Legal
Privacy policy
Last updated 4 October 2026
Ezro answers messages for businesses. That means we handle other people’s words and details every day, and we take that seriously. This policy explains, in plain language, what we collect, why, and what you can do about it.
Who we are
Ezro is an AI agent for customer operations. It answers customers on email, Instagram, Messenger and WhatsApp, looks things up in the systems a business already uses, and hands a person anything it should not decide. The service is run by Ezro (“Ezro”, “we”, “us”), operating under the laws of the Republic of Uganda.
You can reach us about anything in this policy at privacy@ezro.app.
Whose data this covers
There are two groups of people whose personal data passes through Ezro, and our role is different for each.
- Our customers, the businesses that use Ezro, and the people who work for them. For their account details, billing details and use of the service, we decide why and how the data is used. In data protection terms, we are the controller.
- The customers of our customers, the people who write to a business that uses Ezro. Their messages are collected on behalf of that business. The business decides why and how the data is used, and is the controller. We handle it only to provide the service and on the business’s instructions. In data protection terms, we are the processor.
If you are someone who wrote to a business and you want to know what it holds about you, start with that business. If you cannot reach them, or you would rather ask us, write to privacy@ezro.app and we will pass your request on and tell you we have done so. Our data deletion page explains how.
What we collect
This website sets no cookies of its own and uses no analytics or advertising trackers. If you scroll to the booking section, a calendar provided by Cal.com may load, and Cal.com may set its own cookies for that purpose.
How we use it
We use personal data to:
- run the service, including receiving messages, answering them on a business’s behalf, and handing them to a person when that is the right thing to do;
- show the business what Ezro did and why, so they can test, review and improve it;
- provide support, and answer questions and requests sent to us;
- keep the service safe, prevent abuse, and fix faults;
- bill for the service and keep the records the law requires; and
- run and improve this website and arrange demos.
We do not sell personal data. We do not use messages, attachments or business data to train AI models, and the AI model providers we use are not allowed to train on it either.
How AI is involved
To write an answer, Ezro sends the relevant parts of a conversation, and the information it has looked up to answer it, to AI model providers. Our model provider at the date of this policy is OpenAI. They process that content only to return a response to us, under terms that prohibit them from using it to train their models.
Ezro can make mistakes. That is why a business tests it before it goes live, writes the procedures and guidance it follows, and chooses which matters always go to a person. Automated answers are produced for the business’s customers; where a matter needs a decision about someone’s rights or money, such as a refund, the business can require a person to make it.
Who else handles it
Three kinds of third party are involved when Ezro runs, and they are not in the same position.
Providers that process data for us
These companies run parts of Ezro for us. They handle personal data to provide their service to us, under contracts that require them to protect it. The no-training commitment above applies to our AI model provider.
Platforms and systems a business connects
A business that uses Ezro chooses the channels and systems it connects. Meta’s platforms behind Messenger, Instagram and WhatsApp carry the messages to us and carry our replies back. A business may also connect its own systems, such as an ERP or a spreadsheet, for Ezro to read. These platforms and systems handle data under their own terms and privacy policies, and the business’s agreement with them, not under our contracts. We do not control what they do with it.
Cal.com, for booking a demo
If a booking calendar appears on this website, it is provided by Cal.com. Cal.com is an independent service with its own privacy policy and its own cookies, and what you enter there is handled by Cal.com as well as shared with us so we can run the demo.
We may also disclose personal data where the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business (in which case we will make sure the data stays protected and tell affected customers).
International transfers
Ezro and its providers operate in several countries, so personal data may be processed outside the country where you live, including outside Uganda and the European Economic Area. Where we transfer personal data across borders, we do so in line with the laws that apply to the transfer, using safeguards such as contractual protections with our providers and measures to keep the data secure.
How long we keep it
We keep a business’s data while its account is active. Within 30 days of the account closing, or of a valid deletion request, we delete it, except for records the law requires us to keep (for example billing and tax records) and copies in backups, which are overwritten in the ordinary cycle of those backups.
Server logs on this website are kept for a short, routine period. Booking details and emails sent to us are kept as long as needed to deal with your request and our relationship with you.
Security
We protect personal data with measures that fit the risk, including encryption in transit, access limited to people who need it, separation between businesses’ data, and logging of important actions. No system is perfectly secure. If a breach affects personal data in a way the law requires us to report, we will tell the affected businesses and the relevant authority without undue delay.
Your rights
Under Uganda’s Data Protection and Privacy Act, 2019, the GDPR where it applies to you, and other applicable law, you may have the right to:
- ask whether we hold personal data about you, and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- object to, or ask us to restrict, certain uses of your data;
- receive data you gave us in a portable format; and
- withdraw consent you have given, without affecting what was done before.
To use a right, write to privacy@ezro.app. We may need to check who you are first. We will reply within the time the law sets, and within 30 days where it sets none. If your data was collected by a business that uses Ezro, we will pass your request to that business, because it decides what happens to the data, and we will help it respond.
You can also complain to your data protection authority. In Uganda that is the Personal Data Protection Office. If you are in the European Economic Area or the United Kingdom, you can complain to the supervisory authority where you live or work.
Children
Ezro is a business service and is not meant for children. We do not knowingly collect personal data from anyone under 18 for our own purposes. A business that uses Ezro is responsible for deciding whether it should be dealing with children’s data. If you believe a child has given us personal data, write to us and we will deal with it.
Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows when it last changed. If a change matters for how we treat personal data, we will tell our customers by email or in the product before it takes effect.
Contact
Questions, requests and complaints about privacy: privacy@ezro.app. For anything else: hello@ezro.app.