1. Introduction & Scope

Welcome to bussto (“bussto,” “we,” “us,” or “our”). We provide a modern SaaS Customer Relationship Management (CRM) platform that helps our business clients (“Client,” “you,” or “your”) manage communications and interactions with the end-users of their products and services (“Customers”).

This Product Privacy Statement explains how we collect, use, disclose, and otherwise process Personal Data on behalf of our Clients in connection with their use of our products and services (collectively, the “Services”).

When we process Personal Data under the direction of our Clients, we act as a data processor (under GDPR) or service provider (under CCPA). Our Clients are the data controllers / businesses. This Statement does not apply to data we collect on our own marketing website — that is covered by a separate Privacy Policy.

Individuals seeking access, correction, or deletion of Personal Data stored in the Services should contact the relevant Client (the data controller) directly.

2. Personal Data We Collect or Receive

We receive or collect Personal Data that is stored in or transmitted through the Services by or on behalf of our Clients. This may include:

• Customer Data — contact information (name, email, phone, social handles, physical address), conversation history (WhatsApp, email, web chat, tickets), order & purchase history, and any other data Clients choose to store about their Customers.
• Client User Data — name, email address, role, account credentials, device information (browser, OS, IP address, device ID), and usage data (pages viewed, feature interactions, timestamps, searches).
• Integration Data — information authorized through third-party integrations (Shopify, Stripe, Slack, Meta, etc.) via APIs, webhooks, or workflows.

We also collect limited technical and usage data automatically via cookies, log files, and similar technologies necessary for the operation and security of the Services.

3. How We Use Personal Data

We process Personal Data only at the instruction of our Clients and in accordance with our agreements, for the following purposes:

• Providing, operating, securing, and improving the Services
• Enabling Client Users to access and use the platform (including AI features such as summarization and intelligent routing)
• Responding to support requests, inquiries, and complaints
• Maintaining security, preventing fraud, and complying with applicable law
• Generating aggregated or de-identified insights to improve the product (never in a way that identifies individuals)

4. How We Share Personal Data

We share Personal Data only in the following limited circumstances:

• With the Client and authorized Client Users (to the extent the data relates to their Customers or account)
• With carefully selected sub-processors that help us operate, secure, and improve the Services (a current list is available upon request)
• With Third-Party Applications that you choose to connect to the Services
• When required by law, or when we believe disclosure is necessary to protect rights, safety, or investigate fraud / illegal activity

We do not sell Personal Data.

5. How We Secure Personal Data

We implement industry-standard technical and organizational measures, including encryption in transit and at rest, access controls, regular penetration testing, and continuous monitoring. We maintain SOC 2 Type II compliance and regularly engage independent security experts.

Clients remain responsible for protecting their own account credentials and for securing any devices or third-party applications connected to the Services.

6. Cross-Border Data Transfers

The Services are hosted primarily in the European Union and the United States. When Personal Data is transferred outside the country of origin, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission and other approved transfer mechanisms under applicable data protection laws.

7. Data Retention

We retain Personal Data processed on behalf of Clients for as long as our contractual relationship remains active. After termination, we delete Customer Personal Data within ninety (90) days, unless a longer period is required by law or requested by the Client in writing.

Client Users with administrative rights can delete Customer data directly in the platform. We will permanently remove such data promptly (and in any case within 90 days of the request).

Limited account, billing, and log data may be retained longer where necessary for legal, accounting, or security purposes, and will continue to be treated in accordance with this Statement.

8. Data Subject Rights (GDPR & CCPA)

Clients are the data controllers / businesses and are responsible for responding to requests from their Customers. If we receive a data subject request directly, we will direct the individual to contact the relevant Client and will assist the Client in fulfilling the request as required under our agreements and applicable law.

Under the CCPA we do not “sell” or “share” Personal Data for cross-context behavioral advertising. We process Personal Data solely to perform our contractual obligations.

9. Do Not Track

Because certain tracking of Client User activity is necessary for the proper functioning and security of the Services, we currently do not respond to “Do Not Track” browser signals.

10. Changes to This Statement

If we make material changes, we will notify Clients in a manner we reasonably believe will reach them (email, in-app notice, or announcement on this page).

11. Contact Us

If you are a Client and have questions about this Product Privacy Statement, please contact us at:

support@bussto.com

For alternative formats or accessibility needs, reach out to the same address.