Privacy Policy

1. Who we are (data controller)

NeoFir is a service operated by ZYNTHYR OÜ, registered in Estonia:

• Registry Code: 17501982
• Registered office: Tallinn, Estonia
• Contact email: hello@neofir.com
• DPO / GDPR email: hello@neofir.com

For any question about your data or your GDPR rights, reach out via either address above. We respond within 30 days at most, per Art. 12(3) GDPR.

2. What data we collect

2.1 From the organization administrator (our direct customer)

Category	Examples	Why
Identification	Full name, email, phone (optional)	Account creation, transactional communication
Organization data	Name, address, opening hours, time zone, service catalogue	Operating the service
Authentication	Google Calendar OAuth tokens (AES-256 encrypted)	Creating events in your calendar
RAG content	Documents you upload (FAQ, prices, services)	Tailoring AI replies to your organization
Billing	Company address, tax ID, amounts paid	Invoice issuance under EE/RO law
Technical logs	IP, dashboard access timestamps, user agent	Security and debugging

2.2 From visitors to your site (your customers)

These users interact with the NeoFir widget embedded on your site. Their data is processed by NeoFir, but you remain the data controller for the relationship with them (see Neofir's DPA for the contract details; accepted at onboarding or signable PDF on request).

• Widget conversation content
• Name, phone, email — if voluntarily provided for a booking
• Requested / confirmed booking date and time
• Anonymous session identifier (technical cookie, not tracking)

We do not collect: precise geolocation, browser fingerprinting, card details (processed by Stripe), nor any special category of data (health, political views, religion, etc.).

3. How we use data

• To provide the service: reply to your customers, check calendar availability, create bookings, send confirmation emails.
• To improve the service: we analyse anonymous aggregates of frequent question types to improve prompts. We do not use your conversations as training data for external LLMs (Google Gemini is accessed via the paid API tier, whose terms exclude the use of submitted content to train Google's models).
• For communication: transactional email (confirmations, system alerts). Newsletter only with explicit consent (Art. 6(1)(a) GDPR).
• For billing: Stripe processes payment; we only see amount, currency and status. Card data never touches our servers.
• For legal compliance: archival of invoices for 10 years (EE and RO tax obligation).

4. Legal basis for processing (Art. 6 GDPR)

Purpose	Legal basis
Operating your account	Contract performance — Art. 6(1)(b)
Processing your customers' conversations	Your legitimate interest as controller — Art. 6(1)(f)
Billing and tax	Legal obligation — Art. 6(1)(c)
Newsletter / marketing	Consent — Art. 6(1)(a)
Security and fraud prevention	Legitimate interest — Art. 6(1)(f)

5. Sub-processors (who we share data with)

We use external providers to operate the service. All are selected for GDPR compliance and we have Data Processing Agreements (DPA) with each:

Provider	Role	Server location	Data transfer
Supabase	PostgreSQL database, authentication	Frankfurt, EU	No extra-EU transfer
Railway	Backend API hosting	EU West	No extra-EU transfer
Vercel	Dashboard hosting	Frankfurt, EU (edge)	No extra-EU transfer
Google LLC	Gemini (LLM) and Google Calendar APIs	USA	SCC + Adequacy Decision (EU-US DPF)
Resend	Transactional email	USA	SCC
Stripe	Payment processing	Ireland + USA	SCC + Adequacy
RoMarg	CDN hosting for widget + landing neofir.com	Bucharest, RO	No extra-EU transfer
Twilio Ireland	SMS OTP + WhatsApp Business (BSP)	Ireland + USA	SCC + EU-US DPF
Meta Platforms Ireland	Instagram Graph API + Messenger Platform	Ireland + USA	SCC + EU-US DPF
Sentry	Backend error tracking (no PII)	USA	SCC
ElevenLabs	Conversational voice agent (call audio + transcripts, only if the phone answering service is enabled)	USA	SCC

The sub-processor list may be updated. We notify you by email at least 30 days before adding a new sub-processor. You may object; if your objection makes the service unworkable, we will help you export your data and close the account without penalty.

Detailed list with DPAs and downstream sub-processors: /sub-processors/en

6. Third-party messaging channels (Instagram, WhatsApp, TikTok)

NeoFir can be connected at your initiative to accounts you own on third-party messaging platforms so the AI assistant can automatically reply to direct messages (DMs) received there. The connection is made exclusively through each platform's official OAuth flow, never via scraping or shared credentials. These channels are optional and inactive until you press the “Connect” button in the dashboard.

6.1 Supported platforms and data processed

Platform	Data NeoFir receives	Data NeoFir sends to the platform
Instagram (Meta)	Organization's Instagram Business account ID, username, connected Facebook Page ID (page_id), sender's platform-scoped ID (PSID), text content of the DM, message ID (mid), timestamp	AI-generated text reply, sent as a DM via the Graph API
Facebook Messenger (Meta)	Organization's Facebook Page ID (page_id), page name, sender's platform-scoped ID (PSID), text content of the message, message ID (mid), timestamp	AI-generated text reply, sent as a Messenger message via the Graph API
WhatsApp	Organization's phone number (JID), sender's phone number (E.164 format), text content, message ID, timestamp	AI-generated text reply, sent through the WhatsApp Web session you authorised
TikTok	Organization's TikTok Business ID, username, sender's user ID, text content of the DM, message ID, timestamp	AI-generated text reply, sent as a DM via the TikTok Business Messaging API

We do not collect from these platforms: contact lists, follower/following lists, end-user profile pictures, messages addressed to accounts other than yours, or any other content from the platform outside DMs sent to your account.

6.2 Access tokens (OAuth)

On connection, the platform issues an access token that lets NeoFir send and receive messages on your behalf. Tokens are:

• AES-256 encrypted before storage in our database (same scheme as for Google Calendar)
• Automatically refreshed before expiry via a cron job (refresh-token flow)
• Fully deleted within 24 hours of pressing the “Disconnect” button in the dashboard
• Never shared with sub-processors other than those strictly required to run NeoFir

6.3 How inbound messages are processed

When an end user sends a DM to your connected account, NeoFir:

1. Receives the message via the platform's official webhook, with HMAC-SHA256 signature verification;
2. Generates a stable visitor identifier of the form ig:<psid>, fb:<psid> (Messenger), wa:<phone> or tt:<user_id> — never cross-linked with identifiers from other systems;
3. Sends the message content to the LLM (Google Gemini) together with your organization's knowledge base, to generate a relevant reply;
4. Sends the reply as a DM via the platform's API and saves it in your conversation history in the dashboard;
5. Applies the same retention policy as for the widget (12 months, then anonymisation — see §8).

6.4 Sub-processors specific to these channels

Provider	Role	Location
Meta Platforms (Instagram + WhatsApp Business)	Source-platform operator; NeoFir is only an API consumer	Ireland + USA (SCC + EU-US DPF)
TikTok / ByteDance	Source-platform operator; NeoFir is only an API consumer	Singapore + Ireland (transfers covered by SCC)

6.5 Disconnection and channel data deletion

You can disconnect any channel at any time from Dashboard · Settings · Integrations. On disconnect:

• Access tokens are deleted immediately (irreversibly)
• The webhook is unsubscribed at the platform
• Historical messages remain in your history under the general retention rules (§8); you can delete them separately with one click

6.6 Regional note (TikTok)

The TikTok Business Messaging API is currently unavailable for accounts registered in the European Economic Area (EEA), the United Kingdom, Switzerland and the USA. If your organization is registered in one of these regions, the TikTok connect button will not be available in the dashboard until the platform expands availability. This limitation is imposed by TikTok, not NeoFir.

6bis. Google Calendar integration (Google API Services User Data Policy)

NeoFir uses the Google Calendar API to synchronize bookings created in NeoFir with your organization's Google calendar. This section explicitly describes what data we obtain through Google APIs and how we use it, in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

6bis.1 OAuth scopes requested and their use

Scope	Use
https://www.googleapis.com/auth/calendar.events	We create, update and delete events in the calendar you select, solely for bookings that originate in NeoFir (the agent replies to a DM or widget message → confirms a slot → creates a Google Calendar event).
https://www.googleapis.com/auth/calendar.readonly	We read the list of your calendars (so you can pick which one NeoFir writes to) and call freeBusy before every slot proposal — the bot avoids hours when you already have an event on your calendar (existing bookings, personal meetings, manually blocked time).
openid, userinfo.email, userinfo.profile	To identify the account that authorized the connection (we display the connecting admin's email in the dashboard).

6bis.2 Google Limited Use compliance

Data obtained from the Google Calendar API is used exclusively to provide and improve the features described in the dashboard (agent-driven scheduling, conflict avoidance, surfacing bookings in the admin UI). Specifically:

• We do not transfer your Google Calendar data to third parties, except: (a) Supabase (database, AES-256 encrypted at rest in the EU), (b) Railway (compute used to call Google APIs). No other sub-processor receives access.
• We do not use Google Calendar data for personalized ads, profiling or marketing.
• We do not use Google Calendar data to train AI models (Gemini or any other LLM). Event content is never sent as training data.
• We do not sell your Google Calendar data.
• NeoFir staff do not read your events, except for rare debug situations when you explicitly authorize us in writing to investigate a specific bug you reported.

6bis.3 Google access tokens and security

• OAuth tokens (access + refresh) are AES-256 encrypted before being written to Supabase (the encryption key is stored in Railway environment variables, separate from the DB).
• The refresh token is used only to obtain a new access token when it expires; it never leaves our backend.
• Transfer to the Google API uses HTTPS (TLS 1.3) with certificate pinning via the official googleapis library.

6bis.4 Retention and deletion

• Google tokens are deleted immediately when you click "Disconnect Google Calendar" in Settings → Integrations (synchronous operation, no delay).
• When you delete your NeoFir account (Settings → Account → Delete account), Google tokens are revoked via https://oauth2.googleapis.com/revoke before the cascade DELETE.
• Events already created in your calendar are not automatically deleted on disconnect — they belong to you, and you decide whether to keep or delete them manually from Google Calendar.

6bis.5 Revoking access on your side

Regardless of the state of your NeoFir account, you can revoke our access at any time directly from Google: https://myaccount.google.com/connections → find "NeoFir" → Remove access. This step guarantees your independence from us.

7. International data transfers

Most data stays in the EU. Three providers involve transfers to the USA:

• Google (Gemini + Calendar API) — to process a conversation and create a booking, the query is sent to the USA. Covered by SCC + EU-US Data Privacy Framework (European Commission adequacy decision from July 2023).
• Resend — email delivery. Covered by SCC.
• Stripe — primarily operated from Ireland; some cloud subprocesses run in the USA. Covered by SCC + Adequacy.

If transfers to the USA are a blocker for you (e.g., you work with public authorities), let us know — we can offer an “EU-only” variant with Mistral / Aleph Alpha instead of Gemini, at additional cost.

8. Data retention periods

Category	Retention	Basis
Active account data	For as long as you are a customer	Contract performance
Widget / DM conversations	12 months; anonymised afterwards	Legitimate interest
Historical bookings	24 months	Legitimate interest + customer reporting
Data after account closure	Deleted within max 30 days	Art. 17 GDPR
Invoices	10 years	EE/RO tax obligation
Security technical logs	90 days; anonymised	Legitimate interest · security

9. Your GDPR rights

You have the following rights, exercisable free of charge, with a reply within 30 days at most:

• Access (Art. 15): we send you a copy of all data we hold about you in machine-readable format (JSON).
• Rectification (Art. 16): we correct any incorrect or incomplete data.
• Erasure / “right to be forgotten” (Art. 17): we delete your account and associated data. Details at /data-deletion.
• Restriction of processing (Art. 18): we can temporarily halt processing while you contest accuracy or legality.
• Portability (Art. 20): we export your data in JSON/CSV for migration to another provider.
• Objection (Art. 21): you can object to processing based on legitimate interest. We stop, except in mandatory legal cases.
• Consent withdrawal: at any time, for processing based on consent (newsletter etc.).
• Complaint to supervisory authority:
  • In Romania: ANSPDCP · dataprotection.ro
  • In Estonia: AKI · aki.ee
  • In your home EU country: your local Data Protection Authority

To exercise your rights, email hello@neofir.com with subject “GDPR — [type of request]”.

10. Security measures

• Encryption in transit: HTTPS / TLS 1.2+ enforced for all traffic
• Encryption at rest: Google OAuth tokens encrypted with AES-256 before DB storage
• Internal access: single-founder access, audit log enabled for any manual production-data query
• Backup: daily, 30-day retention, encrypted, EU-hosted
• Updates: dependencies monitored via Dependabot, critical vulnerabilities patched within 7 days
• Incident response: notification to ANSPDCP/AKI within 72h per Art. 33 GDPR, customer notification within 7 days

11. Cookies and similar technologies

We use the absolute minimum:

Cookie	Purpose	Duration	Type
neofir_session	Maintain widget session across pages	Session	Technical / necessary
sb-access-token	Dashboard authentication (Supabase)	1 hour	Technical / necessary
sb-refresh-token	Session renewal	30 days	Technical / necessary

We do not use: Google Analytics, Facebook Pixel, Hotjar, other third-party trackers, advertising or retargeting cookies.

If analytics tools are added in the future (likely Plausible — EU-hosted, cookie-less), you will be notified and explicit consent will be requested.

12. Processing of minors' data

NeoFir is intended for organization administrators, i.e., adults (18+). The service is not aimed at and not marketed to minors.

Some organizations serve minor clients (parents booking on behalf of children). In that case, the parent/guardian is the data controller. We recommend not voluntarily entering sensitive data about minors in widget conversations.

13. Changes to this policy

We may update this policy. For material changes (new sub-processor, new data category, new purpose), we notify you by email at least 30 days before they take effect. Continued use after notification constitutes acceptance.

For non-material changes (wording clarifications, typo fixes, restructuring), we publish directly and update the date above.

An archive of prior versions is available on request.

14. Contact

← Back to home