DevInTouch Customer Care Privacy Notice

Version 1.1 · Effective 30 September 2026

1. Scope and roles

DevInTouch Customer Care (the Service) is a business customer-care and CRM platform. The Service provider (DevInTouch, we) is Общество с ограниченной ответственностью «ВоркХаб» ("WorkHub LLC" is an explanatory translation only and is not asserted to be its registered English name).

• Registration number and taxpayer number (УНП): 193233482.
• Registered by the Minsk City Executive Committee on 18 October 2023, certificate No. 0221834.
• Location: 220007, Республика Беларусь, г. Минск, ул. Могилёвская, 2, корпус 2, кабинет 14.
• Telephone/fax: +375-17-242-81-87, +375-29-588-44-27.

The provider's location does not by itself determine the governing law or dispute forum for the Service.

For a business customer's account, user administration, security, support, contract and billing records, DevInTouch determines why and how the data is used and acts as controller to the extent required by applicable law.

For messages, contacts and CRM records belonging to a business customer (the Customer or Tenant), the Customer normally determines the purposes and lawful basis and acts as controller. DevInTouch processes that data on the Customer's documented instructions as its processor or service provider. An end user should normally contact the business whose Facebook Page, Instagram professional account, website or other channel they used.

Meta Platforms and other channel providers process data under their own terms and privacy notices. This notice does not describe or replace their independent processing.

2. Current and planned channels

The Service can organise conversations and CRM records from channels enabled for a Customer. The exact enabled functions are shown in the Customer's configuration and contract.

Instagram messaging is connected for the DevInTouch professional account. Availability for other Customer accounts and Facebook Messenger depends on their separately enabled connections. Connecting a channel does not itself enable AI. This notice applies to data received and sent through an authorised connection.

3. Data we may process

Depending on the enabled functions, the Service may process:

• Customer and authorised-user business contact details, account roles, authentication and access records, settings, support communications, contract and billing records, and security or audit events;
• end-user names, usernames and channel-scoped identifiers supplied by the connected channel;
• message text, attachments, timestamps, language and conversation history;
• Page, Instagram professional account, inbox and conversation identifiers;
• delivery, read, reaction and other channel-event metadata made available by the channel;
• CRM status, assignments, notes, handover state, tags and related service records;
• notice or consent evidence where the Customer has configured it;
• technical, security, deduplication and diagnostic metadata; and
• connection credentials and metadata needed to maintain an authorised channel connection, such as access tokens. We do not ask users to send their Facebook or Instagram password to DevInTouch.

When separately enabled for DevInTouch Instagram customer care, the OpenAI API may process message text and relevant conversation and business context to generate replies, qualify an enquiry and suggest or update CRM status. This can include personal information a person includes in their message. Only context needed for the configured task should be submitted; credentials are not conversation context. AI replies may be inaccurate and require human review where appropriate. You may request a human through the conversation or the privacy contact below. Publication of this notice does not switch on AI or establish a lawful basis by itself.

3a. OpenAI processing for the DevInTouch Instagram AI feature

The configured AI provider is OpenAI (OpenAI OpCo, LLC). The service uses the OpenAI API, not consumer ChatGPT. The configured project uses Global processing rather than a country-exclusive residency commitment. Service infrastructure is hosted in Lithuania; onward OpenAI processing may occur in the United States and other countries where OpenAI and its subprocessors operate, including relevant support access. A complete country-specific processing guarantee is not made. See the current OpenAI subprocessor list and Data Processing Addendum; applicable Customer instructions and transfer safeguards remain required.

The configured Responses API requests use store=false and do not use background mode. This is not Zero Data Retention. Under OpenAI's standard API controls, abuse-monitoring logs may include prompts, responses and associated metadata and are retained for up to 30 days, unless longer retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. No approved Zero Data Retention arrangement is claimed. The 30-day period is not a deletion deadline for records held in our CRM, Chatwoot or backups; section 8 applies to those records.

OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. The DevInTouch configuration requires voluntary sharing for model training to remain disabled before and while the AI feature is enabled. See OpenAI API data controls. Do not send passwords, payment-card details, identity documents or sensitive personal information in the chat.

4. Why data is used

Data is processed only as needed to:

• connect an authorised business channel;
• receive, route, display and reply to customer-care messages;
• maintain the Customer's contact, conversation and CRM records;
• support assignment, human handover and configured workflows;
• administer accounts and authorised users;
• secure the Service, prevent misuse, deduplicate events, investigate errors and maintain proportionate audit evidence;
• provide support and fulfil the applicable agreement; and
• respond to valid privacy, deletion, legal and security requests.

DevInTouch does not use Tenant conversation data for its own advertising and does not use it to train a DevInTouch general-purpose AI model.

5. Who may receive data

Data may be available only as necessary to:

• the Customer's authorised users and administrators;
• authorised DevInTouch personnel supporting and securing the Service;
• the self-hosted Chatwoot communication component and related databases operated within the Service infrastructure;
• the approved infrastructure and backup provider;
• Meta Platforms when a Facebook or Instagram channel is connected;
• an AI or other optional provider only when the Customer has separately enabled that feature and the required documentation and controls apply; and
• authorities or professional advisers where disclosure is required by law or necessary to protect legal rights and security.

A planned integration is not treated as an active recipient until it is enabled. Information about the current processing path, subprocessors and applicable safeguards for an enabled Customer configuration is available through the Customer's contract documentation or from the privacy contact below.

6. Legal grounds and Customer instructions

The Customer is responsible for identifying and documenting the lawful basis, notices and choices required for its end-user communications. DevInTouch processes Customer Data under the Customer's instructions and the applicable data-processing agreement.

For data DevInTouch controls itself, the applicable basis may include requested pre-contract steps, contract performance, legal obligations, legitimate interests in operating and securing the Service, or consent where required. The applicable ground depends on the person, purpose and jurisdiction.

7. International processing

Channel and infrastructure providers may process data in more than one country. No country-exclusive processing or data-residency guarantee is made. The actual processing path and applicable safeguards depend on the enabled Customer configuration and are described in the applicable Customer documentation or are available from the privacy contact below.

8. Retention and deletion

No universal fixed retention period applies to every data category.

Customer Data is kept according to the Customer's documented instructions, configuration and agreement, only for as long as needed for the configured Service, security, dispute handling and applicable legal obligations. Connection credentials are retained only while needed for the authorised connection and are revoked, replaced or deleted through the approved offboarding process.

Deletion is coordinated across the Product CRM and Chatwoot records. Protected backups may remain until they expire through the documented backup cycle, and limited records may be retained where law or a documented legal hold requires it. Applicable periods and deletion commitments are defined in the Customer's Order Form, data-processing agreement or approved retention policy.

See the Customer Care data deletion instructions.

9. Security

The Service uses risk-based measures that include access controls, tenant separation, protected credentials, encryption in transit, minimised logging, backups, vulnerability management and incident handling. No security measure can eliminate every risk.

10. Rights and requests

Depending on applicable law, a person may request information, access, correction, deletion, restriction, objection, portability or withdrawal of consent. End users should first contact the Customer that controls the Page, Instagram account or other channel. DevInTouch will assist the Customer as required by the applicable agreement and law.

Requests may also be sent to privacy@devintouch.com. We may verify identity and authority using the minimum information reasonably needed. Do not send a password, access token, payment-card number, government ID or other sensitive document unless specifically and lawfully required through an approved secure process.

11. Changes and contact

Material changes will be communicated through an appropriate public, account or contract channel where required. The current version and effective date appear at the top of this page.

• Provider: Общество с ограниченной ответственностью «ВоркХаб».
• Location: 220007, Республика Беларусь, г. Минск, ул. Могилёвская, 2, корпус 2, кабинет 14.
• Telephone/fax: +375-17-242-81-87, +375-29-588-44-27.
• Customer Care privacy contact: privacy@devintouch.com.