Privacy Policy
Vintellecta Ltd · Last updated 1 September 2026
This policy explains how Vintellecta Ltd collects, uses, shares and protects personal data. It covers our website at vintellecta.com and the AI Business Assistant platform.
Vintellecta Ltd is a company registered in Mauritius, with its office at Galea Road, Castel, Phoenix, Mauritius. We can be reached at info@vintellecta.com or on +230 5920 8634.
Two different roles
Our responsibilities depend on whose data is involved, so it is worth being clear about this up front.
For our own website visitors, enquiries and the businesses that subscribe to our platform, we are the data controller. We decide what is collected and why, and this policy governs it.
For the customer conversations, contacts and records that flow through the platform, we are a data processor acting for the subscribing business. That business is the controller, decides what is collected and why, and is responsible for having a lawful basis to process it. We handle that data only on their documented instructions. If you are a customer of a business that uses our platform and you want to know how your data is being used, contact that business directly. We will help them respond.
Data we collect
When you visit our website
- Anything you enter into our contact form or send us by message: your name, email address, phone number and the content of your enquiry.
- Basic technical information generated by your visit, including IP address, browser type and pages viewed. This is handled by Cloudflare, which serves our site and protects it from abuse.
When your business subscribes to the platform
- Account details: business name, registration details, address, contact names, email addresses and phone numbers.
- Billing details. Card payments are processed by our payment provider and we do not store full card numbers.
- Configuration you set up in the platform, including your business type, service settings and message templates.
- Usage and diagnostic logs recording actions taken in the platform, used for support and security.
Data processed on your behalf inside the platform
Depending on which features you enable, the platform processes:
- Messages exchanged with your customers on WhatsApp, Instagram, Messenger and website chat, including message content, phone numbers and profile names.
- Lead, contact and customer records you create or import, including notes, enquiry history and any scoring the platform applies.
- Appointment and calendar entries.
- Quotations, invoices and related commercial records.
- Where you connect a Google account, the specific Gmail and Google Calendar data needed to deliver the features you have enabled.
- Where you use document analysis, the contents of documents or spreadsheets you upload.
How we use data
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries you send us | Steps taken at your request before entering a contract |
| Providing, maintaining and supporting the platform | Performance of our contract with the subscribing business |
| Billing, accounting and tax records | Legal obligation and our legitimate interests |
| Security monitoring, abuse prevention and diagnostics | Our legitimate interest in keeping the service safe and available |
| Improving our service | Our legitimate interest, using aggregated or de-identified information |
| Sending service notices about outages, changes or billing | Performance of our contract |
We do not sell personal data. We do not share it with advertisers. We do not use the customer conversations flowing through the platform to train artificial intelligence models, and our AI providers are contractually prevented from doing so with data we send them.
Artificial intelligence processing
The platform uses large language models to draft replies, classify enquiries, score leads and produce written analysis. To do this, relevant message or document content is sent to our AI provider for processing and a response is returned. This happens on request, in real time.
Two points matter here. First, AI-generated output can be wrong. It is a drafting and assistance tool, not a substitute for the business checking what goes out to its customers. Second, if you use document analysis, the uploaded file is used to produce the report and is then discarded. Only the resulting report is retained in your account.
Who we share data with
We use a small number of established service providers to run the platform. Each is bound by contract to protect the data and to use it only to provide their service to us.
| Provider | What they handle |
|---|---|
| Meta Platforms | Delivery of WhatsApp, Instagram and Messenger messages through the WhatsApp Business Platform and related APIs |
| OpenAI | Language model processing for assistant replies, classification and analysis |
| Supabase | Database and file storage |
| Gmail and Calendar features, where you have connected a Google account | |
| Cloudflare | Website hosting, DNS and security |
| Zoho | Our business email |
We may also disclose data where we are required to by law, by a court, or by a competent regulator, and to our professional advisers where necessary. If Vintellecta is ever sold or merged, data may transfer to the acquirer, and we will tell affected clients before that happens.
International transfers
Our service providers operate infrastructure outside Mauritius, including in the European Union and the United States. Where personal data is transferred abroad, we rely on the safeguards in our contracts with those providers, including standard contractual clauses where applicable, and on the transfer conditions set out in the Data Protection Act 2017.
How long we keep data
- Website enquiries: up to 24 months from your last contact with us, unless you become a client.
- Client account and platform data: for as long as the subscription is active. On termination, we retain it for 30 days so the business can export it, then delete it.
- Uploaded documents for analysis: deleted once the report is produced.
- Invoices and accounting records: retained for the period required by Mauritian tax and company law.
- Security and diagnostic logs: up to 12 months.
Security
Data is encrypted in transit. Access to production systems is restricted and protected by multi-factor authentication. The platform is multi-tenant, and each subscribing business's data is separated at the database level so that one client cannot access another client's records. Access tokens for connected accounts are stored encrypted.
No system is completely secure. If a breach occurs that is likely to affect your rights, we will notify the affected clients and the Data Protection Office as required by law.
Your rights
Under the Data Protection Act 2017 you have the right to:
- ask whether we hold data about you, and get a copy of it;
- have inaccurate data corrected;
- have your data erased in the circumstances the Act allows;
- object to processing based on legitimate interests, and request that processing be restricted;
- receive data you gave us in a portable format;
- withdraw consent where processing relies on it, without affecting what was done beforehand.
To exercise any of these, email info@vintellecta.com. We respond within 30 days. If your data is held inside a client's account on our platform, we will refer you to that business, as they control it, and we will assist them in responding to you.
If you are not satisfied with how we handle your request, you may complain to the Data Protection Office of Mauritius.
Cookies
Our website uses only what is necessary to serve pages and keep the site secure. We do not use advertising or cross-site tracking cookies. If we add analytics in future, we will update this policy and ask for consent where required.
Children
Our services are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child's data has reached us, contact us and we will delete it.
Changes to this policy
We will update this page when our practices change and revise the date at the top. If a change materially affects how we handle client data, we will notify subscribing businesses by email before it takes effect.