Privacy Policy

1. Who we are

Lungisa is an AI-powered back-office agent for small service businesses, operated by PopupReach Inc., a company incorporated in Manitoba, Canada. When this policy refers to "Lungisa," "we," "us," or "our," it means PopupReach Inc.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. If you have questions about how we handle your data, contact us at the details in Section 14.

2. Information we collect

We collect information in three ways: what you give us directly, what we collect automatically as you use the service, and what we receive from software you choose to connect.

Information you provide directly:

• Account details — your name, email address, and business name when you register
• Business profile — your business type, phone number, working hours, service description, and any knowledge base content you enter so the assistant can represent your business accurately
• Customer data — names, phone numbers, email addresses, and notes about your customers that you add or sync into Lungisa
• Invoice and financial records — invoice amounts, due dates, statuses, and related records you add or sync
• Integration credentials — connection tokens for accounting or CRM software you choose to connect. These are encrypted and used only to perform the syncs you request.
• Voice and assistant settings — your business phone number, assistant name, transfer number, and any after-hours message you configure
• Support communications — messages you send us when seeking help

Information collected automatically:

• Usage data — which features you use and how often, to help us improve the product
• Call records — records of calls answered by the Lungisa voice agent on your behalf, including the caller's number, call duration, transcript, and AI-generated summary
• Agent action logs — a record of actions Lungisa took on your behalf, such as drafts created, reminders sent, and approvals you gave, so you can review what happened
• Log data — server-side logs including IP address, browser type, and timestamps, used only for security monitoring and debugging
• Session data — authentication tokens used to keep you securely signed in

Information from connected software:

• When you connect an accounting platform, CRM, or field service tool, we retrieve only the data types you authorize, such as contacts, invoices, or jobs
• When you use the Lungisa Chrome extension and click Sync, we receive only the page content you explicitly choose to sync. The extension does not run in the background and does not read pages you have not actively chosen to sync.

3. How we use your information

We use the information we collect to:

• Operate and deliver the Lungisa service — drafting messages, chasing invoices, logging customer interactions, and answering calls on your behalf
• Personalize the AI assistant's responses using your business name, services, hours, and knowledge base
• Sync data between Lungisa and connected software platforms at your direction
• Send you notifications about agent actions taken and decisions that need your approval
• Generate reports, summaries, and business insights from your data
• Monitor and improve the accuracy and reliability of the service
• Detect and prevent fraud, abuse, and security incidents
• Comply with our legal obligations under PIPEDA and other applicable law
• Respond to your support requests

AI model training: We do not use your business data, customer data, or call transcripts to train general AI models that are shared across other customers. Your data is used only within your account to operate Lungisa for your business.

4. Legal basis for processing

Under PIPEDA and applicable privacy law, we rely on the following bases to process your personal information:

• Contract performance — processing necessary to provide the Lungisa service under our Terms of Service
• Consent — where you have given us clear consent, such as connecting a third-party integration or enabling the voice agent
• Legitimate interests — operating and improving the service, detecting fraud, and maintaining security, where those interests do not override your privacy rights
• Legal obligation — where we are required to process data to comply with applicable law

5. How we share your information

We do not sell your data. We do not share your data with advertisers. We share information only in these limited circumstances:

• Infrastructure and service providers: We use third-party providers to host, process, and deliver the service. Each provider processes your data only as necessary for the specific function they perform, under confidentiality obligations. We do not share your data with providers for their own marketing or product development purposes.
• Connected platforms: When you connect an accounting or CRM platform, we send and receive data with that platform as directed by you. That platform's own privacy policy governs their use of the data.
• Legal requirements: We may disclose information if required by law, court order, or a lawful government request, or to protect the rights, property, or safety of Lungisa, our users, or the public.
• Business transfer: If PopupReach Inc. is acquired or merged, your data may transfer to the acquiring entity. We will notify you before any such transfer and the acquirer will be bound by equivalent privacy protections.
• With your consent: In any other situation where you have given us explicit permission.

6. Voice agent and communications

When you enable the Lungisa voice agent, the AI answers inbound calls to your business phone number on your behalf. The following applies:

• Call audio is processed in real time by our AI infrastructure to generate spoken responses
• Transcripts of calls are stored in your Lungisa account for your review and reference
• AI-generated summaries of each call are stored and can be sent to you by text message
• Caller phone numbers are logged and may be matched to existing customer records in your account
• You are responsible for ensuring callers are appropriately informed that they may be interacting with an AI, as required by applicable law in your jurisdiction
• Call transcripts are retained for 12 months and then deleted automatically

When Lungisa sends messages on your behalf, you are responsible for ensuring those messages comply with Canada's Anti-Spam Legislation (CASL) and any other applicable messaging laws. Lungisa sends messages only to recipients for whom you have the required consent on file.

7. Data retention

We retain your data for as long as your account is active. When you close your account:

• Your personal data and business data are deleted within 30 days
• Call transcripts and agent logs are deleted within 30 days
• System backups containing your data are purged within 90 days
• We may retain certain records for longer where required by law, such as financial records for tax compliance

You may also request deletion of specific data without closing your account by contacting us. We will respond within 30 days.

8. Your rights

Under PIPEDA and applicable Canadian privacy law, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Deletion — request that we delete your personal data, subject to legal retention obligations
• Portability — receive your data in a structured, machine-readable format
• Withdraw consent — where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing
• Object — object to processing based on legitimate interests in certain circumstances
• Complaint — lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you believe we have not handled your data lawfully

To exercise any of these rights, contact us at info@popupreach.com. We will verify your identity before processing the request and respond within 30 days.

9. Data security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of all personal and business data at rest
• Encrypted connections (TLS) for all data transmitted between your device and our servers
• Access controls ensuring each business account can access only its own data
• Encrypted storage for all integration credentials and connection tokens
• Restricted access to production systems, limited to authorized personnel only
• Regular security monitoring and incident response procedures

No system is completely secure. If we become aware of a data breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada within 72 hours of discovery, as required by PIPEDA's Breach of Security Safeguards Regulations.

10. Cookies and tracking

Lungisa uses only essential cookies required to keep you signed in, maintain your session, and remember your preferences. We do not use advertising cookies, third-party tracking cookies, or behavioral analytics tools that share your data with external parties.

The Chrome browser extension does not place cookies on any websites you visit. It only reads visible page content when you explicitly click Sync.

11. International data transfers

Lungisa is operated from Canada. Some components of our service infrastructure are located in the United States. When data is processed outside Canada, we ensure appropriate contractual safeguards are in place to protect your information to a standard equivalent to Canadian law.

By using Lungisa, you acknowledge that your data may be processed in Canada and the United States.

12. Children

Lungisa is a business tool intended for use by adults. We do not knowingly collect personal information from anyone under the age of 16. If you believe we have inadvertently collected data from a minor, contact us and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect and update the effective date at the top of this page.

Your continued use of Lungisa after changes take effect constitutes your acceptance of the updated policy. If you do not agree, you may close your account before the changes take effect.

14. Contact us

For any privacy questions, requests, or concerns, contact our Privacy Officer:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.