Privacy Policy

1. What This Policy Covers

This Policy explains:

• What Personal Information we collect
• How and why we use it
• When we share it, and who our sub-processors are
• How we safeguard it
• Your rights under Canadian privacy law, and under U.S. state privacy law

“Personal Information” means information about an identifiable individual, including information that directly or indirectly identifies you.

2. Accountability & Privacy Officer

Peakify Hub Inc. is responsible for Personal Information under its control.

We have designated a Privacy Officer responsible for compliance with Canadian privacy laws.

Privacy Officer Contact:

Philip Akoji

Email: support@peakifyhub.com

Subject Line: Privacy Request

Mail:
Peakify Hub Inc.
214 Selkirk Avenue
Winnipeg, Manitoba, Canada R2W 2L6

3. Information We Collect

We collect Personal Information directly from you, automatically through our website, and from third parties where appropriate.

A. Information You Provide

Contact & Inquiry Information

• Name
• Email address
• Phone number
• Company name
• Website URL
• Message content
• Information shared via webchat

Client & Service Information

If you engage our Services, we may collect:

• Billing details
• Business information
• Marketing assets and materials
• Campaign data
• CRM integrations
• Payment and transaction information

Marketing Preferences

• Consent records
• Communication preferences
• Channel selections (email, SMS, WhatsApp, etc.)

B. Information Collected Automatically

When you visit our website, we may collect:

• IP address
• Browser and device information
• Pages visited
• Session duration
• Referral sources
• Cookie identifiers

This information is collected using cookies, analytics tools, and tracking technologies.

C. Information from Third Parties

We may receive information from:

• CRM and automation platforms
• Advertising platforms (e.g., Meta, Google, LinkedIn)
• Analytics providers
• Payment processors
• Business partners

We only collect such information where lawful and necessary for providing our Services.

4. How We Use Your Information

We use Personal Information for the following purposes:

A. Providing Services

• Responding to inquiries
• Delivering marketing and automation services
• Managing client accounts
• Processing payments

B. Business Operations

• Internal reporting and analytics
• Service improvement
• Auditing and compliance
• Preventing fraud

C. Personalization & Optimization

• Improving website performance
• Enhancing user experience
• Delivering relevant content

D. Marketing Communications

In compliance with Canada's Anti-Spam Legislation (CASL), we send commercial electronic messages only where we have:

• Express consent, or
• Implied consent permitted by law

All marketing messages include:

• Our business identification
• Contact information
• An unsubscribe mechanism

You may withdraw consent at any time.

5. Legal Basis for Processing

Under Canadian privacy laws, we process Personal Information based on:

• Your meaningful consent
• Contractual necessity
• Legitimate business interests
• Legal and regulatory obligations

Where required, we obtain express consent before collecting or using your information.

6. Sharing of Personal Information

We may share Personal Information with:

Service Providers

• Website hosting providers
• Cloud storage providers
• CRM and marketing platforms
• Email and SMS delivery providers
• Analytics providers

These providers are contractually obligated to safeguard your data. Section 7 (Sub-Processors & Service Providers) names the specific providers we use and what each one does.

Legal Requirements

We may disclose Personal Information to comply with laws, court orders, or lawful government requests.

Business Transactions

If Peakify Hub Inc. is involved in a merger, acquisition, restructuring, or sale of assets, Personal Information may be transferred as part of that transaction, subject to safeguards.

We do not sell Personal Information.

7. Sub-Processors & Service Providers

We use a number of third-party service providers (“Sub-Processors”) to operate the Services. Each Sub-Processor processes Personal Information on our behalf, under contract, and only as needed to provide the function described below — they are not permitted to use your Personal Information for their own independent purposes.

• Supabase, Inc.: Managed Postgres database, authentication, file storage, and edge functions. The primary store of customer data.
• Vercel Inc.: Application and website hosting, edge runtime, and aggregate, cookie-light site analytics.
• Cloudflare, Inc.: Private object storage (R2) for conversation attachments and uploaded files, delivered only through short-lived signed links, and the Turnstile bot check on public forms.
• Upstash, Inc.: Managed Redis used for rate limiting and short-lived caching on sign-in, signup, and AI endpoints.
• Functional Software, Inc. (Sentry): Application error monitoring. Error reports can include request context; personal information is scrubbed before sending where possible.
• Stripe, Inc.: Payment processing, card tokenization, and subscription billing. Peakify never stores full card numbers.
• Telnyx LLC: Voice and SMS carrier, phone numbers and 10DLC registration, voice AI including call recording and summaries where enabled, and Telnyx-hosted text models (Kimi-K2.6 and GLM-5.2) that serve as the primary AI provider for replies, message classification, and summaries.
• OpenAI: Fallback AI provider for replies, classification, and summaries when the primary provider is unavailable, and content moderation on inbound messages. Not used to train OpenAI models.
• Anthropic, PBC: Fallback AI provider, used only when the primary and secondary providers are unavailable.
• Chatwoot (self-hosted by Peakify): Former shared-inbox software, kept only to hold a backup of past conversations on the Chatwoot server, rented from Elestio (listed below), until that backup is deleted.
• Elestio: Managed hosting for the Chatwoot server above, kept only to hold a backup of past conversations until it is deleted. Elestio operates the machine; Peakify operates the software on it.
• Meta Platforms, Inc.: WhatsApp Business Platform, Facebook Messenger, and Instagram direct message delivery. Messenger and Instagram are turned on for a business account by account. Messaging channels only; Meta is not engaged for advertising.
• Mailgun Technologies, Inc. (a Sinch company): Transactional email delivery: signup, billing, and system notifications.
• AC PM LLC (Postmark, part of ActiveCampaign): Transactional email delivery: signup, billing, and system notifications, when EMAIL_PROVIDER is set to postmark (Mailgun otherwise).
• Google LLC: Google Analytics 4 on public marketing pages where configured, and Firebase Cloud Messaging for mobile push notifications where enabled.
• Rewardful: Affiliate referral tracking on the public marketing site, where enabled, so a signup can be credited to the partner who referred it. Loads only after a visitor accepts non-essential cookies.

The full list, with where each provider processes data and the notice we give before it changes, is published on our Sub-Processor List. We review our Sub-Processors on an ongoing basis and require each one to maintain safeguards appropriate to the Personal Information it processes, and we give at least thirty (30) days’ notice before engaging a new one, as that page describes.

8. Meta Platforms (WhatsApp, Messenger, Instagram) Integration

We offer a SaaS solution that uses Meta’s WhatsApp Business API, Messenger Platform, and Instagram Messaging API to enable “click-to-connect” and unified messaging for our customers. Messenger and Instagram are turned on for a business account by account; a business only connects a Facebook Page or Instagram account once we have enabled it for their account. Every conversation is stored and managed inside our own inbox, on our own infrastructure. This section describes in plain language how we handle messaging data across all three.

Data we access via Meta’s APIs

When you or your business uses our messaging integration, we access the following information through Meta’s API in order to provide the unified inbox:

• Message content: Text, images, and other media sent via WhatsApp, Messenger, or Instagram direct messages.
• Sender information: The names of people who message the connected business, phone numbers (for WhatsApp), and the Facebook or Instagram identifier Meta assigns to that person for messaging with your business (this identifier is different for every business a person messages). We never ask Meta for a profile picture.
• Page and account information: The name of the connected Facebook Page, and the connected Instagram account’s username, so we can label the inbox correctly.
• Metadata: Timestamps and message status (e.g., delivered, read).

Purpose of processing

We collect and process this data to provide a unified interface for businesses to manage and respond to customer inquiries. Our lawful basis for this processing is the performance of our contract with you (providing the messaging integration service).

Who this applies to

• Business customers: If you use our integration to connect your Meta channels to your inbox, we process your account and configuration data, and the message content that flows through our systems, to operate the integration.
• End users: If you are someone who messages a business via WhatsApp, Messenger, or Instagram that uses our integration, your messages are processed by Meta under Meta’s Privacy Policy and Data Policy, and by that business. We act as a service provider to the business and do not use your information for our own marketing or sell it.

Data storage and security

Messaging data that passes through our systems is stored on our private, secure infrastructure. We use encryption (e.g., SSL/TLS) to protect data in transit between Meta’s systems and our servers. We are responsible for the security of this data and follow the safeguards described in section 13 (Safeguards & Security).

Data sharing: we do not sell your data

We do not sell user data. Data received via the messaging integration is shared only with:

• Meta: To send and receive messages through WhatsApp, Messenger, and Instagram.
• The business user: The business communicating with their customers. They see and manage the conversations in their own dashboard.

Data deletion and disconnecting your account

You may request deletion of your data or disconnect your integration at any time. To submit a Data Deletion Request, contact our Privacy Officer at support@peakifyhub.com with the subject line “Data Deletion Request.” Business users can also disconnect their Meta channels from our integration from within their account or settings; we will remove or anonymize the associated data from our systems in accordance with our retention practices. For full details on your rights and how to exercise them, see section 16 (Your Rights) and the Data Deletion section below.

Compliance

We use Meta’s APIs in compliance with Meta’s terms, platform policies, and applicable data processing terms. For more on what we collect and how we use it across our Services, see sections 3, 4, and 6 above.

A former unified inbox

We used to run messaging through an additional shared-inbox tool, Chatwoot, self-hosted on our own server. Every customer has since moved to our own native inbox, and Chatwoot no longer sends, receives, or stores any live message. We keep a backup of the conversations it used to hold, on the same server, until that backup is deleted. See our Sub-Processor List for details.

9. AI Processing & Model Training

Our AI features process the content of your account — including messages sent and received through the AI web-chat widget, SMS text-back, voice AI, and shared inbox — to generate replies, qualify leads, and summarize calls.

Telnyx is our primary AI provider for both text and voice: replies, message classification and summaries run on text models hosted by Telnyx, and voice AI runs on Telnyx. OpenAI is our fallback provider when the primary is unavailable, and Anthropic is a further fallback after that. Content is sent to these providers only as needed to generate a response or summary and to deliver the Services. Under OpenAI’s API terms, content submitted through its API is not used to train OpenAI’s models.

AI-generated content is a tool that assists the businesses using our Services; it does not replace human judgment, and businesses remain responsible for reviewing AI-generated communications where accuracy matters.

10. Voice Call Recording & Summarization

Where a business customer enables our voice AI feature, calls placed to or from numbers provisioned through the Services may be recorded, and the recording may be transcribed and summarized using AI so the business can manage the conversation.

We act as a service provider to the business in connection with this processing. Where a business customer uses this feature on its own phone line, that business is responsible for providing any caller notification required in its jurisdiction (for example, notice that a call may be recorded). Recordings, transcripts, and summaries are retained in accordance with section 12 (Data Retention).

11. International Transfers

Your Personal Information may be stored or processed outside Canada (including the United States or other jurisdictions where our service providers operate).

When this occurs, your information may be subject to foreign laws. We implement reasonable safeguards, including contractual protections, to ensure appropriate protection. See section 7 (Sub-Processors & Service Providers) for the specific providers involved.

12. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy, including:

• Delivering Services
• Legal and regulatory compliance
• Business and accounting requirements
• Dispute resolution

This applies to every category of Personal Information we process, including account and configuration data, billing and transaction records, conversation data handled through our AI web-chat widget, SMS, and shared inbox, and the voice recordings, transcripts, and summaries described in section 10 (Voice Call Recording & Summarization). When Personal Information is no longer required for these purposes, it is securely deleted or anonymized.

Signup & Fraud Prevention Data

When you submit a signup form, we record your IP address, user agent, and email alongside the attempt outcome (accepted/rejected) for fraud prevention. These records are deleted automatically after 90 days. Verification codes used during signup are likewise retained for no longer than 90 days.

13. Safeguards & Security

We implement appropriate physical, administrative, and technical safeguards, including:

• Encrypted connections (SSL/TLS)
• Secure cloud hosting
• Access controls
• Role-based permissions
• Contractual safeguards with service providers
• Regular monitoring and security reviews

While no system can guarantee absolute security, we take reasonable measures to protect Personal Information.

If a data breach occurs that poses a real risk of significant harm, we will notify affected individuals and relevant regulators as required by Canadian law.

14. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Operate the website
• Analyze traffic and performance
• Improve marketing campaigns
• Enable webchat functionality

Analytics and referral cookies load only after you accept them in the cookie banner; strictly necessary cookies are always on. Our Cookie Policy lists every cookie we use and lets you change your choice. You may also control cookies through your browser settings. Disabling certain cookies may affect website functionality.

15. Automated Decision-Making

We may use automated systems to:

• Analyze website usage
• Score and route leads and conversations through our AI-assisted qualifying flow
• Detect spam or fraudulent activity
• Optimize advertising performance

These processes support our Services and do not produce legal or similarly significant effects concerning an individual without human involvement. For example, our lead-qualifying flow may automatically score and route a conversation to a business, but on its own it does not make a decision that legally or similarly significantly affects that individual.

If you have questions about automated processing that involves your Personal Information, or you wish to object to it, contact us at support@peakifyhub.com.

16. Your Rights (Canada)

Under Personal Information Protection and Electronic Documents Act and applicable provincial laws, you may have the right to:

• Access your Personal Information
• Request correction of inaccurate information
• Withdraw consent
• Request deletion (subject to legal limitations)
• Challenge our compliance with privacy laws

To exercise your rights, contact our Privacy Officer at support@peakifyhub.com.

Data Deletion Requests

If you want your Personal Information deleted (including data associated with our Meta/WhatsApp integration, or held in the retired Chatwoot backup described above), you may submit a request at any time. We will process valid requests in accordance with applicable law.

• Email: support@peakifyhub.com (use subject line: Data Deletion Request).
• Business users: You can also disconnect your Meta channels from our integration in your account or settings; we will remove or anonymize the associated data from our systems as described in section 8.

If you are not satisfied with our response, you may file a complaint with:

• Office of the Privacy Commissioner of Canada
  Website: https://www.priv.gc.ca
• If you are located in Quebec, you may also contact the Commission d'accès à l'information du Québec.

17. Your U.S. & California Privacy Rights

We do not sell or share your Personal Information, as those terms are defined under U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

If you are a California resident, or a resident of another U.S. state with an applicable privacy law, you may have the right to request access to, or deletion of, your Personal Information, and to be free from discrimination for exercising these rights.

To exercise these rights, contact us at support@peakifyhub.com. We will verify your request and respond within the time required by applicable law.

18. SMS & Text Messaging Consent

If you receive a text message from a business that uses our Services, that business has obtained your consent to text you, in accordance with Canada's Anti-Spam Legislation (CASL) and, where applicable, the U.S. Telephone Consumer Protection Act (TCPA).

Reply STOP to any text message to opt out of future messages from that business, or reply HELP for help. Message and data rates may apply, and message frequency varies by business and conversation.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.

We process text messages on behalf of the business you are messaging, as described in section 4 (How We Use Your Information) and section 7 (Sub-Processors & Service Providers). Our SMS Terms describe the text-message program, including how to opt out and get help.

19. Children

Our Services are intended for businesses and individuals over the age of 16. We do not knowingly collect Personal Information from children.

20. Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or business changes. The updated version will be posted on this page with a revised “Last Updated” date. For material changes, we will make reasonable efforts to notify registered account holders by email before the change takes effect.

We will not materially reduce your rights without notice where required by law.

21. Contact Us

If you have questions, concerns, or complaints regarding this Privacy Policy or our handling of Personal Information:

• Email: support@peakifyhub.com
• Mail:
  Peakify Hub Inc.
  214 Selkirk Avenue
  Winnipeg, Manitoba, Canada R2W 2L6
• Website: https://peakifycx.com