1. About this policy
This privacy policy explains how Ciconia (“Ciconia”, “we”, “us”) collects, uses, shares and protects personal data when you visit ciconia.me, use the Ciconia web application, APIs, widgets and softphones (the “Service”), or contact a business that uses Ciconia. It should be read together with our terms and conditions, which use the same defined terms.
2. Our role: controller or processor
Businesses that use Ciconia (our “Customers”) decide which channels to connect, whom to talk to and what to do with their conversations. For the messages, calls, recordings, transcripts and contacts they handle through the Service, the Customer is the data controller and Ciconia acts as their data processor — we process that data only on their instructions and to provide the Service to them.
Ciconia is the controller for the personal data of our own website visitors, prospects and the people who hold Customer accounts, and for the operational data we need to run, secure and bill the Service.
If you messaged or called a business that uses Ciconia, that business’s own privacy notice applies to your data, and you should contact them first about it.
3. Information we collect
Account and business information
- names, work email addresses, phone numbers, job roles and sign-in details of the people who use a Customer account;
- the business’s name and the details needed to set up channels, phone numbers and billing.
Conversation and call data processed for Customers
- messages, media, voice notes, reactions and the time they were sent, received and read;
- End Users’ phone numbers, channel identifiers and profile names, and any contact details the Customer adds;
- call details (numbers, times, duration, routing) and, where the Customer turns them on, call audio, recordings and transcripts;
- notes, assignments, tags and other information the Customer’s team adds to a conversation;
- prompts, responses and actions of AI features the Customer configures.
Technical and usage data
- IP addresses, browser and device information, and logs of requests made to the Service;
- diagnostic information about errors, performance and call quality.
Information you send us
- the contents of emails and demo requests you send us, and the details you include in them.
The ciconia.me website itself does not use analytics or advertising trackers and has no sign-up form; the demo form opens your own email app, so we only receive what you choose to send.
4. Data from messaging channels
When a Customer connects a messaging channel to Ciconia — such as a WhatsApp Business Account or a Telegram bot — we receive and store, on that Customer’s behalf:
- identifiers of the connected account and its phone numbers, and the access credentials the channel provider issues so we can act for the Customer;
- inbound and outbound messages, media, calls and their delivery and read statuses;
- End Users’ phone numbers, channel IDs and profile names;
- message templates, call permissions and the account’s messaging limits and quality information.
We use this data only to provide and support the Service for that Customer — to show conversations in their inbox, send their replies, route their calls, and run the AI features they turn on. We do not:
- sell data received from a channel provider, or share it with data brokers;
- use it for advertising, or to build profiles of End Users;
- use it for any purpose other than providing the Service to the Customer who connected the account, or as required by law.
Our use of this data also follows the terms and policies of each channel provider, listed in our terms.
5. How we use information
- to provide the Service: deliver messages and calls, show conversations to the right team, and run the features a Customer enables;
- to create and manage accounts, authenticate Users and enforce the permissions a Customer sets;
- to keep the Service secure, prevent abuse and spam, and investigate incidents;
- to diagnose problems and improve the reliability and performance of the Service;
- to respond to requests, provide support and send service and billing messages;
- to comply with legal obligations and enforce our terms.
We do not use the content of Customers’ conversations or calls to advertise to anyone, and we do not sell personal data.
6. Legal bases
Where data protection law such as the GDPR applies, we rely on:
- performance of a contract — to provide the Service to Customers and their Users;
- legitimate interests — to secure and improve the Service, prevent abuse, and reply to people who contact us, where those interests are not overridden by your rights;
- legal obligation — where the law requires us to keep or disclose information;
- consent — where we ask for it, which you can withdraw at any time.
For data we process on behalf of Customers, the Customer is responsible for having a legal basis for that processing.
8. International transfers
Our service providers and the messaging platforms we connect to may process data in countries other than yours. Where data protection law requires it, we put appropriate safeguards in place for those transfers, such as the European Commission’s standard contractual clauses.
9. How long we keep information
We keep account information for as long as the account is active. Conversation and call data is kept for as long as the Customer keeps it in the Service, or until the Customer asks us to delete it. When an account ends, we delete its data within a reasonable period, unless the law requires us to keep some of it, for example for tax or legal claims. Logs and diagnostic data are kept only as long as needed for security and troubleshooting.
10. Security
We use technical and organisational measures designed to protect personal data, including encryption of data in transit, authentication for every User, and role-based access controls that each Customer manages. No system is completely secure; if we become aware of a breach affecting personal data, we will notify the affected Customers and, where required, the authorities, as the law requires.
11. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. To exercise these rights, email hello@ciconia.me. If we hold your data on behalf of a Customer, we will refer your request to that Customer and help them respond.
You also have the right to complain to your local data protection authority.
12. Data deletion requests
If you are a Ciconia Customer and want us to delete your data — including data received through a connected WhatsApp account or other messaging channel:
- email hello@ciconia.me with the subject “Data deletion request”;
- include the business name on your account and the phone number or channel account you want removed;
- we will verify that the request comes from the account owner, delete the data, and confirm by email when the deletion is complete.
You can also remove Ciconia’s access in the channel provider’s business settings at any time, which stops us receiving new data from that account.
If you messaged or called a business that uses Ciconia, that business controls your data. Ask the business to delete it; if you contact us instead, we will pass your request on to them.
14. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal data from children for our own purposes.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date, and for material changes we will also notify account administrators.
16. Contact
Questions about this policy or your personal data? Email hello@ciconia.me.