Privacy Policy

1. Introduction

Kongko Inspira Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our WhatsApp AI assistant service ("Service") and website qenn.ai.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. Data Controller

Kongko Inspira Ltd is the data controller for the personal data we collect.

• Address: 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN.
• Company Number: SC823803.

3. Data We Collect

3.1 Information You Provide

• Account Data: Name, email address, WhatsApp phone number, business name, and trade.
• Payment Data: Billing address and transaction records (processed by Stripe; we do not store card details).
• Communications: Messages you send to our support channels.

3.2 Content and Usage Data

• Messages: Text, images, and documents sent via WhatsApp to Qenn for processing.
• Voice Data: Audio recordings and transcripts of calls handled by our AI Receptionist feature.
• Generated Documents: Quotes, invoices, and schedules created by Qenn on your behalf.
• Integration Data: When you connect third-party services (e.g., Google Calendar, QuickBooks), we access and process data necessary to provide the Service (contacts, events, invoices) strictly per your authorization.

3.3 Automatically Collected Data

• Usage Data: Timestamps, interaction logs, error reports, and feature usage statistics.
• Device Data: IP address, browser type, and device information for security and analytics.

4. How We Use Your Data

• Service Provision: To process your messages, generate quotes/invoices, and manage your CRM.
• AI Processing: To analyze your requests using Large Language Models (LLMs).
• Billing: To manage subscriptions and process payments.
• Support: To provide customer support and troubleshooting.
• Security: To detect fraud, abuse, and security incidents.
• Legal Compliance: To meet tax, regulatory, and legal obligations (e.g., HMRC record keeping).

5. Legal Basis for Processing

• Contractual Necessity: Processing required to fulfill your subscription contract and provide the Service.
• Legitimate Interest: Service improvement, security, fraud prevention, and analytics.
• Consent: For marketing communications and non-essential cookies (where applicable).
• Legal Obligation: Compliance with tax and regulatory laws.

6. Data Sharing and Sub-processors

We do not sell your personal data. We share data only with trusted sub-processors who assist us in operating the Service:

7. Google API Services & Limited Use

When you connect a Google account (e.g., Google Calendar), Qenn requests access only to the data needed to provide the features you enable. Qenn's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google Workspace APIs:

• Is used only to provide or improve user-facing features that are prominent in Qenn's requesting interface;
• Is not transferred to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior user consent;
• Is not used or transferred for serving advertisements, including retargeting, personalised, or interest-based advertising;
• Is not read by humans unless we first obtain your affirmative agreement, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymised.

Qenn does not use Google Workspace API data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models.

8. International Transfers

Our primary data processing occurs in the UK and European Union. Where data is transferred outside the UK/EU (e.g., WhatsApp messaging via Meta, payment processing, or voice telephony), we ensure protection through the UK-US Data Bridge Framework, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.

9. Data Retention

• Active Accounts: Data is retained for the duration of your subscription.
• Account Deletion: Personal data is deleted or anonymized within 30 days of account closure, subject to legal retention requirements.
• Financial Records: Invoices and transaction data are retained for 6 years to comply with HMRC regulations.

10. Your Rights

Under the UK GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data ("Right to be Forgotten").
• Right to Restrict Processing: Limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interest.
• Right to Withdraw Consent: Withdraw consent at any time (where processing is consent-based).

To exercise your rights, contact us at [email protected]. We will respond within 30 days.

11. Security

We implement industry-standard security measures to protect your data:

• Encryption: Data encrypted at rest (AES-128) and in transit (HTTPS/TLS 1.3).
• Access Control: Strict role-based access controls and authentication.
• Monitoring: Regular security audits and vulnerability assessments.

12. Children's Privacy

Our Service is intended for business use by individuals aged 18 and over. We do not knowingly collect data from children. If we become aware that we have collected data from a child, we will delete it immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of the Service constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or complaints about this Privacy Policy or our data practices, please contact:

• Email: [email protected]
• Post: Data Protection Officer, Kongko Inspira Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN, Scotland.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk.