Privacy policy

1. Who is responsible

OO-Apps Ireland Operations is the planned operator of Corpoo (“we”, “us”). The full registered name and the date the change takes effect must be confirmed before publication.

Registered address from the Visioo Privacy Notice: 18 Mallow Street, Co. Limerick, Limerick, V94N12Y, Ireland. For a privacy request, use the Corpoo Contact page and identify your request as “Privacy / Data protection”. A dedicated contact channel must be verified before launch.

2. Our role and our customers’ role

We act as controller when we decide why and how account administration, billing, website inquiries, service security and our own business communications are processed.

For lead lists, campaign content, connected mailbox messages, uploaded product knowledge and workflow records processed on a customer’s instructions, the customer will generally act as controller and Corpoo as processor. That processing must be governed by a DPA. If a customer is itself a processor, the contractual roles must be adjusted accordingly.

Lead sourcing or enrichment may involve other controllers. The actual providers, sources and allocation of responsibilities must be documented; this draft does not classify every lead-sourcing operation as processor-only.

3. Information we process

Account and business details: names, business email addresses, company information, user roles and subscription details.

Authentication and service security: credentials or authentication references, access events, device information and diagnostic records, depending on the implementation.

Communications: demo requests, contact form messages, support correspondence and information you choose to provide.

Customer workspace data: prospect details, imported CSV records, segments, stop-lists, campaigns, message content, knowledge documents, AI inputs and outputs, decisions, errors and escalations, where used by the customer.

Billing and payment records: invoice details and transaction information handled through the selected payment provider. The precise payment data held by Corpoo must be confirmed.

Website usage and cookies: information from technologies actually deployed, as described in the Cookie policy and confirmed inventory.

4. Purposes and legal bases

We use account and communication data to respond to requests and provide services. The basis is steps towards a contract or contractual necessity where the individual is a party; for business representatives it is generally our legitimate interest in managing the business relationship.

Security, abuse prevention and service administration rely on legitimate interests, subject to a balancing assessment. Records required for accounting, tax or regulatory purposes are processed to meet legal obligations.

Optional analytics, advertising technologies and communications requiring consent must rely on valid consent. You may withdraw that consent. Customer-directed processing follows the customer’s lawful instructions under the DPA, rather than a legal basis chosen by Corpoo on the customer’s behalf.

5. AI and outreach data

Depending on the feature, AI processing may use product knowledge, prospect and conversation context to prepare replies, generate content or support workflow decisions. All plans, including Basic, support autonomous replies and human escalation. Replies requiring review may be prepared as drafts.

Before launch, the operator must identify each AI provider and verify its retention, training-use and international-transfer settings. This draft makes no promise that data is never used for training or processed only in the EU.

Customers must explain their outreach processing to recipients and honor relevant rights and objections. A recipient can contact the business that sent the message; requests received by Corpoo for customer-controlled data will be handled with that customer under the DPA.

6. Recipients and transfers

Personal data may be accessed by authorized personnel and contracted providers needed for hosting, authentication, email connectivity, AI processing, lead sourcing, billing, CRM and support, to the extent actually used. Some providers may act as independent controllers for their own purposes.

The actual provider list, purposes and processing locations must be completed before publication. Visioo’s HubSpot, Typebot and Shopify references are not treated as confirmed Corpoo providers.

Transfers outside the EEA require a valid mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, with any additional measures required. The transfer map and safeguards must be verified and made available through the privacy contact.

7. How long we keep data

Account data is retained for the active relationship and afterwards only for specified support, security or legal purposes. Inquiry records are retained while needed to respond and manage the relationship. Billing records follow applicable statutory requirements.

Workspace data, AI records, mailbox content and backups must follow the agreed DPA and a documented deletion schedule. Security logs and cookie data must have separate, defined retention settings.

Concrete periods or meaningful retention criteria for each category, including deletion from backups and after cancellation, must be added before publication. Data needed for a legal claim may be retained for the relevant claim period.

8. Your rights and choices

Where applicable, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent without affecting processing already lawfully carried out.

Contact us through the verified privacy channel. We may need proportionate information to verify your identity. Where a customer controls the data, we will assist or direct the request to that customer as appropriate.

You may complain to the Irish Data Protection Commission at dataprotection.ie or another competent supervisory authority. We will respond to rights requests within the time limits required by applicable law.

9. Security, required information and updates

We must maintain appropriate technical and organizational safeguards. The published description should reflect the controls actually implemented; no online service can promise absolute security.

Information marked as necessary for account creation, billing or responding to a request is needed for that purpose; without it we may be unable to provide the requested service. Do not include sensitive personal data unless expressly supported and covered by an appropriate agreement.

We will identify the effective date of this notice and notify material changes where appropriate. Any processing involving solely automated decisions with legal or similarly significant effects requires a separate assessment and the disclosures required by law.