Privacy Policy

AutomiQ is a business automation service operated by KW Catering & Consulting OY (Y-tunnus: 2521859-1), Helsinki, Finland. Contact: info@automiq.fi

When you connect your Google account to AutomiQ, we access only the specific Google services you authorize (Gmail, Google Sheets, Google Drive, Google Calendar). We do not store your Google credentials. OAuth tokens are stored securely and used only to execute your automations.

Your data is used exclusively to run the automation workflows you have configured. We do not sell your data. The third-party services that process it are listed in section 6. We process gateway clients' data to perform our contract with them. We rely on our legitimate interest to answer requests and to keep our services secure. We rely on your consent for analytics cookies. For the messages of gateway clients' end users we act as a processor on the client's behalf (see section 8). For our own website and account data we are the controller.

Workflow configurations and execution logs are stored in secured cloud infrastructure. Our database and our hosting functions are in the Frankfurt region. The third-party services listed in section 6 may process data in other locations. We keep data only as long as needed for the purpose it was collected for, then delete or anonymise it.

Audit logs of sign-ins and administrative actions are kept for 12 months and then deleted. IP addresses in the portal audit log are removed after 90 days.

We store a nightly copy of our database as a backup. It is encrypted before it is uploaded, and only the controller holds the key. The copy is kept in a private Google Drive account with 2-step login, access is limited to the controller, and each copy is kept for 14 days.

Under GDPR you have the right to access, correct, or delete your data at any time. Contact us at info@automiq.fi to exercise these rights.

To request erasure of your data, write to info@automiq.fi. Backup copies age out within 14 days.

AutomiQ uses the services below. For each one we say what it does, which data it receives and whether it loads before you accept cookies.

• Vercel hosts this website and the AutomiQ application and runs its server functions in Frankfurt, Germany. It processes the technical data of each request, such as your IP address, the page you ask for and your browser type. It is part of every visit and does not wait for cookie consent.
• Supabase provides the database and the sign-in service, in the Frankfurt region (eu-central-1). It stores client records, the email addresses of client portal users, sign-in sessions (with IP address and browser user agent), WhatsApp gateway delivery logs, and counters that limit repeated requests by IP address. It also sends the sign-in link by email to client portal users.
• Client portal users can sign in with Google. Google then tells us the verified email address of the account.
• Google Analytics measures how the site is used. It loads only after you accept analytics cookies, and never on the WhatsApp connection page. Google receives your IP address, device and browser details, the pages you view and the usage events your browser sends.
• Cloudflare Turnstile is a security measure against automated abuse of our request forms. We list it here because its script loads when you open a request form on the home page or the WhatsApp page, without waiting for cookie consent. Cloudflare receives your IP address and browser details from your browser. Our server also sends Cloudflare the check token and your IP address to verify it.
• n8n (n8n Cloud, hosted in the EU) handles what you send through the request forms (name, email, company and form type) and the chat widget (your messages, the conversation so far, the page language and the site you are on, plus your name, email and phone number if you fill in the lead card). It sends the emails that follow a request. The website chat runs on an AI model hosted on our own server, not on a third-party AI provider. The chat widget does not wait for cookie consent.
• Meta runs the WhatsApp Business Platform, which handles the data described in section 8. The WhatsApp connection page also loads Meta's Facebook JavaScript SDK in your browser for Embedded Signup, without waiting for cookie consent. Meta then receives your IP address and browser details and the authorisation you give there, which gives us the IDs of your WhatsApp Business account and phone number and an access token.
• When the chat suggests booking a time, it shows a link to Calendly. We load nothing from Calendly on our site. What you enter there goes to Calendly under its own privacy policy.
• AutomiQ integrates with Google Workspace APIs. Our n8n workflows use Google Sheets and Google Docs: form submissions are appended to a Google Sheet, and the WhatsApp assistant reads a Google Doc and logs to a Google Sheet. Your use of Google services is subject to the Google Privacy Policy.

Some of these services (Vercel, Cloudflare, Google and Meta) may process data outside the EU/EEA. Where they do, they use safeguards such as standard contractual clauses or the EU-US Data Privacy Framework, as described in each provider's own privacy policy.

KW Catering & Consulting OY
info@automiq.fi
Helsinki, Finland

Where AutomiQ provides WhatsApp-based automation services on behalf of a client business, AutomiQ processes the following categories of data via the WhatsApp Business Platform (operated by Meta Platforms, Inc.):

• End-user phone numbers
• Message content sent and received through the client's WhatsApp Business number
• Conversation metadata (timestamps, message status)

This data is processed solely to deliver the automation and conversational agent services configured by the client business, and is not used for advertising, profiling, or any purpose outside the agreed service scope.

The AutomiQ WhatsApp gateway forwards message content without storing it and logs delivery metadata only, which it keeps for 90 days. Message identifiers, which may include phone numbers, and hashes of webhook events are kept for 48 hours to prevent duplicate processing.

AutomiQ acts as a data processor on behalf of the client business (the data controller) for any personal data of the client's end users exchanged via WhatsApp. Client businesses remain responsible for obtaining appropriate consent from their own end users under GDPR.

Use of the WhatsApp Business Platform is additionally subject to Meta's WhatsApp Business Policy and Meta Privacy Policy, available at whatsapp.com/legal/business-policy and facebook.com/privacy/policy.