Privacy Policy

• Contact & account details you provide — name, business name, email, phone/WhatsApp number, and the contents of messages you send us.
• Customer conversations handled by the concierge on a client business’s behalf (messages, booking and order details, and the phone number used to pay).
• Payment information needed to process a transaction — handled by our payment processors; we do not store full card details.
• Connected-account data from platforms a client links (e.g. Meta and Google), strictly to provide the features they enable.
• Usage & technical data such as pages visited, device/browser information, and basic analytics.

• To provide, operate, and improve the AI concierge and related features (replies, bookings, orders, and payments).
• To respond to enquiries, set up accounts, and provide customer support.
• To process payments and send transaction confirmations.
• To send service messages and, where you have opted in, occasional product updates.
• To maintain security, prevent fraud and abuse, and meet legal obligations.

We do not sell your personal data. We share it only with service providers that help us run the service, under appropriate confidentiality and data-protection terms, including:

• Payment processors — Paystack and the mobile-money networks (MTN, Telecel, AirtelTigo) to take payments you authorise.
• Messaging platforms — Meta (WhatsApp, Instagram, Messenger) to send and receive the messages you exchange with a business.
• AI & infrastructure providers — our model and hosting providers, used to generate replies and run the service securely.

We may also disclose information where required by law or to protect our rights, users, or the public.

To read and answer messages, transcribe voice notes, describe images and learn how a business answers its customers, we send the relevant message content to these AI service providers: MiniMax (language models); Anthropic PBC (Claude language models); OpenRouter, Inc., a routing service that passes a request to the model provider selected for it, which may be a different company, for example to use a lower-cost model; Groq, Inc. (voice-note transcription); and Microsoft (spoken replies).

OpenRouter passes a request only to an endpoint that keeps neither the request nor the answer after serving it (zero data retention) and does not use them to train models, run by one of these model providers: Microsoft Azure (OpenAI models), OpenAI, Anthropic, Google (Vertex AI and AI Studio), Amazon Web Services (Bedrock), Mistral AI, xAI, DeepSeek, Moonshot AI, Z.ai, Alibaba Cloud, MiniMax, Groq, Cerebras, DeepInfra, Together AI, Fireworks AI, Baseten, Nebius and Parasail. No data of a business goes to OpenRouter, or through it to any of these model providers, before that business has accepted version 1.1 of our Client Acceptance Policy. We give notice before a new model provider processes a business’s data.

Our hosting, storage and delivery providers include Hetzner Online GmbH, Cloudflare, Inc., Meta Platforms and Resend. These providers process data in the United States, the European Union, Singapore, China and other countries, so data is processed outside Ghana. We apply the safeguards the Data Protection Act, 2012 (Act 843) requires for such transfers and, where a provider offers the option, we set it not to use this data to train its models.

For the conversations a business handles through our service, that business is the data controller and we process them on its instructions as its data processor. We are the controller for our own website, account, billing and security records.

A business can let its AI learn how it works before the AI answers anyone.

• Learn Mode. While learning, the service reads new conversations on the channels the business connects. It does not reply to them or mark them as read.
• WhatsApp chat-history import. When a business links its WhatsApp number while setting up or learning, or asks for it later, the service imports that phone’s recent one-to-one chats: at most the last 60 days, and a limited number of messages per chat. Group chats, broadcast lists, status updates and channels are never imported, and media is recorded only by its type and file name.
• Exclusions. The business can exclude contacts such as family and friends. Their chats are skipped before they are read, and anything already imported from them is deleted.
• Use and retention. Imported chats are used only to prepare that business’s own AI setup for it to review. The AI never answers customers from them directly, they are never used for another business or for aggregated insights, and they are deleted automatically 90 days after import, or with the business’s account. A draft AI setup built from them that the business has not approved is deleted with them; what the business approves stays part of its AI setup.

If you have chatted with a business on WhatsApp and want your chats excluded or deleted, ask that business, or contact us and we will pass your request on and help it act.

When a business connects a WhatsApp, Instagram, or Facebook account, we access only the data needed to send and receive messages on its behalf. We use that data solely to operate the concierge for that business and in accordance with Meta’s Platform Terms and Developer Policies.

When a business connects its Google account to XCelerate AI Concierge, our application accesses Google user data through the Google APIs. We request only the access necessary to provide scheduling and lead-tracking features (such as Google Calendar and Google Sheets), and our access, use, storage, and sharing of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or share it with third parties except as required to provide the feature, comply with law, or with the user’s explicit consent.

We keep personal data only as long as needed to provide the service and to meet legal, accounting, or reporting requirements, after which it is deleted or anonymised.

Subject to applicable Ghanaian law (including the Data Protection Act, 2012), you may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. To exercise these rights, contact us using the details below.

You can request deletion of your account and eligible data through our account deletion page or by emailing info@xcelerateak.com. Disconnecting a linked platform revokes future access through that connection, but does not by itself delete information already stored for the workspace. We verify identity, authority, scope, and any narrow legal-retention requirements before taking action.

We protect data with encryption in transit, access controls, and secured infrastructure. No method of transmission or storage is perfectly secure, but we work to safeguard your information and to respond quickly to any incident.

XCelerate accounts are for businesses and adult users; children must not create accounts or submit information to us independently. A client such as a school may use the concierge to receive limited information about a student from a parent, guardian, or other authorised adult. In that situation, the client decides why the information is collected and is responsible for the required notice, lawful basis, permissions, and instructions; XCelerate processes the information to provide the service on the client’s behalf.

Clients should collect only what is necessary, avoid requesting sensitive records in ordinary chat, and use an appropriate protected process when more information is required. We apply access controls and the retention and deletion practices described in this policy. A parent or guardian can contact the relevant client, or contact us, to ask about access, correction, or deletion.

We may update this policy from time to time. Material changes will be reflected by updating the “Effective” date above and, where appropriate, by notifying you.

XCelerate AK LLC (registered in the United States and in Ghana) · operating from Accra, Ghana

Email: info@xcelerateak.com · sales@xcelerateak.com

For the AI concierge product specifically, the same commitments apply at concierge.xcelerateak.com/privacy.