XCelerate AI Concierge by XCelerate AK

XCelerate AK LLC — a company registered in both the United States and Ghana, operating as XCelerate AK from Accra, Ghana ("we", "us", or "our") — operates the XCelerate AI Concierge platform, which provides AI-powered customer service automation for businesses via Meta platforms including Instagram and WhatsApp. This Privacy Policy explains how we collect, use, disclose, and protect information when you interact with our services.

Who is responsible for your data. When you message a business that uses our platform, that business is the data controller of your messages and details, and we process them on its behalf and on its instructions, as its data processor, under Ghana's Data Protection Act, 2012 (Act 843). We are the data controller only for our own records: the accounts, billing and security records of the businesses that use our platform, and the visitors to our own website. Questions about how a business uses your chats are best sent to that business; we will help it answer them.

1. Information We Collect

When you interact with a business using the XCelerate AI Concierge, we may collect:

• Messages & Conversation Data: The content of messages you send to businesses through Instagram Direct Messages or WhatsApp.
• Platform Identifiers: Your Instagram or WhatsApp user ID, name, and profile information as provided by Meta's platforms.
• Interaction Metadata: Timestamps, message status (sent/read), and session identifiers.
• Business-Provided Data: Information shared by the business you are interacting with, such as booking details or support context.

2. How We Use Your Information

• To provide automated customer service responses on behalf of the business you are contacting.
• To route conversations to human agents when required.
• To maintain conversation history for continuity of service within a session.
• To generate analytics and service quality reports for the business operator.
• To comply with legal obligations.

3. Data Sharing

We do not sell your personal information. We may share data with:

• Business Operators: The business whose AI concierge you are interacting with receives your conversation content.
• AI Service Providers: Conversation data is processed by large language model (LLM) and speech providers to read and answer messages and to help a business set up its AI. They are named in section 4 and act as our sub-processors under data processing terms.
• Infrastructure Providers: Cloud hosting, database, and caching services used to operate the platform.
• Legal Authorities: Where required by law or court order.

4. AI Service Providers and Processing Outside Ghana

To read and answer messages, transcribe voice notes, describe images and learn how a business answers its customers, we send the relevant message content to these AI service providers:

• MiniMax (language models);
• Anthropic PBC (Claude language models);
• OpenRouter, Inc., a routing service that passes a request to the model provider selected for it, which may be a different company, for example to use a lower-cost model;
• Groq, Inc. (voice-note transcription);
• Microsoft (spoken replies).

OpenRouter passes a request only to an endpoint that keeps neither the request nor the answer after serving it (zero data retention) and does not use them to train models, run by one of these model providers: Microsoft Azure (OpenAI models), OpenAI, Anthropic, Google (Vertex AI and AI Studio), Amazon Web Services (Bedrock), Mistral AI, xAI, DeepSeek, Moonshot AI, Z.ai, Alibaba Cloud, MiniMax, Groq, Cerebras, DeepInfra, Together AI, Fireworks AI, Baseten, Nebius and Parasail. No data of a business goes to OpenRouter, or through it to any of these model providers, before that business has accepted version 1.1 of our Client Acceptance Policy. We give notice before a new model provider processes a business's data.

Our hosting, storage and delivery providers include Hetzner Online GmbH, Cloudflare, Inc., Meta Platforms (WhatsApp, Instagram and Messenger) and Resend (email). These providers process data in the United States, the European Union, Singapore, China and other countries, so your data is processed outside Ghana. We apply the safeguards Act 843 requires for such transfers and, where a provider offers the option, we set it not to use this data to train its models.

5. Learning From Conversations and Imported WhatsApp Chat History

A business can let its AI learn how the business works before the AI answers anyone:

• Learn Mode. While a business's AI is learning, the platform reads new conversations on the channels the business connects. It does not reply to them and does not mark them as read.
• Chat-history import. When a business links its WhatsApp number while setting up or learning, or asks for it later, the platform imports that phone's recent one-to-one chats: at most the last 60 days, and a limited number of messages per chat. Group chats, broadcast lists, status updates and channels are never imported. Text is imported with a description of any media (its type and file name); the photos, videos, voice notes and documents themselves are not copied by the import.
• Exclusions. The business can exclude contacts, such as family and friends. Their chats are skipped before they are read, and anything already imported from them is deleted. Contacts the business has told its AI not to reply to are excluded too.
• Use. Imported chats are used only to prepare that business's own AI setup (its instructions, knowledge and products) for the business to review. The AI never answers customers from imported chats directly, and they are never used for any other business.
• Retention. Imported chats are deleted automatically 90 days after import. A draft AI setup built from them that the business has not approved is deleted with them, whether they are deleted by the business, by an exclusion, after 90 days or with its account. What the business approves from them becomes part of its AI setup.

If you have chatted with a business on WhatsApp and would like your chats excluded from its AI or deleted, ask that business, or contact us and we will pass your request to it and help it act on it.

6. Meta Platform Data

Our application integrates with Meta platforms (Instagram, WhatsApp) under Meta's Platform Terms and Developer Policies. Data received through Meta's APIs is used solely to provide the messaging service described in this policy. We do not use Meta user data for advertising purposes.

7. Google User Data

When a business connects its Google account to XCelerate AI Concierge, our application accesses Google user data through the Google APIs. We request only the access necessary to provide scheduling and lead-tracking features, and our access, use, storage, and sharing of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

Data we access. With the connecting business's explicit consent on the Google consent screen, we request the following OAuth scopes:

• Google Calendar (https://www.googleapis.com/auth/calendar) — to read calendar availability and to create, update, and cancel calendar events.
• Google Sheets (https://www.googleapis.com/auth/drive.file) — to create the business's lead-tracking spreadsheet and append booking/lead rows to it. With this scope the app can only access the specific spreadsheet it creates.

We do not request access to your Google profile, name, email address, contacts, Gmail, Drive, or any Google data beyond the two scopes above.

How we use it. Google Calendar and Google Sheets data is used solely to provide the features the business has enabled: checking real-time availability and creating or managing bookings on the business's behalf in response to its customers' messages, and recording leads in the business's spreadsheet. Calendar availability may be read by the business's AI assistant only to answer scheduling questions and perform these booking actions.

How we store it. We store the OAuth access and refresh tokens needed to perform these actions. Tokens are encrypted at rest (AES-256) and transmitted only over encrypted (TLS) connections. We do not copy or retain the contents of your Google Calendar or Google Sheets beyond what is necessary to complete a requested operation.

How we share it. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized artificial-intelligence or machine-learning models. Google user data is not transferred to third parties except the limited infrastructure and AI service providers needed to operate the features above (under data-processing agreements), where required by law, or in a merger or acquisition with appropriate notice.

Retention and revocation. Tokens are retained only while the integration remains connected. A business may disconnect Google at any time from its dashboard or by contacting us, and may revoke our access directly at myaccount.google.com/permissions. On disconnection or account termination, the stored Google tokens are deleted.

8. Data Retention

Conversation data is retained for up to 90 days to allow businesses to review interaction history and resolve disputes. After this period, message content is deleted. Chats imported from a business's WhatsApp history are deleted 90 days after import. Analytics aggregates (non-personally identifiable) may be retained longer.

9. Your Rights

Depending on your location, you may have rights to:

• Access the personal data we hold about you.
• Request deletion of your personal data.
• Object to certain processing activities.
• Lodge a complaint with a data protection authority.

To exercise these rights, please contact us at [email protected].

10. Data Deletion

You may request deletion of your data at any time. To submit a data deletion request, please visit: https://concierge.xcelerateak.com/api/meta-data-deletion or email us at [email protected]. When a business deletes its account, its conversations and any imported chat history are deleted with it; a business can also delete imported chats at any time from its dashboard, and any draft built from them that it has not approved is deleted with them.

11. Security

We implement industry-standard security measures including encrypted connections (TLS), access controls, and regular security reviews to protect your data. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

12. Children's Privacy

Our services are not directed at individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy, please contact:

• Company: XCelerate AK LLC (registered in the United States and in Ghana), operating from Accra, Ghana
• Email: [email protected]
• Website: https://xcelerateak.com