Privacy policy

1. Our role

For your account data (name, email, company, billing) Wupli acts as controller. For the data you upload or receive in the CRM about your own customers and prospects, Wupli acts as processor: it handles that data on your instructions and to provide the service.

2. What we collect

Account and billing data; data you load into the CRM (contacts, opportunities, notes, file uploads); the content of conversations you choose to bring into the CRM (messages, emails on threads started from the CRM, call results and recordings); and technical usage data (access logs, audit trail, security IP records).

We do not deliberately collect special categories of data. If your business handles them (a clinic, for example), you decide what goes into the CRM and on what lawful basis.

3. Why

To provide the service, bill it, protect it (audit, abuse prevention, usage limits) and improve it. We do not sell data, do not pass it to data brokers and do not use it for third-party advertising.

4. Subprocessors

We operate with the following providers, under contract and only to provide the service: Supabase (database, authentication and file storage); Vercel (hosting and application runtime); Stripe (payments and billing); Resend (Wupli's own system email); Anthropic and OpenAI (AI models for assisted features, including vector representations of the product documentation); respond.io (WhatsApp, Instagram and Facebook messaging); autocalls.ai (assisted outbound calls).

When you connect your own Gmail or SMTP server, that provider is yours and email goes out under your identity, not ours. We will publish any change to this list here with reasonable notice.

The providers above process data primarily in the United States. By using the service you accept that processing.

5. AI and automated decisions

AI-assisted features draft messages and answer questions about how to use the product. An AI-generated draft is never sent on its own: it waits in the approval queue until a person approves it. We do not make automated decisions with legal effects about the people whose data you upload.

6. Retention

We keep your workspace data while the account exists and, after cancellation, for a reasonable period — up to 90 days — to allow reactivation or export, unless you request deletion sooner. Audit and billing records are kept for as long as the law requires.

You can export your data at any time and request deletion by writing to us from your workspace.

7. Individual rights

If you are a customer of a company that uses Wupli CRM, direct your access, correction, deletion or objection request to that company, which controls the data. Wupli will assist them in handling it.

Residents of US states with applicable privacy laws may exercise the rights those laws grant; we neither sell nor share personal data for targeted advertising.

8. Communications and consent

Marketing emails you send from the CRM carry an unsubscribe link and honor the suppression list. Assisted calls require documented consent, respect the do-not-call list and only dial inside the recipient's local time window.

9. Security

Encryption in transit and at rest, third-party credentials encrypted at field level, per-company isolation enforced in the database, mandatory two-factor authentication, audit logs and backups. No system is infallible; we will notify you without undue delay of an incident that affects you.

10. Minors

The service is for business use and is not directed to anyone under 18.

11. Changes and contact

We will publish any change here with its effective date. Write to us from your workspace with the help button or at the contact address published on wupli.ai.