Privacy Policy

1. Introduction

This Privacy Policy describes how Creatizo Media Holdings Limited (“FrontDesk.ie,” “we,” “us,” or “our”), a company registered in Ireland (CRO: 798461), collects, uses, and shares information when you use our AI-powered front desk and commerce copilot services, including the FrontDesk AI Copilot plugin for WooCommerce (“Plugin”), the FrontDesk dashboard, and related managed services (collectively, the “Services”).

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the ePrivacy Directive, and other applicable data protection laws.

Data Controller:

Company: Creatizo Media Holdings Limited

Trading as: FrontDesk.ie

Registration: CRO 798461

Email: [email protected]

Address: Dublin, Ireland

2. Information We Collect

2.1 Information You Provide

Account information: name, email address, phone number, business name, billing information

Business data: product catalogues, service menus, pricing, opening hours, staff names, booking and e-commerce platform details

Communication data: messages, voice notes, images, and documents shared through our platform between you and your customers

Payment information: processed securely through Stripe. We do not store card details directly

2.2 Automatically Collected Information

Usage data: features used, conversation metrics, performance data

Plugin telemetry: aggregate usage statistics (AI call counts, token volumes, cost estimates, plugin version). Telemetry is aggregate-only and contains no customer personal data (see Section 5.3)

Device information: IP address, browser type, operating system

Log data: access times, pages viewed, system activity

2.3 Information from Third Parties

Social media platforms: when you connect WhatsApp, Instagram, or Facebook Messenger to our Services

E-commerce and booking platforms: when you integrate WooCommerce, Fresha, Phorest, Booksy, or other platforms with our Services

3. How We Use Your Information

3.1 Primary Purposes

Provide and maintain our AI front desk and commerce copilot services

Process AI-powered conversations and commerce actions on your behalf

Handle customer support and respond to your enquiries

Process payments and manage subscriptions

Send service updates and important notifications

Improve our Services based on aggregate usage patterns

3.2 AI Processing

We use AI language models from third-party providers to power conversations and commerce features on your behalf.

Your data is not used to train AI foundation models

AI processes your data solely to deliver our Services

All AI processing is governed by Data Processing Agreements with our providers

AI disclosure is included in every agent’s opening message to your customers

We do not permit our AI providers to use your data for their own purposes

3.3 AI Processing Legal Basis

AI-powered processing is carried out under Article 6(1)(b) GDPR (contract performance). Where AI processes your customers’ data, the legal basis is your instruction to us as data processor under Article 28 GDPR. AI does not make automated decisions with legal or similarly significant effects on individuals under Article 22 GDPR.

3.4 Legal Bases for Processing (GDPR)

Contract performance (Art. 6(1)(b)): to provide the Services you have subscribed to

Legitimate interests (Art. 6(1)(f)): to improve our Services, ensure security, and conduct B2B outreach

Consent (Art. 6(1)(a)): for marketing communications. You may withdraw consent at any time

Legal obligations (Art. 6(1)(c)): to comply with applicable Irish and EU laws

4. Data Sharing and Sub-Processors

4.1 Named Sub-Processors

We share data with the following service providers, all operating under Data Processing Agreements:

A complete and current list of sub-processors is maintained and available upon request at [email protected]. We will notify you in advance of any material changes to sub-processors (see DPA Section 4.2).

4.2 We Do NOT

Sell your personal data to any third party

Share data for third-party advertising or marketing purposes

Transfer data outside the EU/EEA without appropriate safeguards (Standard Contractual Clauses)

Allow sub-processors to use your data for their own purposes

5. Data Residency and Access Controls

5.1 Where Your Customers’ Data Lives

Plugin clients: your customers’ operational data (orders, contact details, conversation history, product information) lives in your own WordPress installation and is never copied to or stored on our servers. AI conversations and messaging are routed through our platform infrastructure hosted in the European Union. The Plugin sends only aggregate telemetry to our servers (licence state, plugin version, AI usage counts) — no customer data.

Managed Agent clients: your customers’ data (conversations, contacts, campaign data) is stored on our platform infrastructure in the European Union (Hetzner, Germany).

In both cases, our servers additionally store:

Your account configuration

Aggregate telemetry (AI call counts, token usage, cost estimates per month)

Your dashboard user account and session data

5.2 Access Controls

We do not routinely monitor or review your customer conversations. We access your data only for setup, configuration, optimisation, troubleshooting, and at your specific request. All access is logged.

5.3 Telemetry Data

The Plugin sends aggregate usage telemetry to our servers (licence key, site identifier, plugin version, AI call counts and token totals). This telemetry contains no customer personal data — no names, phone numbers, email addresses, order details, or conversation content.

6. Data Retention

Upon account termination, we delete or anonymise your data within 30 days, except where retention is required by law.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

Access (Art. 15): request copies of your personal data

Rectification (Art. 16): correct inaccurate or incomplete data

Erasure (Art. 17): request deletion (“right to be forgotten”)

Portability (Art. 20): receive your data in a machine-readable format

Restriction (Art. 18): limit processing in certain circumstances

Object (Art. 21): oppose processing based on legitimate interests

Withdraw consent (Art. 7): at any time for consent-based processing

Not be subject to automated decision-making (Art. 22): our AI does not make decisions with legal or similarly significant effects

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Cookies and Tracking

8.1 Essential Cookies

Our website and chat widget use essential cookies required for basic functionality. These do not require consent.

8.2 Analytics Cookies

We do not currently use analytics or tracking cookies. If we introduce them, we will update this policy and obtain your consent.

8.3 Chat Widget Cookies

Our website chat widget sets functional cookies to maintain your conversation session.

8.4 Third-Party Cookies

Interactions via WhatsApp, Instagram, or Facebook Messenger are subject to those platforms’ cookie policies.

9. Data Security

We implement appropriate technical and organisational security measures including:

Encryption in transit (TLS 1.2+) across all services

Application-level credential encryption using authenticated encryption

Access controls and role-based authentication

Timing-safe credential verification

PII masking in all application logs

Regular review of security practices

Incident response procedures

In the event of a personal data breach, we will notify the Data Protection Commission within 72 hours and notify affected individuals where required.

10. International Data Transfers

Your data is primarily processed within the EU/EEA (Germany and Ireland). Where data is processed outside the EU/EEA (specifically, AI language model providers based in the United States), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and conduct transfer impact assessments.

11. Your Customers’ Data

11.1 Data Controller and Processor Roles

11.2 Your Responsibilities as Data Controller

Must have a lawful basis to process your customers’ data

Should inform customers that AI handles initial conversations

Must honour data access, deletion, or opt-out requests from your customers

11.3 Our Obligations as Data Processor

Process personal data only on your documented instructions

Ensure confidentiality obligations for our staff

Implement appropriate security measures

Assist you in responding to data subject requests

Notify you of any personal data breach without undue delay

Delete or return all personal data upon termination

Not routinely access your customer conversations; access only for service delivery and at your request

11.4 Data Processing Agreement

A standalone Data Processing Agreement is available and governs our processing of your customers’ personal data under GDPR Article 28. The applicable DPA depends on your service model. Contact [email protected] to request a copy.

11.5 STOP / Opt-Out Requests

We honour STOP requests immediately across all channels

Contacts are permanently excluded from future automated messages

Opt-outs are logged for compliance records

12. AI-Specific Disclosures

12.1 AI Transparency

Every AI agent discloses it is an AI assistant in its opening message

AI does not make autonomous decisions with legal effects

AI does not engage in profiling under GDPR Article 4(4)

Human handoff is available for complex requests

12.2 AI Accountability

Denis Colli (Founder) oversees AI quality and accuracy

Conversations are periodically reviewed for compliance

13. Chat Widget and AI Agent

Our website, and websites operated by our clients, may use an AI-powered chat widget. This section explains how that widget handles your information.

13.1 You Are Chatting With an AI

The chat widget is operated by an AI assistant, which is disclosed at the start of the conversation. A human can take over the conversation at any time, and you can ask to speak to a person.

13.2 Who Is Responsible for Your Data

On the FrontDesk.ie website, the data controller is Creatizo Media Holdings Limited (CRO 798461). On a client’s own website, that business is the data controller and we act as their data processor.

13.3 How We Use What You Share in Chat

Any details you provide in the chat (such as your name, email, or phone number) are used to respond to your enquiry. We do not add you to any marketing or automated outbound messaging list on the basis of a chat interaction alone.

Before any phone number or email address receives marketing or automated outbound messages, separate explicit consent is required. If that consent is not confirmed, the contact is suppressed and is not messaged.

Your chat messages are processed to answer you and are not used to train AI foundation models. Our AI providers are bound by Data Processing Agreements and may not use your data for their own purposes.

13.4 Stopping Messages and Deleting Your Data

To stop messages or request deletion of anything you shared in the chat, type STOP in the chat or email [email protected]. We action opt-out and deletion requests promptly and permanently exclude the contact from future automated messages.

14. Marketing Communications

We obtain consent before sending marketing communications

Every marketing message includes an unsubscribe option

Service-related communications are sent regardless of marketing preferences

We honour STOP and unsubscribe requests immediately

15. Children’s Privacy

Our Services are designed for business use by adults. We do not knowingly collect data from individuals under 16.

16. Changes to This Policy

Material changes notified via email at least 30 days before taking effect

Minor changes may be made without advance notice

The “Last updated” date will always reflect the most recent revision

17. Complaints

If you are unhappy with how we handle your data, contact us first at [email protected]. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie at any time.

18. Contact Us

Creatizo Media Holdings Limited

Trading as FrontDesk.ie

Dublin, Ireland

Email: [email protected]

CRO: 798461