Privacy policy

1. Information we handle

• Account and workspace information: name, email, company/workspace, role, login and device-enrollment records, subscription and access settings. Passwords are stored as password hashes.
• Information you enter or import: contacts, phone numbers, email addresses, messages, attachments or file references where supported, requests, offers, tasks, appointments, notes and reports.
• Authorized connected-service information: account identifiers, granted permissions, access and refresh tokens, selected email/calendar content and synchronization metadata. Where a Meta integration is enabled and authorized, this can include WhatsApp account/number identifiers, supported message text and history shared through the official onboarding flow, or authorized social-page information. Availability depends on configuration, provider approval and the permissions you grant; this notice does not mean every integration is already active.
• Team and editorial information: employee assignments, work profiles, deadlines, delivery and approval history, advisory performance reports, brand profiles, campaign briefs, scripts and captions.
• Technical information: essential session cookies, security and access events, timestamps, device/browser identifiers used for enrollment, and service diagnostics. The platform also uses local browser storage for interface preferences.

2. Why we use information

We use information to provide accounts and workspaces; synchronize authorized services; organize contacts and communications; support scheduling, editorial and team workflows; create requested reports and drafts; maintain access controls; investigate errors and abuse; and respond to support and privacy requests. We do not sell your personal information or use connected-service messages for advertising.

3. Access and service providers

Workspace administrators control their staff access and which business information is imported or selected for processing. Authorized staff and service operators may access information as needed for their assigned work, support, maintenance and security. We use infrastructure providers, including OVHcloud for hosted infrastructure, connected-service providers such as Google, Zoho and Meta when you use those integrations, and OpenAI for enabled AI features. These providers handle information under their own terms and policies and may process it outside your country. We may also disclose information when required by applicable law or to protect the service and its users.

4. AI processing and human review

AI processing requires workspace permission. Selected message content may be sent to OpenAI for analysis when an authorized user or configured automation requests it. The social content agent sends the selected brand profile and campaign brief when the owner requests generation. Our API requests disable response storage where implemented, but provider-side processing and retention remain subject to the provider’s policies. AI results can be inaccurate and require human review. Advisory team reports are not a substitute for an employment decision. AI permission does not itself authorize sending a message or publishing content.

5. Connected accounts and revocation

Connect services only when you have authority to do so. OAuth permissions and tokens enable the selected functions without asking you to give us the service password. Stored integration tokens are encrypted. You can disconnect supported accounts in the platform’s Connected accounts section and revoke access separately in the provider’s account or business settings. Disconnecting stops use of the stored connection credentials; it does not automatically erase previously imported messages, contacts, reports or backups.

Meta-connected data is used for the authorized business workflows, not to sell data or create advertising audiences. WhatsApp history sharing, if available, requires the relevant onboarding and sharing approval. A webhook configuration alone does not connect a phone number or give access to all historical chats.

6. Retention and security

Workspace records are retained to support the service and the workspace’s authorized business use until removed or addressed through a deletion request. Security, accounting or other records may be retained where necessary for legitimate operational needs or applicable legal obligations. Backups may contain earlier copies; deletion from backups requires separate backup handling. Contact us for the scope and timing applicable to a specific request. We do not represent that disconnecting an account instantly deletes all backup copies.

We use HTTPS, password hashing, encrypted integration credentials and workspace/role-based access controls. No system can guarantee absolute security. Do not upload information you are not authorized to process, and protect your account and administrator devices.

7. Your choices and requests

You may request access, correction, export or deletion of information relating to you, or ask us to restrict processing or explain the handling of your information, subject to applicable law and necessary identity verification. Email ceo@ccyacademy.com. For business data managed by your employer or another organization, the workspace administrator may need to participate. We assess requests involving other people’s information before disclosing or deleting it.

Follow our data-deletion instructions for a specific request. Do not email passwords, access tokens, one-time codes or entire private conversations.

8. Children and changes

The platform is intended for business use, not as a service directed to children. Contact us if you believe a child’s information was provided improperly. Material changes to this notice will be reflected on this page with an updated effective date.