Legal
Plain-language summaries first; the full text follows each.
Questions about privacy or data processing? Contact us. See also our pricing.
Summary. We collect what we need to run the service: account details, conversation data you route through the platform, and usage telemetry. We do not sell personal data. Conversation data is processed on your instructions as a processor; we are a controller only for our own customers’ account and billing data.
DGY LLC, a Wyoming limited liability company doing business as Aftersales (“Aftersales”, “we”, “us”), operates aftersales.co, the Aftersales web app and the Aftersales chat widget. For the personal data described in this policy that we use for our own purposes, Aftersales is the data controller. Registered address: 312 West 2nd Street #1195, Casper, Wyoming 82601, USA. Contact: privacy@aftersales.co or our contact form. Enquiries are kept for twelve months so we can handle follow-up questions.
We process personal data in line with the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and other applicable privacy laws.
Aftersales is a customer service platform: an AI Agent that resolves conversations, a Copilot that assists human agents, and a shared inbox and helpdesk. When our customers use Aftersales to talk to their customers, we process that conversation data as a processor on the customer’s instructions under our Data Processing Agreement. The customer is the controller and is responsible for the lawfulness of that processing and for answering their end users’ rights requests. If you are an end user of one of our customers, please contact that business first.
We act as a controller for: visitors to aftersales.co; people who contact us; and our customers’ account, team-member and billing data.
Website visits. Device and browser type, operating system, IP address, pages visited, referrer, and date and time of the request, as recorded in standard server logs.
Account registration and support. Name, email address, password (stored hashed by our authentication provider, Supabase; we never see it in plain text), sign-in provider details where you use single sign-on, confirmation that you are 18 or over, company name, job role, team members’ names and email addresses, profile photo, phone number, billing address, VAT/tax ID, and payment details (handled by Stripe; we do not store full card numbers).
Chat widget and conversations (as processor). Depending on how the customer configures Aftersales, this may include:
Product telemetry and error reporting. When you use the web app we collect usage events and diagnostic information about errors (for example the action attempted and device details) so we can find and fix problems.
The Aftersales Agent and Copilot draft and send replies, summarise conversations, search connected knowledge sources and suggest actions. To do this, the content needed for each request — conversation text, relevant help-centre and knowledge-base content, customer-configured instructions and, where enabled, attachments — is sent to our servers and to our AI model provider, Anthropic, PBC. Some processing (such as indexing knowledge content) runs automatically in the background once a feature is enabled.
We do not sell personal data and do not share it for cross-context behavioural advertising.
We use carefully selected service providers (sub-processors) for cloud infrastructure, database hosting, website and app hosting, AI model inference, email delivery and payments. Each is bound by a written agreement that limits their use of the data to providing services to us. The current list, with each provider’s purpose and processing location, is published on our data protection page; customers receive 30 days’ notice of changes. We may also disclose data where required by law, or to a successor in a merger or acquisition subject to this policy.
Account data, login credentials and all customer content — conversations, attachments, knowledge content and backups — are stored in our Supabase database in the United States. We do not currently offer hosting in other regions. The providers we use and their locations are listed in our sub-processor list.
Where personal data is transferred outside the EEA or UK, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, with supplementary measures where required. Contact privacy@aftersales.co for a copy of the relevant safeguards.
We keep personal data only as long as needed for the purposes above. Account data is kept for the life of the account and deleted or anonymised after closure, except where we must keep it longer for legal, tax or accounting reasons or to resolve disputes. Customer conversation data is retained according to the customer’s settings and deleted at the end of the contract as described in the DPA. Server logs are kept for a limited period for security purposes.
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, authentication managed by Supabase, and role-based access controls. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Our liability for security incidents is limited as set out in section 14 of our Terms.
We use cookies and local storage that are strictly necessary to run the website, keep you signed in and operate the chat widget (for example, to remember a conversation session). These do not require consent. If we introduce functional, analytics or marketing cookies, we will ask for your consent first and list them here, and you will be able to withdraw consent at any time. You can also block or delete cookies in your browser settings, though parts of the service may then stop working.
Our website loads fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads.
Our website and service may link to third-party sites and integrations. Their own privacy policies apply, and we are not responsible for their practices.
Aftersales is a business service for adults. Account holders must be 18 or over and confirm this at sign-up. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA/UK); if we learn we have, we will delete it. Our customers must not direct their chat widgets at children without complying with applicable children’s privacy laws, such as COPPA.
Customers grant us a royalty-free licence to use their company name and logo for marketing purposes only, as set out in section 11 of our Terms of Service. This covers business brand features, not personal data about individuals.
Subject to applicable law, you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interests or used for direct marketing. Where processing is based on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal. Depending on where you live (for example California), you may have additional rights, and we will not discriminate against you for exercising them.
To exercise your rights, email privacy@aftersales.co. We may need to verify your identity. You also have the right to complain to your local data protection supervisory authority.
We have not appointed a statutory data protection officer. Privacy questions and requests are handled by our privacy team at privacy@aftersales.co, or by post to DGY LLC, 312 West 2nd Street #1195, Casper, Wyoming 82601, USA.
We may update this policy to reflect changes in law or in how we operate. The updated version applies from the date it is published here; for material changes we will notify customers by email or in the app.
Last updated: October 9, 2026.
Summary. Business use only, 18+. Plans are monthly or annual, cancel any time, fees non-refundable. You own your data and should keep backups. Test before going live. AI answers come from the content you provide and are your responsibility. We are not liable for downtime or data loss. HIPAA is available only on the Enterprise plan with a signed BAA. Contact us first about any issue; disputes go to individual arbitration in Wyoming.
Please read these Terms carefully. Section 17 requires most disputes to be resolved by individual binding arbitration and waives class actions and jury trials. Sections 12 and 14 limit our liability, including for data loss and downtime.
These Terms of Service (“Terms”) are a binding agreement between DGY LLC, a Wyoming limited liability company doing business as Aftersales (“Aftersales”, “we”, “us”), and the business or organisation that creates an account, signs an order form or uses the Services (“Customer”, “you”). You accept these Terms by ticking the acceptance box at sign-up, signing an order form or using the Services. If you accept on behalf of an organisation, you confirm you have authority to bind it; if you do not, you are personally bound. If an order form signed by both parties conflicts with these Terms, the order form controls for that subject only.
The Services are for business use only and are not intended for consumers. To create an account you must be at least 18 years old and must confirm this by ticking the age confirmation box at sign-up. Accounts created by anyone under 18, or by giving false information at sign-up, are a breach of these Terms and may be closed without notice or refund. You must not use the Services if you are barred from doing so under applicable law, including US sanctions and export laws.
Sign-in and authentication are provided through our sub-processor Supabase. You must keep login credentials confidential, enable available security features, and give accurate account information. You are responsible for all activity under your account, including by your team members, contractors and anyone using your credentials, whether or not authorised by you. Notify us immediately at privacy@aftersales.co if you suspect unauthorised access. We are not liable for losses caused by unauthorised use of your credentials.
Aftersales provides an AI Agent, Copilot, shared inbox, helpdesk, chat widget and related features (the “Services”). We may add, change or remove features at any time. Free trials and beta or preview features are provided “as is”, may be changed or withdrawn without notice and carry no commitments of any kind.
Before you install the Services on a live website, store or app, or connect them to live customers, you must test them in a test or staging environment to confirm they work correctly with your systems, content and settings. You are solely responsible for deciding when to go live, for your configuration, and for any effect the Services have on your website, store, orders, customers or revenue. We recommend keeping your own backups of any data you rely on.
The AI Agent and Copilot use artificial intelligence provided by our sub-processor Anthropic to generate answers based on the documents, websites, knowledge sources and instructions you supply. You acknowledge that:
You will not, and will not allow anyone to, use the Services to: break any law or infringe anyone’s rights; send spam or unsolicited messages; collect data without a lawful basis or required notices; upload malware or harmful content; attempt to probe, breach, overload or test the Services’ security without our written permission; scrape, copy, reverse engineer or build a competing product from the Services; resell or sublicense the Services without agreement; impersonate any person; or process protected health information, payment card data, government ID numbers or other sensitive data except as expressly permitted in section 8. We may suspend or terminate access immediately, without liability, if we reasonably believe you have breached this section or your use poses a legal, security or operational risk to us or others. Report abuse at /legal/report-abuse.
HIPAA-compliant processing, including a HIPAA-eligible database configuration, is available only on the Enterprise plan and only after both parties sign a Business Associate Agreement (“BAA”). Unless you are on the Enterprise plan with a signed BAA in force, you must not upload, send or allow your end users to submit protected health information (“PHI”) through the Services, and you must configure the AI to redirect health questions to a human. We have no obligations under HIPAA for any PHI submitted without a signed BAA, and you are solely responsible for, and will indemnify us against, any consequences of doing so.
Fees are as shown on the pricing page or your order form. Subscriptions are billed in advance monthly or annually through our payment processor Stripe and renew automatically for the same period until cancelled. AI resolutions and other usage are billed in arrears as defined on the pricing page. You authorise us to charge your payment method for all fees. Fees exclude taxes, which you must pay (other than taxes on our income). You may cancel at any time; cancellation takes effect at the end of the current billing period. All fees are non-refundable except where required by law or expressly stated otherwise. We may change prices with at least 30 days’ notice, effective from your next renewal. Overdue amounts may lead to suspension and bear interest at 1.5% per month or the maximum permitted by law, if lower. You agree to raise any billing dispute with us under section 16 before filing a chargeback.
You own the data and content you and your end users submit to the Services (“Customer Data”). You grant us a worldwide, royalty-free licence to host, copy, process and transmit Customer Data as needed to provide, secure, support and improve the Services, as described in our privacy policy and DPA. Customer Data is stored with our sub-processor Supabase in the United States. You confirm you have all rights, consents and notices needed for us to process Customer Data. You are responsible for keeping your own backup copies of Customer Data. You can export Customer Data while your account is active. We may use aggregated, de-identified data to operate and improve the Services.
While you use the Services, you grant Aftersales a non-exclusive, royalty-free, worldwide licence to use your company name, logo and trademarks (“Brand Features”) for marketing purposes only — for example on our website, customer lists, case studies, presentations, advertising and social media — to identify you as a customer of Aftersales. We will not alter your Brand Features beyond resizing, and will not suggest you endorse us beyond being a customer without your approval. After your account ends we will stop adding your Brand Features to new materials and will remove them from our website within 30 days of a written request; we are not required to recall materials already printed or distributed.
We work to keep the Services available and to protect Customer Data, but we do not guarantee that the Services will be uninterrupted, error-free, secure or available at any particular time, or that Customer Data will not be lost or corrupted. The Services depend on third-party infrastructure (including Supabase, Amazon Web Services, Vercel and Anthropic) and the internet, which are outside our control. To the maximum extent permitted by law, Aftersales is not liable for any downtime, outage, delay, maintenance, data loss, data corruption, failed message delivery or AI unavailability, or for any lost sales, orders or customers resulting from them. Any uptime commitment or service credit applies only if set out in a separate written service-level agreement signed by Aftersales, and those credits are your sole remedy.
Aftersales and its licensors own all rights in the Services, software, AI configurations we provide, documentation and our brand. We grant you a limited, non-exclusive, non-transferable, revocable right to use the Services during your subscription for your internal business purposes. If you give us suggestions or feedback, we may use them freely without obligation to you.
The Services are provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, title, non-infringement, accuracy and any warranty arising from course of dealing.
To the maximum extent permitted by law: (a) Aftersales will not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, sales, goodwill, data or business interruption, however caused and even if advised of the possibility; and (b) Aftersales’ total liability for all claims arising out of or relating to the Services or these Terms is limited to the fees you actually paid us in the three (3) months before the event giving rise to the claim, or US$100 if you have paid nothing. These limits apply to every theory of liability, including contract, tort (including negligence) and statute, and are an essential basis of our pricing. They do not limit liability that cannot be limited by law, such as for fraud or wilful misconduct.
You will defend, indemnify and hold harmless Aftersales and its members, managers, employees and contractors from all claims, losses, liabilities, fines and costs (including reasonable legal fees) arising from: Customer Data; your use of the Services or AI output; statements the AI makes to your customers; your breach of these Terms or of law (including privacy, consumer protection, marketing and HIPAA laws); or any dispute between you and your customers.
If you have any problem with the Services, a bill or these Terms, you agree to contact us first at privacy@aftersales.co with a description of the issue, so we can try to resolve it. Both parties will negotiate in good faith for at least 30 days from that notice before either starts arbitration, legal proceedings, a payment chargeback or a regulatory complaint (except where the law gives you a right to complain to a regulator directly, or where urgent injunctive relief is needed to protect intellectual property or confidential information). Time limits for claims are paused during this period.
Any dispute not resolved under section 16 will be resolved by final and binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, seated in Casper, Wyoming (hearings may be held by video). Judgment on the award may be entered in any court with jurisdiction. Either party may instead bring an individual claim in small-claims court if it qualifies. Claims may be brought only on an individual basis, not as a plaintiff or class member in any class, consolidated or representative proceeding, and each party waives any right to a jury trial. Any claim must be started within one year after it arises, or it is permanently barred, to the extent permitted by law.
You may stop using the Services and cancel at any time. We may suspend or terminate your account, with or without notice, if you breach these Terms, fail to pay, create risk or legal exposure for us, or if we stop offering the Services (in which case we will refund any prepaid fees for the unused period). After termination your right to use the Services ends immediately; you may request an export of Customer Data within 30 days, after which we may permanently delete it. Sections that by their nature should survive (including 6, 8, 10–17 and 19) survive termination.
These Terms are governed by the laws of the State of Wyoming, USA, without regard to conflict-of-laws rules. Subject to section 17, the state and federal courts located in Wyoming have exclusive jurisdiction. You may not assign these Terms without our written consent; we may assign them to an affiliate or successor. We are not liable for failures caused by events beyond our reasonable control, including outages of third-party providers, internet failures, cyberattacks, natural disasters, war, labour disputes or government action. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. Our failure to enforce a provision is not a waiver. We may update these Terms; material changes take effect 30 days after notice by email or in the app, and continued use after that date means you accept them. These Terms, the privacy policy, the DPA, any BAA and any signed order form are the entire agreement between us on this subject. Notices to us must be sent to privacy@aftersales.co and by post to DGY LLC, 312 West 2nd Street #1195, Casper, Wyoming 82601, USA.
Summary. Our DPA incorporates the EU Standard Contractual Clauses and the UK Addendum, lists sub-processors with 30 days’ notice of changes, and states that customer data is hosted in the United States.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between DGY LLC, doing business as Aftersales (“Processor”), and the Customer (“Controller”) and applies when Aftersales processes personal data on the Customer’s behalf in providing the Services (“Customer Personal Data”). It reflects the requirements of Article 28 GDPR, the UK GDPR and, where applicable, US state privacy laws (under which Aftersales acts as a “service provider”).
Aftersales processes Customer Personal Data only on the Customer’s documented instructions — these Terms, this DPA and the Customer’s configuration of the Services — unless required otherwise by law, in which case we will inform the Customer unless legally prohibited. We will tell the Customer if we believe an instruction infringes data protection law. We will not sell Customer Personal Data, use it for our own purposes beyond providing the Services, or use it to train AI models.
Everyone authorised to process Customer Personal Data is bound by confidentiality obligations and receives appropriate privacy and security training. Access is limited to what is necessary.
We implement appropriate technical and organisational measures, including encryption in transit and at rest, authentication and database security provided by Supabase, role-based access control and backups. The Customer acknowledges that no measures are perfectly secure and that it is responsible for its own account security, configuration and backups.
The Customer authorises Aftersales to use the sub-processors listed on our data protection page. We will give at least 30 days’ notice before a new sub-processor starts processing Customer Personal Data. The Customer may object on reasonable data-protection grounds within that period; if we cannot reasonably resolve the objection, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees. We impose data protection terms on each sub-processor at least as protective as this DPA and remain responsible for their performance.
Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where the Customer is itself a processor), the UK International Data Transfer Addendum and Swiss amendments, which are incorporated by reference. The EU–US Data Privacy Framework may be relied on for certified recipients. We carry out transfer impact assessments and apply supplementary measures where required. Customer Personal Data is hosted in the United States.
Taking into account the nature of processing, we will help the Customer respond to requests to exercise data subject rights, mainly through self-service tools in the Services (export, edit and delete). If we receive a request directly, we will pass it to the Customer and not respond except to redirect the requester.
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, providing the information reasonably available to help the Customer meet its own notification obligations, and will take reasonable steps to contain and remedy it.
We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Services.
The Customer may export Customer Personal Data at any time. After the agreement ends, the Customer has 30 days to export data, after which we delete Customer Personal Data from production systems, with backups overwritten within a further 90 days, unless retention is required by law.
We will make available, on request and under confidentiality, information reasonably necessary to demonstrate compliance with this DPA, such as written answers to security questionnaires. If that is insufficient or a supervisory authority requires it, the Customer may conduct an audit on at least 30 days’ notice, no more than once a year, during business hours, at its own cost and subject to confidentiality.
This DPA is governed by the same law as the Terms, except where the Standard Contractual Clauses require otherwise. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. Liability under this DPA is subject to the exclusions and limitations in the Terms, to the extent permitted by law. HIPAA obligations apply only under a separate signed BAA. To request a countersigned copy, email privacy@aftersales.co.
Last updated: October 9, 2026 · Questions: privacy@aftersales.co