Privacy policy

This policy explains what information WentBack ("we", "us") collects, how we use it, who we share it with and the choices you have. It covers our website (helpsay.com), our dashboard (app.helpsay.com) and the messages we send for the businesses that use WentBack.

Who this policy covers

• Our clients: businesses that sign up for WentBack, and the people on their teams who use the dashboard.
• Our clients' customers: people a business adds to WentBack, or who sign up through a business's sign-up page or QR code, so the business can send them reminders, invitations and updates.
• Website visitors: anyone who browses helpsay.com.

For our clients' customers, the business is responsible for that information and for having permission to contact you. We act on the business's behalf, as its service provider. If you'd like to see, correct or delete what a business holds about you, you can ask the business directly, or contact us and we'll pass your request on and help.

Information we collect

From our clients

• Account details: name, email address, phone number, password (stored only in scrambled, hashed form) and, if you choose to sign in with Google or Microsoft, the basic profile details they share with us.
• Business details: business name, address, locations, hours, logo, website and review links, and settings.
• Billing details: your plan, purchases and billing history. Card payments are handled by Stripe; we never see or store full card numbers.
• Support conversations and plan requests.

About our clients' customers (provided by the business, or by the customer on a sign-up page)

• Name, phone number, email address, preferred language and, if the business adds them, mailing address, birthday, notes and customer groups.
• Visit and booking history, such as last visit, service and upcoming appointments.
• Consent records: which channels the person agreed to, and when and how they agreed or opted out.
• Messages sent and received, and delivery information such as whether a message was delivered or failed.

Automatically

• Technical information such as IP address, browser and device type, pages requested and times, kept in server and security logs.
• Our dashboard uses cookies that are needed to keep you signed in and to protect forms from misuse. We don't use advertising cookies or third-party tracking on the dashboard.
• Our website remembers your currency choice (US or Canadian dollars) in your browser. It loads fonts from Google Fonts, which means Google receives your IP address when the page loads.

How we use information

• To provide the service: sending reminders, invitations, updates and replies on the channels a business chooses, showing delivery results, and running bookings and sign-up pages.
• To respect consent: recording consent, honouring opt-outs on every channel and holding messages during quiet hours.
• To run accounts and billing, provide support and tell clients about changes to the service.
• To keep WentBack secure, prevent spam, fraud and abuse, and enforce our Terms and Messaging policy.
• To improve WentBack, using information about how the service is used.
• To meet our legal obligations.

We don't sell personal information, and we don't use our clients' customer lists for our own marketing.

Text messages and mobile information

We do not sell, rent or share mobile phone numbers, or consent to receive text messages, with third parties or affiliates for their marketing or promotional purposes. Mobile information is shared only with the service providers that deliver messages (such as our text-messaging provider and mobile carriers), and only to deliver them. Anyone can reply STOP to stop texts from a business, or HELP for help. Message and data rates may apply.

Who we share information with

We share information only with service providers that help us run WentBack, under agreements that limit how they can use it, and only as much as they need:

• DigitalOcean: hosting and databases (our servers are in Toronto, Canada)
• Cloudflare: website delivery, domain name and security services
• Twilio and mobile carriers: text messages and phone calls
• Meta (WhatsApp): WhatsApp messages, for businesses that use them
• Stripe: card payments
• Google and Microsoft: sign-in, only if you choose it
• Email delivery and print-and-mail partners: when a business sends emails, postcards or letters

We may also share information if the law requires it, to protect the safety, rights or property of anyone, or as part of a merger, acquisition or sale of our business (in which case this policy will continue to apply to it).

Some of these providers process information outside Canada, including in the United States, where it may be accessible to authorities under local law.

How long we keep information

We keep information for as long as an account is open and as needed to provide the service. When a business closes its account, we delete or anonymise its information, including its customer list, within a reasonable time, except records we must keep for legal, tax or accounting reasons, or to resolve disputes. Opt-out records are kept so that people who asked not to be contacted stay that way.

How we protect information

Information is encrypted in transit over HTTPS, passwords are stored hashed, every business's information is kept separate from every other's, and access by our staff is limited to what's needed to run and support the service. No system is perfectly secure, but we work to protect information and will notify affected people and authorities of a breach where the law requires.

Your choices and rights

• Clients can see and update most account and business information in the dashboard, and can ask us for a copy of their information or to close their account.
• Customers of our clients can reply STOP to texts, use the unsubscribe link in emails, or ask the business to update or delete their details. You can also contact us.
• Depending on where you live, you may have the right to access, correct or delete your personal information, to withdraw consent, or to complain to a privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada.

To make a request, email [email protected]. We may need to confirm your identity first.

Children

WentBack is a service for businesses and isn't directed at children. Clients must be adults who can sign up on behalf of their business.

Changes to this policy

We'll update this page if our practices change and change the date at the top. If a change is significant, we'll tell clients by email or in the dashboard before it takes effect.

Contact us

Questions about this policy or your information: [email protected].