Privacy Policy

This Privacy Policy explains how Candela ("we", "us") collects, uses and shares information when you visit candela.sh, use the Candela dashboard at app.cntillion.com, or talk to an AI assistant that a business runs on Candela by chat, voice, email, WhatsApp, or text message (SMS).

Who this applies to

• Customers: businesses that sign up for Candela and configure an assistant.
• End users: people who contact one of those businesses through a Candela assistant. For end-user conversations, the business decides why and how the conversation is used; we process that data on the business's behalf and under its instructions.
• Visitors to our website.

What we collect

• Account data: name, email address, business name, phone number, and billing details (processed by our payment provider; we do not store full card numbers).
• Conversation data: messages, call audio and transcripts, email content, the phone number or other identifier you contact us from, and time stamps.
• SMS data: your mobile number, the messages you send and receive, delivery status, and your opt-in and opt-out (STOP/START) history.
• Usage and device data: pages visited, browser type, IP address, and similar data collected by cookies and analytics tools.
• Contact form data: name, email address and message when you write to us.

How we use it

• To provide the service: answer messages and calls, route conversations to the business's staff, send the notifications the business has set up, and keep conversation history.
• To operate, secure and improve Candela, including debugging and abuse prevention.
• To bill customers and communicate with them about their account.
• To comply with law and enforce our Terms of Service.

We do not sell personal information.

Text messaging (SMS)

Businesses use Candela to answer text messages from their customers and to send them messages in a conversation the customer started, such as answers to questions and booking and appointment details. Business owners and staff who opt in may also receive account alerts by SMS, such as a notice that a conversation needs their attention and a daily activity summary.

• Opt-in: texting a business's number is consent to receive replies in that conversation. Any other messages, such as reminders or recurring notifications, are sent only after you give the business separate express consent. Business owners and staff enroll in account alerts by registering their mobile number in the Candela dashboard. Consent to receive text messages is not a condition of any purchase.
• Frequency: message frequency varies with your conversation. Owner alerts: up to one message per conversation that needs attention, plus one daily summary.
• Cost: Msg & data rates may apply.
• Opt-out: reply STOP at any time to stop receiving messages. You will receive one final message confirming the opt-out. Reply START to opt back in.
• Help: reply HELP for help, or email privacy@cntillion.com.
• Carriers are not liable for delayed or undelivered messages.

No sharing of mobile information. We do not share, sell, rent or trade mobile phone numbers, SMS opt-in data or consent with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share mobile information only with the service providers that deliver the messages for us, such as our SMS carrier provider, and only to provide the service.

Who we share information with

• The business you are talking to, which can read its conversations in the Candela dashboard.
• Service providers that run parts of Candela for us under contract: cloud hosting, databases, telephony and SMS delivery, AI model providers that process message content to generate replies, email delivery, analytics, error monitoring and payments. They may use the data only to provide their service to us.
• Legal and safety: when required by law, or to protect the rights, safety and property of our users, the public, or Candela.
• Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

Retention

We keep conversation data for as long as the business's account is active or as the business configures, and account data for as long as your account exists. We delete or anonymize data when it is no longer needed, unless the law requires us to keep it.

Security

We use encryption in transit, access controls and other measures to protect personal information. No system is fully secure.

Your rights

Depending on where you live (for example California under the CCPA/CPRA, or the EU and UK under the GDPR), you may have the right to access, correct, delete or port your personal information, and to object to or restrict certain processing. If your data is part of a conversation with a business, we will forward your request to that business or help it respond. To make a request, email privacy@cntillion.com. We will not discriminate against you for exercising these rights.

Children

Candela is not directed at children under 13, and we do not knowingly collect their personal information.

International transfers

We are based in the United States, and our service providers may process data in other countries. Where required, we use appropriate safeguards for those transfers.

Changes

We may update this policy. We will post the new version here with a new effective date and, for material changes, notify customers by email or in the dashboard.

Contact

Candela, 201 Spear Street, San Francisco, CA 94105. Email: privacy@cntillion.com.