Phoros Cloud privacy, account and data deletion

1. Who we are and what this policy covers

Phoros Cloud is a business operating platform provided by Phoros Cloud Ltd ("Phoros," "we," "our," or "us"). This Privacy Policy explains how we collect, use, share, protect, retain, and delete personal information when you visit our website, use the Phoros Cloud applications and virtual staff, connect other services, or contact us.

Businesses and other organizations ("customers") use Phoros Cloud to run their operations, and their records can include personal information about their own customers, guests, patients, employees, and contacts. For that information, we act on the customer's behalf and under its instructions, and the customer decides how it is used. If your information is held in a Phoros Cloud workspace run by a business you deal with, please contact that business about it; we will help them respond.

2. Information we collect

2.1 Information you give us

• Account information: name, email address, phone number, organization name, role, sign-in details, and billing details.
• Business records: information entered into or created in the Service, such as contacts, invoices, transactions, inventory, payroll, appointments, messages, files, website content, and notes.
• Work you give virtual staff: the jobs, instructions, and questions you give virtual staff, and the drafts, records, and other output they produce.
• Communications: messages, support requests, website enquiries (such as the "Tell us about the job" form), and deletion requests you send us.

2.2 Information from services you connect

When an authorized person connects another service, such as QuickBooks Online, Google Workspace, Microsoft 365, Meta (Facebook and Instagram), WhatsApp, Mercury, Cloudbeds, Event Temple, Fireflies, Airtable, Figma, or Google Cloud, we receive the information that service makes available under the permissions granted, such as accounting records, emails and calendar entries, messages, reservations, meeting recordings and transcripts, and files. We access connected services only to provide the features the customer uses.

2.3 Information collected automatically

• Usage information: how the Service is used, features accessed, actions taken, and related logs.
• Device information: browser type, operating system, device identifiers, and IP address.
• Cookies and similar technologies: used to keep you signed in, remember preferences, secure the Service, and understand how it is used. On our public website, and only if you choose Allow on our privacy prompt, we also use Meta's advertising cookies (the Meta pixel) to measure our ads and show them to people likely to find them useful. Advertising cookies are never used inside the signed-in Service.

3. How we use information

• Provide, operate, maintain, and support the Service, including carrying out work you assign to virtual staff.
• Connect to and exchange data with the services you choose to connect.
• Process payments, manage subscriptions, and send invoices and receipts.
• Send service messages, security alerts, and updates, and respond to requests.
• Secure the Service, and detect, prevent, and address fraud, abuse, misuse, and technical issues.
• Understand how the Service is used, in aggregated or de-identified form, to improve it.
• Advertise Phoros Cloud on Meta's services (Facebook, Instagram, Messenger, Threads and WhatsApp) and measure how well our ads work, as described in "Advertising with Meta" below.
• Comply with law and enforce our agreements.

We do not sell personal information, and we do not use customer business records or connected-account data for advertising.

Advertising with Meta

• On our website: if you choose Allow, the Meta pixel records visits and actions on our public pages, such as viewing the trial page or sending us an enquiry.
• When you sign up: if you chose Allow before signing up, our servers tell Meta that a sign-up or trial start happened, with your email address and phone number in hashed form (scrambled one way, so they cannot be read back), so Meta can match it to an ad you saw. If you did not choose Allow, we send nothing.
• Audiences: we may share the hashed email addresses and phone numbers of Phoros Cloud account holders with Meta, to show our ads to account holders or leave them out, and to find businesses similar to our customers. Meta uses the hashed details only to match them to its users and deletes them after matching.
• Meta may also use what its pixel and our sign-up events tell it as described in its own privacy policy, for example to improve how it delivers ads.

4. Virtual staff and artificial intelligence

Virtual staff use AI models to read the information a job needs, draft content, prepare records, and take the actions a customer allows. To do this, the relevant information is sent to AI model providers, such as Anthropic, OpenAI, and Google, which process it to return a result.

• We do not use customer business records or connected-account data to train AI models, and we choose AI providers whose business terms do not allow them to train their models on the data we send them.
• Customers control which tools, data, and connected accounts each virtual staff member can use, and which actions need a person's approval.
• If a customer connects its own AI service account, such as a Claude Code, Codex, or Kimi Code account, the information processed through that account is also subject to the customer's agreement with that provider.
• AI output can be wrong. Customers are responsible for reviewing it before relying on it.

5. Connected accounts, including QuickBooks Online

An administrator of a connected account authorizes each connection through that service's own sign-in. For example, a QuickBooks Online company is connected only after an administrator of that company approves access through Intuit. Phoros then accesses that company's accounting data, such as company details, accounts, customers, vendors, items, invoices, bills, payments, and reports, through the QuickBooks Online Accounting API.

• We use connected-account data only to provide the features the customer uses, such as showing and reconciling its books and letting its staff and virtual staff review records and prepare entries.
• The access keys a service issues for a connection are encrypted at rest, are never shown in the app, and are not shared with other parties. We do not write connected-account credentials or QuickBooks data to our logs.
• A connection can be removed at any time in Phoros Cloud (Settings, then Connections) or from the connected service. When it is removed, we stop accessing the service, revoke our access where the provider allows, and delete the stored connection keys. Records already in the connected service are not changed.
• Our use of data received from connected services also follows the terms each provider sets for apps that connect to it.

6. How we share information

We share personal information only as described here:

• Service providers: companies that host and operate the Service for us under contract, including cloud hosting (Amazon Web Services), AI model providers, email delivery, payment processing, and meeting transcription when a customer enables it. They may use the information only to provide their services to us.
• Advertising partners: Meta Platforms, Inc. and its affiliates receive the information described in "Advertising with Meta" in section 3, to deliver and measure our ads. For that information Meta acts under its own terms and privacy policy, at facebook.com/privacy/policy.
• Services you connect: information is exchanged with connected services as directed by the customer, for example when virtual staff send a message or record a transaction.
• Within a customer's workspace: information in a workspace is visible to people and virtual staff the customer authorizes.
• Legal and safety: when required by law or legal process, or to protect the rights, safety, and security of our customers, users, the public, or Phoros.
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this policy.
• With consent: for any other purpose with your consent.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit, encryption of connected-account keys and other sensitive credentials at rest, access controls and authentication requirements, logical separation of each customer's data, monitoring, and backup and recovery practices. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected customers as required by law.

8. Data retention

We keep information while an account is active and as needed to provide the Service, meet legal and accounting obligations, resolve disputes, prevent misuse, and enforce agreements. After an account ends, customers may request an export within 30 days, after which we delete or de-identify its data subject to the retention periods above. The deletion section above explains the main categories and periods that apply after a request. You can submit an account or data deletion request here.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information, to receive a portable copy of it, and to withdraw consent where processing relies on consent. You can update much of your account information in the Service, use the deletion form above, or contact privacy@phoroscloud.com. We may need to verify your identity before acting on a request. If your information is held by a business that uses Phoros Cloud, we will refer your request to that business or help it respond.

Advertising choices: you can change your Allow choice at any time with "Privacy choices" at the bottom of every page of our website. You can ask us to leave you out of the audiences we share with Meta by emailing privacy@phoroscloud.com, and we will remove you before our next upload. You can also manage how Meta uses your information in your Meta account's ad preferences.

10. Where information is processed

The Service is hosted in the United States, and our team and service providers may process information in Jamaica and other countries. These countries may have different data protection laws from yours. Where required, we use safeguards intended to protect information in accordance with applicable law.

11. Children's privacy

The Service is for businesses and is not intended for children under 16. We do not knowingly collect personal information from children under 16 for our own purposes. Customers that record information about minors in their workspace, such as patients or guests, are responsible for doing so lawfully.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the "Last updated" date, and we will give notice of material changes by email or in the Service.

13. Contact us