Privacy policy

• Business account data. When a business signs up, we collect the account owner's and team members' names, email addresses, phone numbers and passwords (stored only as secure hashes), plus business details such as name, address, services, prices, opening hours and payment details the business chooses to share with its customers. For this data, we are responsible as the controller.
• Customer conversation data. When people message a business that uses our service, we process their WhatsApp number, profile name, messages, voice notes, images and documents, bookings, payment screenshots and notes the business adds. We process this on behalf of the business, which decides how it is used and is the controller. If you are a customer of a business, please contact that business first about your data; we will help them respond.

• To run the service: receive and send WhatsApp messages, answer customers with AI, take bookings, send reminders and show chats to the business's team.
• To help the assistant remember useful facts about a returning customer (for example a preferred time), only within that business's account.
• To bill businesses for their plan, provide support, keep the service secure and prevent abuse.
• To send businesses service messages about their account. We do not sell personal data and we do not use it for advertising.

We use a small number of providers to run the service. They may only use the data to provide their service to us:

• Meta Platforms, which runs the WhatsApp Business Platform. Messages travel through Meta's systems under Meta's own terms and policies.
• AI providers (Google Gemini, and Anthropic Claude where enabled), which generate replies, read payment screenshots and transcribe voice notes. They receive the parts of a conversation needed to produce a reply.
• Hosting and infrastructure providers that store our database and run our servers.

We may also disclose data when the law requires it, or to protect the rights and safety of our users and the public.

We keep business account data and conversation data for as long as the business's account is active. When a business closes its account or asks us to delete data, we delete it within 30 days, except where we must keep some records (such as invoices) to meet legal or accounting obligations. Backups are overwritten on a rolling basis.

Access to each business's data is limited to its own team and to our staff when needed for support. Passwords are stored as one-way hashes, connections to the service are encrypted, and important account actions are logged. No system is perfectly secure, so please use a strong password and tell us straight away if you suspect a problem.

• Business users can view and update their details in the dashboard, and can export or delete conversations by asking us.
• Customers can reply STOP to a business at any time to stop receiving its offers and announcements.
• Anyone can ask us for a copy of their data, a correction or deletion. See how to request data deletion.

The service is meant for businesses and is not directed at children under 13.

We may update this policy as the service changes. We will change the date at the top and, for important changes, let business accounts know by email or in the dashboard. You can always reach us at contact@subtle-marketing.com.