Privacy Policy

1) Who we are (Data Controller for this Privacy Policy)

Data Controller:

SUMPLER

15 Rue des Halles, 75001 Paris, France

Email: contact@ansrfast.com

SUMPLER develops and operates AnsrFast, a platform that enables businesses to create and manage AI chatbots for customer support and to handle written conversations with end users.

2) Scope

This Privacy Policy applies to personal data processed by SUMPLER as a controller for:

• Website visitors (www.ansrfast.com)
• Business users of the AnsrFast application (account owners/admins/agents)
• Support and communications with us
• Authentication flows (including Google Sign-In)
• Billing and subscription administration
• Product usage analytics (as configured)

For end users interacting with a Customer’s Embedded Chat:

• The Customer is the controller.
• SUMPLER (AnsrFast) acts as a processor on the Customer’s behalf under a Data Processing Addendum (DPA).
• End users should consult the Customer’s privacy notice and contact the Customer to exercise privacy rights.

3) Personnal data we collect (as Controller)

4) End-user data processed on behalf of customers (Processor context)

When a Customer embeds the AnsrFast chatbot, SUMPLER may process certain end-user data on the Customer’s behalf, such as:

• Conversation content (messages) and metadata (timestamps, conversation IDs)
• End-user identity attributes provided by the Customer via a snippet (e.g., first name, last name, email, profile picture or URL, user ID)
• Technical data (IP address, user-agent, logs/events)

In this context:

• The Customer determines the purposes and means of processing (support operations).
• SUMPLER processes data only to provide the Service and according to the Customer’s instructions under the DPA.
• End users should contact the Customer to exercise rights (access, deletion, objection, etc.). If an end user contacts SUMPLER directly, we may redirect the request to the relevant Customer where legally permitted and reasonably possible.

5) How we use personal data (as Controller)

We use personal data to:

• Provide and operate the Service (account creation, authentication, session management)
• Manage subscriptions, billing, and invoicing
• Provide support and respond to inquiries
• Ensure security, prevent abuse, and monitor reliability
• Improve product performance and user experience (using aggregated metrics where possible)
• Comply with legal obligations

6) Legal bases (GDPR)

We rely on:

• Contract performance (to provide and support the Service)
• Legitimate interests (security, fraud prevention, product reliability, business operations)
• Consent (where required for optional cookies/marketing communications)
• Legal obligation (e.g., accounting, compliance requests)

7) Data sharing (as Controller) & Service providers

We share data only with service providers acting on our behalf, only as necessary, and under appropriate contractual safeguards.

Examples of service provider categories may include:

• Hosting/infrastructure and CDN (e.g., Vercel, Cloudflare)
• Database hosting (e.g., Neon on AWS EU regions)
• Email delivery (e.g., Resend)
• Real-time messaging infrastructure (e.g., Ably)
• Background jobs/automation (e.g., Trigger)
• Payment processing (e.g., Stripe)
• Analytics (e.g., Plausible and/or others depending on configuration)

We do not sell personal data.

8) International transfers

Your data may be processed in countries outside your country of residence, including outside the EU/EEA. Where required, we rely on appropriate safeguards such as:

• Standard Contractual Clauses (SCCs),
• adequacy decisions (where applicable),
• and additional technical/organizational measures.

9) Data retention

We retain personal data only as long as necessary for the purposes described above, including:

• Account data: for as long as the account is active, and for a limited period thereafter as necessary for legal, security, or dispute purposes.
• Logs: retained for security and diagnostics for a limited period.
• Billing data: retained as required by applicable accounting/tax laws.

End-user conversations (Processor context)

Conversation data processed on behalf of Customers is retained according to our DPA and the Customer’s instructions. Our current default retention for conversation messages is for the life of the Customer account and for one (1) year after account deletion, unless earlier deletion is requested by the Customer and is reasonably feasible.

10) Security

We implement appropriate technical and organizational measures, including:

• HTTPS/TLS encryption in transit
• Secure password hashing
• Access controls and least privilege
• Monitoring and incident response
• Use of reputable infrastructure providers

No system is perfectly secure, but we continuously work to protect data.

11) Your rights

11.1 GDPR rights (for business users / website visitors)

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object, and request portability. You may also withdraw consent where processing is based on consent.

To exercise these rights, contact: contact@ansrfast.com

11.2 End users of a Customer’s Embedded Chat

End users should contact the Customer (the controller) to exercise rights regarding end-user chat data. If you contact us, we may redirect your request to the Customer.

11.3 California (CCPA/CPRA)

If applicable, you may have rights to know, access, delete, correct, and opt out of sale/sharing (we do not sell personal data). Contact: contact@ansrfast.com

12) Children

AnsrFast is not intended for children under 13 (or 16 where applicable). We do not knowingly collect data from children.

13) Third-party links

Our Service may link to third-party websites/services. Their privacy practices are governed by their own policies.

14) CHANGES

We may update this Privacy Policy. We will post updates and revise the “Last updated” date.

15) CONTACT

Privacy questions or requests: contact@ansrfast.com