Privacy Policy

StepUp Operations Platform ("StepUp", "we", "our", "us") respects your privacy. This Privacy Policy explains how we collect, use, and protect information when you use our SaaS application, AI tools, and integrations with third-party messaging services (including Meta's Facebook, Instagram, and WhatsApp APIs).

1. Information We Collect

• Account Information: When an Admin logs in, we collect your username, role, profile data, and session activity.
• Third-Party Integrations Data: To provide our Unified Inbox, we collect and process messages, sender IDs, and timestamps sent via Facebook Messenger, WhatsApp Business, and Instagram Direct.
• End-User ("Customer") Data: With your permission and connections, we ingest data about the people who message your business pages. This includes phone numbers, names, and interaction histories.
• Automated Tracking: Device usage (such as browser type and IP address) for security and auditing logs.

2. How We Use the Information

We use your data strictly to operate and improve the StepUp platform, including:

• Displaying conversations in the Unified Inbox and resolving complaints/leads.
• Generating AI-assisted auto-responses (via OpenAI) to support your customer service.
• Monitoring platform stability, logging errors, and tracking agent performance.

We never sell your conversational data or customer databases to third parties. We do not use your private inbox data to train public AI models.

3. Data Sharing & Third Parties

Your data may be securely transferred to these infrastructure sub-processors:

• OpenAI: For evaluating messages or generating semantic responses (if AI is enabled).
• PostgreSQL/ChromaDB Servers: Our hosted databases storing application state and vector knowledge base.
• Meta Platforms Inc: When syncing Webhooks and sending replies back to Messenger, WhatsApp, or Instagram.

4. Meta SDKs and APIs

By authorizing the StepUp app on Facebook (via `pages_show_list`, `pages_manage_metadata`, and `pages_messaging`), you permit us to manage these business assets. You can revoke these permissions at any time via your Facebook Business Integrations page.

5. Data Retention, Deletion & Your Rights

You may request immediate deletion of your entire workspace, API tokens, and customer threads at any time. For exact instructions on how to trigger a complete data wipe, please see our Data Deletion Instructions.