Privacy Policy

Who we are. RingPost is operated by RINGPOST (SMC-PRIVATE) LIMITED (Islamabad, Pakistan), referred to here as “RingPost”, “we” or “us”. You can reach us about anything in this policy through our contact page.

1. Two kinds of people, two different relationships

Almost everything below turns on this distinction, so it comes first.

Businesses. If you sign up for RingPost, we are the controller of your account data. You chose to be here, and this policy is our agreement with you about it.

Your customers. When someone calls, texts or messages a business that uses RingPost, their personal data passes through our systems. They never signed up with us and in most cases have never heard of us. For that data, the business is the controller and we are only the processor: we hold it on that business’s instructions, and we do not decide what happens to it.

This has a practical consequence worth stating plainly. If you are a customer of a business that uses RingPost and you want your data seen, corrected or deleted, ask that business. They can do it themselves in their dashboard, and we will help them if it needs more than that. We will not act on your data without their instruction, because it is not ours to act on. The full terms of that arrangement are in our Data Processing Addendum.

What we will never do with a business’s customers’ data, on anyone’s instruction: sell it, use it to advertise to those people, use it to train an AI model of our own, or use it to benefit any other business on the platform.

2. What we collect

Information you give us

• Business account details: business name, owner name, email, phone number, business type, and address if you provide one.
• Business configuration: your services, prices, hours, policies and knowledge-base content. This is what your AI receptionist answers from.
• Payment information: collected and processed directly by our payment provider. We never see or store your full card details.

Information collected as you use the Service

• Bookings and appointment records.
• Reviews synced from platforms you connect.
• Usage and log data: timestamps, which features are used, error logs.

Information about your customers: the part that matters most

This is data about people who contacted your business, not people who signed up with us. We hold it on your instruction, as your processor.

• Contact details: name, phone number, email address, and social media handle where they messaged from one.
• The content of their conversations with your business, on every connected channel: SMS, WhatsApp, Instagram and Facebook messages and comments, Threads replies and email.
• Call audio and transcripts. Calls answered by the AI may be recorded and transcribed. Recording is announced at the start of the call by default. See Call Recording and AI Disclosure.
• Booking history: what they booked, when, with whom, and whether they turned up.
• Anything they volunteer in a message. A customer may mention a health condition to a clinic or a gym without being asked. We do not solicit it and the Service is not designed to hold it, but where it appears in a message it is stored as ordinary message content. Having a lawful basis for that is yours as controller.
• Contact preferences: which channel they use, and whether they have opted out. A customer who replies STOP is opted out immediately and automatically, and that decision is honoured across every channel.

3. What we use it for

• Running the Service: generating AI responses grounded in your real business data.
• Processing bookings and sending confirmations and reminders.
• Generating marketing content and publishing it to platforms you connect, at your direction.
• Detecting and preventing abuse, fraud or terms violations.
• Maintaining and improving reliability.
• Contacting you about your account, billing, and material changes.

We don’t sell your data, or your customers’ data, to anyone.

4. Who else touches your data

Running this Service means sending some data to specialist providers: for AI replies, images and video, phone calls and SMS, messaging, email, calendar sync, reviews, social publishing, payments, and hosting.

Each provider only processes what it needs for its specific job, under its own data protection obligations. We don’t permit them to use your data for their own independent purposes.

We may also disclose information where the law requires it, to protect our legal rights, or in connection with a business transfer, in which case we’d tell affected users.

5. Meta platforms: WhatsApp, Instagram, Facebook and Threads

When a business connects WhatsApp, Instagram, Facebook or Threads, we use its messages, comments, replies and post insights only to answer, publish and book for that business; we never sell them, use them for advertising or use them to train an AI model, and you can request deletion through our Data Deletion Instructions.

6. Google user data

RingPost uses Google Calendar data only to check availability and manage the appointments booked through it, and its use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Security

We take reasonable technical and organisational measures to protect your data: sensitive values such as stored access tokens are encrypted at rest, access is restricted, and the system enforces tenant-level isolation at the database layer so one business’s data cannot be reached through another business’s account.

No system is perfectly secure and we won’t claim otherwise. We commit to investigating any suspected incident promptly and telling affected customers where it matters.

8. How long we keep it

We keep your business’s data while your account is active, and for a reasonable period afterwards in case you want to reactivate or export it. After that it’s deleted or anonymised, unless we’re required to keep it longer for legal or accounting reasons.

9. The chat on this website

The chat assistant on ringpost.tech is an AI. When you use it, we keep what you type and what it replies, plus any name, email address, phone number or business name you choose to give us, so our team can follow up and so we can see which questions the website isn’t answering well. We use it only to reply to you and to improve the website and product. We don’t sell it or use it to advertise to you elsewhere.

Chat transcripts are kept for 12 months and then deleted. The replies are generated by our AI provider, which processes the text only to produce the reply. To have your chat deleted sooner, use our contact page.

10. Your rights

Depending on where you are, you may have the right to access, correct, export or delete your personal data. Follow our Data Deletion Instructions or use our contact page. We acknowledge deletion requests within 72 hours and complete verified requests within 30 days.

If one of your customers wants to exercise similar rights over data held in your account, they should contact your business directly. You hold the customer relationship, and we process that data on your behalf.

11. Cookies

This site and the dashboard use cookies for essential functions such as keeping you signed in, and for basic analytics. You can control cookies in your browser, though disabling essential ones will break parts of the Service.

12. Children

The Service is for business owners and isn’t directed at children. We don’t knowingly collect personal information from anyone under 16.

13. International processing

Your data may be processed and stored outside your own country by the providers described above. Using the Service means consenting to that, under the terms of this policy.

14. Government and law enforcement requests

We may be asked by a public authority to hand over personal data. This is how we handle that, and it applies to every request, wherever it comes from.

• We check that the request is lawful. Every request is reviewed before anything is disclosed: that it comes from an authority with jurisdiction over us, that it is served through the proper legal process, and that it is valid on its face. We do not disclose data on an informal or voluntary request.
• We challenge requests we believe are unlawful. Where a request appears to be overbroad, improperly served, or without a legal basis, we will push back on it and, where necessary, contest it through the appropriate legal channel rather than comply.
• We disclose the minimum. Where we must comply, we give only the specific data the request actually compels, for the people it names and the period it covers. We do not provide bulk exports, direct access to our systems, or anything beyond the narrow scope of the order.
• We write it down. We keep a record of each request, what we disclosed, the legal reasoning, and who was involved in the decision.
• We tell the people affected. Where a business’s data is involved, we notify that business, unless a court order or the law forbids us from doing so.

15. Changes

We may update this policy. Material changes will be communicated by email before they take effect.

16. Contact

Questions about this policy or your data: use our contact page.