How Executive AI Studio handles your personal data.

Executive AI Studio is Uprax Investments (Private) Limited, a company registered in Zimbabwe

This policy is published by Uprax Investments (Private) Limited, trading as Executive AI Studio ("we", "us"), a company registered in Zimbabwe under company number 126041A0272026, with its registered office at 7 Normandy Road, Alexandra Park, Harare. Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] applies to how we handle personal data.

This policy covers:

• This website, executiveai.studio, and the AI assistant on it.
• Our chatbot platform, which businesses ("clients") use to run AI assistants that answer their own customers on a website chat, WhatsApp, Facebook Messenger, Instagram and email.
• The apps we build and run for clients, such as content studios, customer platforms, training tools and dashboards, including signing in to them with Google.

For a business's customers, the business decides how their data is used

When you message a business's assistant on our platform, or use an app we run for a business, we process your data on that business's behalf and on its instructions. The business decides what its assistant or app is for and what it asks for, and its own privacy notice applies as well. Questions about how a particular business uses your information are often answered fastest by that business, and you can always contact us directly too.

For this website, enquiries sent to us, our own client accounts and signing in to the apps we run, we decide how the data is used, and this policy is the notice that applies.

We collect messages, contact details, account details and billing records

• Enquiries. What you send when you email us, call us or use the assistant on this website, including your name, your contact details and any call you book with us.
• Conversations. The messages a customer sends to a client's assistant, including any photo, document, voice note or location they choose to send, and the replies the assistant sends.
• Details a customer chooses to share. A name, phone number or email address, given so the client can follow up on a lead, prepare a quote, take an order or make a booking.
• Messaging identifiers. The WhatsApp phone number, or the Messenger or Instagram account identifier Meta provides, that a message came from, and on Messenger the profile name. The platform needs these to send the reply back to the right person.
• Newsletter. Your email address, and your first name if you give it, when you sign up for the Executive AI Studio Weekly, with the page you signed up on and the date.
• Accounts and sign-in. The name and email address of client staff and app users, and how they sign in: a one-time code or link sent by email, or Sign in with Google.
• Content in an assistant or app. What a client and its team put in, such as knowledge base articles, documents and images.
• Usage and billing records. How each client uses our services, and its invoices and billing records.
• Google account data, only when a client connects its own Google account. This has its own section below.
• Website visits. Our hosting provider receives the technical details every browser sends, such as an IP address. This website uses no analytics or advertising cookies. It stores one setting in your browser so the opening screen shows only on your first visit.

We use this data to answer you and to run our services

• To reply to your enquiry and arrange any call you book.
• To receive a customer's message, generate a reply and send it back on the channel it arrived on.
• To pass leads, quotes, orders and bookings to the client the customer was talking to.
• To let a person on the client's team read a conversation and take it over.
• To run the apps we provide to clients, and to sign people in to them.
• To send the Executive AI Studio Weekly to people who signed up for it. Every email has an unsubscribe link.
• To keep accounts secure, keep our services running, fix faults and prevent abuse.
• To bill clients and keep the financial records the law requires.

The basis for this. We rely on your consent, and for client accounts on our contract with the client. We keep some records because the law requires it, such as invoices. You can withdraw your consent at any time by writing to jon@executiveai.studio.

You do not have to give us personal data. If you choose not to, we may be unable to answer your enquiry, open an account for you or let an assistant help you.

We do not sell personal data, and we do not use it for advertising.

Our assistants tell people they are AI, and AI replies can be wrong

The assistants we build are AI, and they say so.

An AI reply can be wrong. Check anything important, such as a price, a date or a commitment, with the business directly. A person on the client's team can step into a conversation and take it over.

Google user data is used only to sign people in and for the features a client connects

Sign in with Google. When you sign in to our platform or to an app we run with your Google account, Google gives us your name, email address and profile picture. We use them only to sign you in.

Connected Google accounts. A client can choose to connect its own Google account so its assistant can work with Google services. The platform asks only for the access each feature needs:

• Gmail, send only. The gmail.send permission, so the assistant can send email on the client's behalf, such as a quote or a booking confirmation. This permission allows sending mail and gives no access to read the mailbox. The platform does not read the client's mailbox.
• Google Calendar. Reading the client's availability, and creating or updating events, so the assistant can offer open times and record bookings.
• Google Sheets. Reading and writing the spreadsheets the client chooses, so the assistant can look up or record information there.

Google access tokens are stored encrypted. Data received from Google APIs is used only to sign people in and to provide these features to the client who connected the account.

Executive AI Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not sell Google user data.
• We do not use Google user data for advertising, including personalised or retargeted advertising.
• We do not use Google user data to develop, improve or train generalised AI or machine learning models.
• We do not transfer Google user data to anyone else, except as needed to provide the features above, for security purposes, or to comply with applicable law.
• People at Executive AI Studio do not read Google user data, except with the client's permission, when needed for security purposes such as investigating abuse, or to comply with applicable law.

A client can disconnect Google at any time from the platform dashboard, or by removing Executive AI Studio's access on its Google Account permissions page. Either one stops the platform's access to that Google account.

These service providers process data on our behalf

• Anthropic, whose Claude AI models write the assistants' replies. Anthropic's commercial terms state that it does not train its models on content sent through its API.
• Google, which provides Sign in with Google, sends some sign-in emails, runs the Gemini service that searches a client's knowledge base, hosts our own email and calendar, lets an app read the Google Drive folders a client shares with it, and provides the services a client may connect as described above.
• Meta, whose WhatsApp Business Platform, Messenger and Instagram carry messages between customers and assistants, and which publishes posts to a Facebook Page or Instagram account a client connects to an app.
• Coda, part of Superhuman, an online database that stores assistants' settings, knowledge bases and conversations, and our own client records.
• Supabase, which provides databases, file storage and sign-in.
• Railway, which hosts our applications.
• Vercel, which hosts this website and our web dashboards.
• Upstash, which runs the queue that handles background work on the platform.
• Resend, which sends email such as sign-in codes, notifications and our newsletter, and keeps the list of people who signed up for the newsletter.
• ElevenLabs, which turns WhatsApp voice notes into text when a client turns voice notes on.
• Serper.dev, which runs web searches when an assistant or an app looks something up on the web.
• The OpenStreetMap Foundation, whose Nominatim service finds a place from its name when an assistant needs a location.

To write a reply, the content of a conversation is sent to Anthropic. To search a client's knowledge base, the words being searched for are sent to Google. Coda and Supabase use providers of their own, including AI providers, and publish lists of them. Each provider handles data under its own terms and privacy policy.

Write to jon@executiveai.studio for the current list of providers that handle your data.

Your data is processed outside Zimbabwe, and we rely on your consent for it

Most of the providers above process data in the United States. Meta may process messages in its data centres in other countries, and the OpenStreetMap Foundation is in Europe.

We rely on your consent for these transfers outside Zimbabwe, as the Cyber and Data Protection Act allows, and for client accounts also on our contract with the client. You can withdraw your consent at any time by writing to jon@executiveai.studio.

We keep data while an account is active and delete it after the account closes

We keep a client's data, including its customers' conversations, while the client's account is active. We keep it for less time if the client sets a shorter period, or if a person asks us to delete their data.

When an account closes, we delete its data within 30 days. Backup copies are removed within a further 35 days.

We keep invoices and billing records for 6 years, because tax law requires it.

We keep a newsletter subscriber's address until they unsubscribe. After that we keep it only so we do not email them again.

To have your own data deleted, see the data deletion page.

You can ask to see, correct or delete your data, or object to its use

You can ask us:

• To tell you what personal data we hold about you and how we use it.
• To correct data that is wrong or misleading.
• To delete your data.
• To stop using your data, including for direct marketing, free of charge.

Write to jon@executiveai.studio. We confirm we have your request within 5 working days and complete it within 30 days. We may ask a question to confirm the request comes from you. If the law requires us to keep some of the data, such as billing records, we tell you what we kept and why.

If your data came through a business's assistant or app, we tell that business about your request so it can deal with copies in its own systems. After a deletion, we keep only a record that the request was made and completed.

If you are unhappy with how we handle your data, you can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection authority, at www.potraz.gov.zw.

We protect data and report any breach to POTRAZ

Access tokens for connected Google accounts are stored encrypted, and each client's data is available only to that client's own team and to the people who run the service. No way of storing or sending data is perfectly secure, so tell us straight away at jon@executiveai.studio if you think an account has been misused.

If a breach affects personal data we hold, we notify POTRAZ within 24 hours and tell the people affected within 72 hours where there is a real risk of harm to them. If the data belongs to a client, we tell that client as well.

Our services are for adults

Our website, assistants and apps are for people aged 18 and over. If you think a child has given us personal data, write to jon@executiveai.studio and we will delete it.

Changes to this policy are posted on this page

When this policy changes, the new version appears here with a new date at the top. If a change affects how client data is used, we tell clients by email before it takes effect.

Privacy questions go to Executive AI Studio by email

Email jon@executiveai.studio about anything in this policy, or write to Uprax Investments (Private) Limited, trading as Executive AI Studio, 7 Normandy Road, Alexandra Park, Harare, Zimbabwe. The contact page lists our phone numbers.