Privacy Policy

1. Information we collect

From Merchants (account holders)

• Account information. Your name, email address and profile image from Google sign-in.
• Business information you provide. Your business profile, opening hours, FAQs, documents and assistant settings (the “Knowledge Base”).
• WhatsApp connection credentials. The phone number ID, WhatsApp Business Account ID, access token and app secret you enter to connect your number. These are encrypted at rest and used only to send and receive messages on your behalf.
• Purchase information. Your reply-credit balance and order history. Payments are processed by Stripe (payment processor) and Dodo Payments (merchant of record for purchases made through its checkout). We do not receive or store your full card number, CVV or bank details.
• Usage & device data. IP address, browser type, timestamps and error logs used to operate and secure the Service.

About End Customers (on behalf of Merchants)

• Message data. When an End Customer messages a connected WhatsApp number, we receive the message content, the sender’s WhatsApp phone number and display name, timestamps and delivery statuses, and the replies the assistant sends.

For End Customer message data, the Merchant is the data controller and we act as a data processor on the Merchant’s instructions. If you are an End Customer with questions about how a business uses your data, please contact that business directly.

2. How we use information

• To generate and send replies to End Customers using the Merchant’s Knowledge Base.
• To show Merchants a log of conversations, usage and replies that need human attention.
• To create and secure Merchant accounts and process purchases.
• To communicate with Merchants about their account, orders and support requests.
• To detect, prevent and address fraud, abuse and security issues, and to enforce daily reply limits.
• To comply with our legal obligations.

We do not use End Customer messages or Merchant Knowledge Bases to train AI models, and we do not sell personal information or share it for third-party advertising.

3. Third-party services we share data with (sub-processors)

We share the minimum information necessary with providers that help us run the Service:

• Meta Platforms (WhatsApp Business Platform) — messages are received from and sent to End Customers through the WhatsApp Business Platform. Meta’s handling of WhatsApp messages is governed by its own terms and privacy policy.
• Anthropic — the AI model provider that generates replies. The Merchant’s Knowledge Base and the relevant conversation history are sent to the provider to produce each reply. Data sent for this purpose is not used to train their models.
• Stripe (payment processor) and Dodo Payments (merchant of record for purchases made through its checkout) — payment processing. Payment details are provided directly to them.
• Google — to authenticate Merchants who sign in with Google.
• Hosting & infrastructure providers — to host the Service and store data.

4. Cookies & local storage

We use a strictly necessary session cookie to keep Merchants signed in, and browser local storage to remember preferences. We do not use third-party advertising or tracking cookies.

5. Data retention

We keep Merchant account data, Knowledge Bases and order records for as long as the account is active or as needed to provide the Service and meet legal, tax and accounting requirements. Conversation logs are retained so Merchants can review them; Merchants may ask us to delete conversation data at any time, and all data associated with an account is deleted when the account is deleted (subject to legal retention requirements). WhatsApp connection credentials are deleted immediately when a Merchant disconnects a number.

6. Security

We use industry-standard measures to protect information, including encryption in transit, encryption of WhatsApp credentials at rest, and signature verification of every webhook we receive from Meta. No method of transmission or storage is 100% secure, but we work to protect your data and promptly address any issues.

7. Your rights

Subject to applicable law, you may request to access, correct, export or delete your personal information, and object to or restrict certain processing. Merchants can exercise these rights by contacting us at [email protected]. End Customers should contact the Merchant they messaged; we will assist Merchants in responding to such requests.

8. International transfers

Information may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers.

9. Children's privacy

The Service is a business tool and is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above.

11. Contact

Questions or requests? Email us at [email protected].