Privacy Policy
Pasforma (“Pasforma”, “we”, “us”) is a team workspace for businesses: a shared customer inbox, team voice calls, a virtual office and an AI assistant, available at pasforma.com. This policy explains what data we handle, why, who we share it with, and the choices you have. Questions: pasformaplatform@gmail.com.
1. Who is responsible for which data
- Account data (the people who sign in to Pasforma): we are the controller.
- Workspace data (conversations with a business’s own customers, contacts, files, knowledge sources): the business that owns the workspace (“the organization”) decides why and how it is used and is the controller. We process it on the organization’s behalf, to run the service.
2. Data we handle
Account and sign-in
- Name, email address, role in the organization, avatar, language and notification settings.
- If you choose “Sign in with Google”: your Google account identifier, email address, name and profile picture. We use this only to identify you and sign you in.
- Session and security data: IP address, browser/device information and sign-in times.
Workspace content
- Messages, media, contacts, labels, notes, quick replies and assignments from the channels an organization connects (WhatsApp, Instagram, Messenger, TikTok, the website chat widget).
- Voice-call and virtual-office presence data. If an organization turns on meeting recording, the recording, transcript and notes of that meeting.
- Knowledge sources an organization adds for its AI assistant (text, Q&A, files, websites and Google Docs/Sheets), and the passages we derive from them.
Billing
Plan, invoices and payment status. Payments are handled by our payment providers; we do not store full card numbers.
Usage and analytics
Pages visited, actions in the app, approximate country (to choose a default language), and technical logs. On our public website we use Google Analytics / Google Tag Manager to measure sign-ups and traffic.
3. Google user data
Pasforma’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Google
Scopes: openid, email, profile. Used only to sign you in and show your name and picture.
Google Drive (optional knowledge sources)
An organization administrator may connect a Google account so that specific Google Docs and Google Sheets can be used as knowledge for the organization’s AI assistant. Scope requested: https://www.googleapis.com/auth/drive.file, which gives Pasforma access only to the files the administrator picks in the Google Picker.
- What we access: only the files the administrator picks in the Google Picker. We read the file’s name, type, version and trashed state, export a Doc as plain text, and read a Sheet’s cell values. We cannot see, list or read any other file in the account.
- What we do with it: the text is split into passages, indexed and stored in that organization’s workspace so its AI assistant can answer that organization’s customers from its own documents. We re-read a file only when its version changes.
- What we never do: we do not create, edit or delete files in Google Drive; we do not use Google user data for advertising, we do not sell it, and we do not use it to develop or train generalized AI/ML models. Humans at Pasforma do not read it, except with your consent, to investigate abuse or security issues, or where the law requires.
- Where it goes: to answer a customer’s question, the relevant passages may be sent to the AI or embedding provider the organization has configured with its own API key (see section 5). Those providers act on the organization’s instructions.
- Storage and security: the OAuth refresh token is stored encrypted and never sent to your browser.
- Your control: the administrator can remove a file or disconnect Google Drive at any time in the Knowledge settings; disconnecting revokes the token at Google and stops all Drive syncing. You can also revoke access at myaccount.google.com/permissions.
4. How we use data
- To provide and secure the service: deliver and route messages, run voice and office features, sign you in, send notifications.
- To provide AI features an organization turns on (summaries, reply suggestions, an automated assistant).
- To bill, support and communicate with you (for example sign-in codes, invitations, service notices).
- To measure and improve the product, prevent abuse and meet legal obligations.
5. Who we share data with
We do not sell personal data. We use service providers that process data only to deliver their part of the service:
| Provider type | Purpose |
|---|---|
| Servers and databases we operate | Hosting the application and its data. |
| Object storage (Wasabi) | Files, media and meeting recordings. |
| Messaging channel providers (WhatsApp, Instagram, Messenger, TikTok connections, including WhatsApp Official API partners) | Sending and receiving the organization’s customer messages. |
| AI and embedding providers the organization chooses (OpenAI, Anthropic, Google, OpenRouter or a custom endpoint, using the organization’s own API key) | Generating replies, summaries and search over knowledge. Their terms and privacy policies apply to what is sent to them. |
| Payment providers | Subscriptions and payments. |
| Email delivery provider | Sign-in codes, invitations and notices. |
| Sign in with Google, Google Drive (when connected), Analytics and Tag Manager. |
We may also disclose data when required by law, to protect rights and safety, or in a merger or sale of the business (with notice to you).
6. Retention and deletion
We keep data while the account or workspace is active and as needed to provide the service. When an organization deletes content or its workspace, or asks us to, we delete or anonymize the related data, except records we must keep (for example billing and security logs). Knowledge sources removed by an administrator are deleted together with their derived passages. To request deletion of your account data, write to pasformaplatform@gmail.com.
7. Security
Traffic is encrypted with TLS. Stored secrets (such as API keys and Google tokens) are encrypted at rest. Access is separated per organization and limited by role. No system is perfectly secure; if a breach affecting you occurs we will notify you as the law requires.
8. Your rights
You may ask to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. For data in an organization’s workspace, please contact that organization first; we will help it respond. Contact us at pasformaplatform@gmail.com. We handle personal data in line with applicable law, including Indonesia’s Personal Data Protection Law (Law No. 27 of 2022).
9. International transfers
Our providers may process data in other countries. Where required, we rely on appropriate safeguards.
10. Children
Pasforma is for businesses and is not directed to children. We do not knowingly collect data from children.
11. Changes
We may update this policy. We will change the date above and, for significant changes, notify account holders.
12. Contact
Pasforma — pasformaplatform@gmail.com