DATA PROTECTION

Data Protection Policy

Last updated: 11 October 2026

Wise & Rise respects your privacy. This policy explains what personal and business contact data we may collect, why we process it, how we protect it, and your rights.

1. Data we may collect

We only collect information you voluntarily provide when you interact with us:

• Contact details: name, phone number, email address.
• Business details: company name, website, industry, requirements you share.
• Communication records: messages exchanged via our website chat, WhatsApp, email or phone.
• Technical data: IP address, browser type, device information and pages visited (standard web server logs).

We do not collect sensitive personal data (such as health, biometric, racial or political information) unless you explicitly provide it in the context of a business enquiry.

2. Why we process your data

We use your information for the following purposes:

• To respond to your enquiry and provide the execution-plan conversation you requested.
• To send you a customised proposal, service details or follow-up communication.
• To manage our relationship with you as a lead or client (CRM, pipeline tracking, reporting).
• To improve our website, chatbot and service offerings (aggregated, anonymised analytics).
• To comply with legal obligations and respond to lawful requests from authorities.

3. Legal bases for processing

Where applicable, we rely on:

• Legitimate interest: responding to business enquiries, improving our services, preventing fraud.
• Contract performance: where you engage us for services.
• Consent: where you explicitly opt in to marketing communications.
• Legal obligation: where required by law.

4. Access control and security safeguards

• Data is stored in a Supabase (PostgreSQL) database with Row Level Security policies that restrict access to authorised roles only.
• Admin and sales dashboards require Supabase Auth session with verified role and active status (middleware-enforced).
• API endpoints that write data are protected by the same session + role checks; service-role keys are used only server-side after authorisation.
• All traffic is served over HTTPS. Cookies are HttpOnly, Secure and SameSite.
• We do not share your data with third parties for their own marketing purposes.

5. Third-party service providers

We use the following processors under written agreements:

• Supabase: database, authentication, storage (hosted in the region you select).
• Meta (WhatsApp Business API): message delivery when you choose WhatsApp as a contact channel.
• OpenRouter / DeepSeek: AI-assisted chat responses (only the conversation text you provide; no separate profiling).
• Resend (or configured SMTP): transactional email for system notifications.

We do not sell or rent your data to any third party.

6. Retention and deletion

• Enquiry and lead records are retained while the business relationship is active and for a reasonable period after the last interaction (typically 24 months) unless you request deletion sooner.
• Chat transcripts are stored for the duration of the conversation and linked to the lead record.
• Server access logs are rotated per hosting provider policy (typically 30–90 days).
• You may request deletion at any time (see Section 8).

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure (deletion) of your data.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

8. How to contact us about data protection

To exercise any of the above rights or ask questions about this policy, contact us:

Please include "Data Protection Request" in the subject line and describe the nature of your request. We will acknowledge receipt within a reasonable time and respond in accordance with applicable law.

9. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will be revised. We encourage you to review this page periodically.