Privacy Policy
Last updated: 25 August 2026
1. What we collect
- Account information — name, email address, and authentication details for your login.
- Workspace information — organization name, timezone, members, roles and workspace settings.
- Content you process — conversations, contacts and audiences, templates, campaigns, notes and the knowledge base you add for AI features.
- Integration data — when you connect Shopify or another service, the data that service shares with your workspace (e.g. orders, customers).
- Usage and technical data — API and webhook logs (method, endpoint, status, duration), and basic device/browser information needed to operate the Service.
2. How we use data
- To provide and operate the Service — routing conversations, sending messages via Meta’s Cloud API, running campaigns, reporting and analytics.
- To power AI features — when AI is enabled for a workspace, relevant conversation content is sent to the AI provider configured for that workspace (e.g. DeepSeek, OpenAI, OpenRouter, Groq, Anthropic, Google Gemini, or a custom endpoint) to generate drafts and summaries.
- To deliver integrations — e.g. Shopify webhooks that trigger WhatsApp messages.
- To support you, maintain security, prevent abuse and comply with law.
3. What we share
- Meta — message content and delivery data are processed through the WhatsApp Cloud API to send and receive messages on your numbers. Meta’s processing is governed by Meta’s terms and privacy policy.
- AI providers — only when AI assistance is enabled, and only the content needed to generate the requested output.
- Integration providers — only the data required to operate the integrations you connect.
- Subprocessors — hosting and infrastructure providers (e.g. Supabase for database and functions, Cloudflare for content delivery).
- Authorities — where required by law or a valid legal request.
We do not sell your personal data, and we do not use your workspace content to train models on behalf of third parties.
4. Security
- Data is encrypted in transit (TLS). Access to your data is isolated per workspace with row-level security.
- API keys, AI keys and other credentials are stored server-side and never exposed to the browser.
- We apply role-based access within workspaces and review access to production systems.
No method of transmission or storage is completely secure. You are responsible for protecting your login credentials and API keys.
5. Retention
We keep your data for as long as your account is active, plus a short period needed for backups and legal obligations. You can delete your workspace at any time — see Data deletion for what is removed and what we are required to retain.
6. Your rights
Depending on your jurisdiction (including under India’s DPDP Act 2023 and the EU GDPR where applicable), you may have rights to:
- Access and correct your personal data;
- Export your data (CSV exports are available in the Service);
- Delete your data or account;
- Withdraw consent for optional processing such as AI features;
- Lodge a complaint with your data-protection authority.
To exercise any of these, contact [email protected] from the email registered on your account.
7. Cookies and analytics
Our marketing site uses the Crisp chat widget, which may set cookies to support live chat. Cloudflare, our CDN, processes standard request metadata for security and performance. We do not use third-party advertising trackers on this site.
8. Children
The Service is not directed at children under 16, and we do not knowingly collect personal data from children.
9. Changes to this policy
We may update this policy as the Service evolves. Material changes will be announced in the Service or by email. The “Last updated” date above reflects the current version.
10. Contact
Privacy questions or requests: [email protected].