Privacy Policy

1. Who we are and who is responsible

Feerasta is being incorporated as an Ontario corporation, with a Michigan subsidiary for US customers. Until registration is complete, Feerasta is operated by Meer Feerasta in Ontario, Canada. We will name both companies here once they are registered. Until then, the controller of the personal information described in this Policy is Meer Feerasta, operating as Feerasta, Ontario, Canada.

Person responsible for personal information. Meer Feerasta, founder, is the person in charge of the protection of personal information (Quebec) and the individual accountable for our compliance (Canada, PIPEDA). Contact: hello@feerasta.ai. Every request about your data is handled from that address. We have not appointed a data protection officer. For individuals in the European Economic Area and Portugal, an EU representative will be appointed if the law requires one, and named here.

2. What we collect, why, and on what legal basis

The legal basis column matters if you are in the European Economic Area (including Portugal), the United Kingdom or Switzerland. "Legitimate interest" means we have a reasonable business reason that we have weighed against your privacy; you can object to it at any time (section 11).

We do not ask for, and do not want, sensitive information (such as health, financial account or government ID numbers) through this website. We do not use any of the above to infer things about you.

3. Who receives it

• Cloudflare delivers and protects the site, runs our server code, stores enquiries and question logs (Workers KV), and runs the AI model behind Ask Feerasta.
• Resend (on Amazon SES) delivers the email that tells us about your enquiry, and the automatic confirmation email when that is switched on.
• Hostinger hosts our own mailboxes, including hello@feerasta.ai. Google hosts a second mailbox that receives a copy of each enquiry.
• Meta receives advertising measurement data, only as described in section 4.
• Our other service providers (subprocessors) run the Feerasta platform for clients: Hetzner (the application and its database, Germany), Twilio, ElevenLabs (voice calls, including recording and transcription of calls to our own number), Meta (the WhatsApp Business API), Stripe (payments), Google (business data, maps, and our encrypted offsite backups), and the AI model providers named on the subprocessors page (Anthropic and OpenAI for drafting that waits for your approval; NVIDIA for the WhatsApp Assistant demo and for search embeddings in the platform memory feature). Customer-facing conversations on the web widget, SMS, WhatsApp and the rules-based phone line are answered from approved rules and make no model call; natural-voice phone lines run on an ElevenLabs agent, which does use an AI model. We update that page before a new provider processes customer data.
• Legal and safety: when the law requires it, or to protect the rights, safety and property of Feerasta, our clients or others.
• Business transfers: if Feerasta is merged or sold, subject to this Policy.

We do not sell personal information for money, and we do not give it to data brokers. The only time information about your visit goes to an advertising company is the Meta measurement in section 4. Some US state laws call that "sharing" for cross-context behavioral advertising, or "targeted advertising", so we give you a way to say no to it.

4. Advertising measurement, and your choice to say no

When we advertise on Facebook or Instagram, we may use the Meta Pixel (a piece of Meta's code that runs in your browser) and Meta's Conversions API (a message from our server to Meta) to see whether our ads lead to enquiries.

What Meta receives when it is on

• From your browser: which of our pages you view, that you clicked one of our email or phone links, and that you sent us an enquiry. Like any website request, this also gives Meta your IP address and browser details, and the Meta cookies described on our cookie page. If you are logged in to Facebook or Instagram, Meta may link this to your account. We have switched off the Pixel's automatic collection of button clicks and page details.
• From our server, only when you send an enquiry: a one-way scrambled (hashed) copy of your email address, your IP address, your browser's user agent, the page address, and Meta's own browser codes, so Meta can match the enquiry to an ad it showed. We never send Meta your name, phone number, business name, or the text of your message.

When it runs

• European Union and EEA (including Portugal), United Kingdom, Switzerland, Quebec, and anywhere we cannot tell where you are: only after you press Accept. Decline is just as easy, and nothing loads from Meta until you choose.
• United States, Pakistan, and Canada outside Quebec: it starts when the page loads, and a notice appears at the same time with an Opt out button. You can also opt out at any time with the link below.
• Never, anywhere, if your browser sends Global Privacy Control or Do Not Track. We treat either as a refusal, and our server also refuses to send the enquiry message to Meta when it sees either signal.

Saying no changes nothing else: every page, the contact form and Ask Feerasta work the same.

Do not sell or share my personal information

Use the Do not sell or share my personal information link (it is also at the bottom of every page) to open your choice and switch advertising measurement off, or on again. Your choice is remembered in your browser. If the choice box does not open, advertising measurement is not running for your visit, so there is nothing to switch off. You can also email hello@feerasta.ai and we will act on it the same way.

Meta's role

For collecting this data on our site and passing it to Meta, we and Meta may be jointly responsible under EU law; what Meta does with it afterwards is Meta's responsibility. Meta handles it under its Business Tools Terms and its own privacy policy, which also explains how to use your rights with Meta and how long Meta keeps it. We keep nothing from the Pixel ourselves.

5. Cookies, browser storage, and Do Not Track

Our cookie page lists every cookie and every item we store in your browser, with how long each lasts. In short: a light or dark theme choice, your advertising choice, a "read answers aloud" setting if you turn it on, the source of your visit for the length of the browser tab (not stored at all for visitors in Europe or with Global Privacy Control or Do Not Track), Cloudflare's security cookies, and Meta's cookies only when advertising measurement is on.

How we respond to Do Not Track and Global Privacy Control: we treat both the same way. Advertising measurement never runs, the source of your visit is not stored in your browser, and visit records (if we switch them on) skip you. In US states where Global Privacy Control is a legal opt-out of sale or sharing, we honour it as one.

6. AI and automated decisions

• Ask Feerasta first looks for a matching published answer in your browser. If none fits, an AI model run by Cloudflare chooses from our published answers. The answer you see is always our published text, word for word; the model never writes it. The box says so where you use it.
• The automatic confirmation email, when switched on, is a fixed message written in advance by a person. It says it is an automatic reply. No AI writes or changes it.
• AI in our services. Where you interact with an AI assistant we build for a client (for example a voice or chat agent), it says it is AI at the start and does not pretend to be a person: on the first turn of a call or text the agent says it is AI and names the business it works for, and on text the line repeats on the first reply to a sender every 30 days. Where we generate synthetic audio or content, we mark and disclose it where the law requires, including Article 50 of the EU AI Act.
• No automated decisions about you. We make no decision based solely on automated processing that has a legal or similarly significant effect on you. Simple automatic rules (for example, not sending the confirmation email to a shared "info@" address) do not decide anything about you.

7. Emails, calls, and texts

We follow anti-spam and communications laws including the U.S. CAN-SPAM Act, the U.S. Telephone Consumer Protection Act (TCPA), and Canada's Anti-Spam Legislation (CASL).

• The automatic confirmation email is a one-time, direct reply to the enquiry you sent us. It is transactional and contains no marketing, so it is not a marketing message under CASL or CAN-SPAM. It goes out at most once a day per address, and never to shared or disposable addresses.
• We send marketing only if you tick the marketing box on our contact form, or where the law otherwise allows it. Every marketing email identifies us and includes a way to opt out, and we honour opt-outs promptly (within 10 business days at the latest).
• Text messages include opt-out instructions (reply STOP, HELP for help). Message and data rates may apply. We obtain prior express written consent before sending marketing text messages, and we register our messaging campaigns as required (A2P 10DLC).
• Where a call is made or assisted by an automated or AI system, we say so at the start of the call. We obtain prior express written consent before placing marketing calls that use an automated or artificial voice, and we check do-not-call lists and keep our own do-not-contact list.
• The phone line we set up for a client's business does not make audio recordings of calls. There is no audio recording and no setting to turn it on. If we add it, it will be off until the owner chooses it, and audio will be kept 30 days by default.
• Calls to Feerasta's own number are answered by an AI receptionist and are recorded and transcribed by our voice provider, ElevenLabs, so we get your details right. Feerasta’s own line is different: Rachel introduces herself as the front desk agent and says plainly that she is an AI whenever anyone asks. The caller is told at the start of the call. You can ask us to delete a recording and its transcript by emailing hello@feerasta.ai.
• You can opt out of all marketing contact at any time by emailing hello@feerasta.ai, or by replying STOP to a text. We honour opt-out requests made in any reasonable way.
• Inside the Feerasta platform, consent is recorded per person, per channel, with its source. STOP on any channel revokes every channel. A message with no consent record is refused, and the refusal is logged. Every outbound channel starts switched off.

8. Business and prospecting data

We collect publicly available business contact details to offer our services to businesses that may benefit from them: business name, address, phone number, website (or absence of one), public ratings and review counts. This is business contact information used for business-to-business outreach. If you do not want to be contacted, or want your business removed from our records, email hello@feerasta.ai and we will remove you and add you to our do-not-contact list.

9. How long we keep it

• Enquiries (contact form and Ask Feerasta "Send this to a person"), with how you heard about us and where your visit came from: deleted automatically from our enquiry store after 180 days. The notification emails stay in our mailboxes as correspondence and follow the prospect and lead period below.
• Automatic confirmation email: the scrambled copy of your email address used to avoid duplicates is deleted after 24 hours.
• Ask Feerasta question log and thumbs up or down: 90 days.
• Rate-limit counts (scrambled IP address): about a minute.
• Source of your visit in your browser: until you close the tab.
• Meta cookies: up to 90 days in your browser. Meta keeps what it receives under its own policy; we cannot set that period.
• Your advertising choice: in your browser until you clear your site data.
• Prospect and lead information, including enquiry emails: up to 24 months after our last meaningful contact, then deleted or de-identified.
• Client account and billing records: for the engagement and up to 7 years afterwards, for tax and accounting law.
• Visit records (not running today): 90 days if switched on. Anonymous daily totals of sign-up clicks and page views contain no personal information and are kept.
• Your Feerasta workspace: you set a retention period and a nightly job purges what is past it. The whole workspace can be exported as JSON whenever you want. Closing a workspace schedules deletion after a 30-day window in which you can cancel. Three things survive, because they prove a STOP was honoured and what was approved: the consent record, the opt-out list, and the audit trail.
• Free-month documents (bank and card statements, bills and receipts sent for a free trial month): deleted within 90 days if you do not become a client, and sooner if you ask. Encrypted backup copies are removed within a further 30 days.
• Call logs (text records of a call, not audio): for the workspace retention period, 12 months by default; the owner can set 30 days to ten years.

We keep information longer only where we need it to resolve a dispute or the law requires it.

10. How we protect it

We keep reasonable administrative, technical and physical safeguards, consistent with laws such as New York's SHIELD Act: access controls, encryption in transit, server-side encryption of stored secrets and backups, least-privilege access, and isolated infrastructure. Stored enquiries can be read only by us, through our own Cloudflare account or a private access key. The detail, including what is not yet in place, is on the security page. No method of transmission or storage is completely secure. If a breach puts you at risk, we will tell you and the regulators the law requires us to tell.

11. Your rights and how to use them

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you, and give you a copy (access).
• Correct anything that is wrong.
• Delete it, unless the law requires us to keep it.
• Give it to you, or to someone else, in a usable electronic format (portability). A Feerasta workspace can be exported in full, as JSON, from inside the product.
• Stop using it for something you object to, including anything based on legitimate interest, and stop all marketing (objection). You can also ask us to pause using it while a complaint is checked (restriction).
• Withdraw your consent, for example to advertising measurement, as easily as you gave it.
• Opt out of "sale" or "sharing" and targeted advertising (see section 4).

How: email hello@feerasta.ai. Tell us what you want and the email address you used with us. We may ask a question to confirm it is you, and we only ask for what we need. You can use an authorized agent; we may ask them for your signed permission. We reply within one month (EU, UK, Switzerland), 30 days (Canada and Quebec), or 45 days (US states), and tell you if we need the extension the law allows. It is free. We will not treat you differently for using your rights.

If you are not satisfied, reply and ask us to look again (an appeal), and you can complain to a regulator: in Portugal the Comissão Nacional de Proteção de Dados (CNPD), or your own EU supervisory authority; in the UK the Information Commissioner's Office; in Switzerland the Federal Data Protection and Information Commissioner; in Canada the Office of the Privacy Commissioner of Canada; in Quebec the Commission d'accès à l'information; in the United States, your state attorney general (in California, also the California Privacy Protection Agency).

12. Rules for your region

13. International transfers

We are run from Canada. The European Commission and the UK recognise Canada as giving adequate protection for organisations subject to PIPEDA, and we rely on those decisions for information sent to us from the EU and the UK. Some of our providers process information in the United States. Where a provider is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), as Cloudflare, Google and Meta are, we rely on that certification; otherwise, and in addition where the provider offers them, we rely on the Standard Contractual Clauses in that provider's data processing terms (Resend's, for example). We have not signed separate transfer contracts beyond those vendor terms. You can ask us for more detail at hello@feerasta.ai.

14. Children

Our website and services are for businesses and adults. They are not directed at anyone under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

15. Changes to this Policy

When we change this Policy we update the version and effective date at the top. If a change affects how we use information you have already given us, we will make it clear on this page before it takes effect, and ask for your consent where the law requires it. We switch on a new kind of collection only after this page describes it.

16. How to contact us

For any privacy question or request, or to opt out of contact, email hello@feerasta.ai. Meer Feerasta, operating as Feerasta, Ontario, Canada.