Privacy Policy

1. Overview

Gurbakhshish Traders ("we", "us", "our") provides a chat automation platform that helps businesses build flows and AI-assisted replies across Facebook Messenger, WhatsApp, and Instagram (the "Service"). This policy explains what we collect when a business ("Customer") and that business's end customers ("Contacts") use the Service, why we collect it, and the choices available.

If your organization is a Customer using the Service to message your own Contacts, you act as the data controller for that messaging, and we act as a data processor on your behalf. This policy describes our practices as both the platform operator and, where relevant, as a processor.

2. Data we collect

Account & billing data

• Name, business email, and password (stored as a salted hash) when you create an account.
• Company name, billing address, and payment details, processed by our payment provider — we do not store full card numbers.
• Support tickets and messages you send to our team.

Usage data

• Log data such as IP address, browser type, device identifiers, and pages visited within the dashboard.
• Flow-builder activity: flows created, blocks used, and error events, used to keep the product working.
• Cookies and similar technologies for authentication and basic analytics — see the cookie table below.

3. Data from Messenger, WhatsApp & Instagram

When a Customer connects a Facebook Page, WhatsApp Business Account, or Instagram professional account, we receive and process the data needed to operate the flows that Customer configures. This can include:

• Contact identifiers issued by the platform (such as a page-scoped user ID or WhatsApp phone number) — we do not receive a Contact's personal Facebook or Instagram login credentials.
• Message content sent to or from the connected account, including text, quick-reply selections, and attachments the Contact sends.
• Public profile fields the platform makes available for messaging, such as first name and profile picture, where permitted by that platform's policies.
• Comment and mention data, when a Customer builds a comment-to-DM or mention-triggered flow.

Our use of this data follows the respective platform policies, including Meta's Platform Terms and WhatsApp Business Messaging Policy, in addition to this policy and our agreement with each Customer.

4. AI Desk (testing phase)

AI Desk is an optional feature, currently in a testing phase, that drafts or sends automated replies. When a Customer enables it:

• Conversation text is sent to our AI processing systems to generate a suggested or automatic reply, together with any knowledge-base content the Customer has connected (FAQs, product catalog, prior resolved chats).
• A confidence score is calculated for each reply; below the Customer's configured threshold, the message is routed to a human agent instead of being sent automatically.
• Because this feature is in testing, conversation samples may be reviewed by our team, in de-identified or aggregated form where feasible, to improve reply accuracy and safety.
• Customers can disable AI Desk, or exclude specific flows from it, at any time from account settings.

5. How we use data

• To operate the flows and integrations a Customer configures, and to deliver messages across connected channels.
• To provide, maintain, and improve the Service, including the AI Desk while it is in testing.
• To authenticate accounts, prevent fraud, and secure the Service against abuse.
• To send account, billing, and service-related communications.
• To comply with legal obligations and enforce our terms of service.

6. Sharing & third parties

We share data only as needed to run the Service:

We do not sell personal data. We disclose data to law enforcement or regulators only where required by applicable law, and we notify the affected Customer where legally permitted.

7. Retention

We retain conversation data for as long as the Customer's account is active, or as needed to provide the Service, and delete or anonymize it within 90 days of account closure unless a longer period is required for legal, tax, or dispute-resolution purposes. Customers can request earlier deletion of specific conversations from their dashboard or by contacting us.

8. Security

We use encryption in transit and at rest, role-based access controls, and regular access reviews. No method of transmission or storage is completely secure, so while we work to protect data, we cannot guarantee absolute security.

9. Your rights & choices

Depending on where you're located, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

• Customers: manage account and billing data directly from account settings, or contact us to request export or deletion.
• Contacts messaging a Customer: requests about your data are generally directed to that business, since they control the messaging relationship; we support them in fulfilling these requests and will assist directly where required by law.
• You can withdraw consent for AI Desk processing on a given flow by contacting the Customer operating that account, or by messaging "stop" where the flow supports it.

10. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children under 13 (or the minimum age required by local law) through our own account-creation flows. If we learn that a Contact appears to be a child and a Customer's flow has collected data beyond what the messaging platform itself provides, we will work with the Customer to address it.

11. International transfers

We and our providers may process data in countries other than where a Customer or Contact is located. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

12. Changes to this policy

We may update this policy as the Service, including features currently in testing such as AI Desk, evolves. We will post the updated version here with a new "last updated" date, and notify Customers of material changes by email or in-app notice.

13. Contact us

Questions about this policy or a data request can be sent to privacy@fbchat.alphavchat.com. We aim to respond within 30 days.