Privacy Policy

1. Information we process

• Client account data: business name, contact name, email, phone number, password (stored only as a bcrypt hash) and settings.
• Business content the Client adds: products, services, prices, opening hours, answers to common questions.
• Conversations: messages exchanged between the Client and its customers on the channels the Client connects — Facebook Messenger, Instagram and, once connected, TikTok — with the sender identifier and display name the platform provides, and any orders, bookings or quotes created in them.
• Connection data: the access tokens the platforms issue when a Client connects an account.
• Technical data: IP address and request logs used for security, kept for 7 days.

2. How we use it

Only to provide the service to the Client: understanding a customer's message, drafting and sending a reply on the Client's behalf, showing conversations, orders and bookings in the Client's dashboard, securing accounts, and support.

We do not sell data, use it for advertising or profiling, combine one Client's data with another's, or use conversations to train AI models.

3. Artificial intelligence

Replies are drafted by AI models that receive the customer's message and the Client's own business information:

• Facebook and Instagram conversations: DeepSeek API.
• TikTok conversations: Google Gemini API under Google's paid-service terms, which exclude using the data to train Google's models. TikTok data is never sent to any other AI provider.

Clients can switch the assistant off or take over any conversation at any time.

4. Service providers (sub-processors)

• Hostinger — server hosting in Frankfurt, Germany, where all data is stored.
• DeepSeek — AI replies for Facebook and Instagram conversations.
• Google (Gemini API, paid tier) — AI replies for TikTok conversations.
• Meta and TikTok — to receive and send messages through the accounts the Client connects.
• Resend — sending account emails (sign-in codes, notices) to Clients.
• Arqam — sending WhatsApp sign-in codes to Clients.
• Legal authorities, only when required by a valid legal order.

5. Security

All connections use TLS 1.2 or 1.3. Conversation content and stored secrets are encrypted at rest with AES-256-GCM, with the key kept separately from the database and its backups. Each Client can see only its own data. Server access is restricted to key-based login, and administrator access requires a password and a one-time code. Backups are made daily and kept for 14 days.

6. Retention and deletion

• Client data is kept while the account is active and deleted within 30 days after the account is closed.
• When a Client disconnects a channel (or de-authorizes our app on that platform), its access tokens are deleted immediately.
• TikTok data: deleted within 7 days after the TikTok account is disconnected or de-authorized; while connected, TikTok message content is deleted automatically 180 days after the last message in a conversation.
• Deleted data leaves our backups within 14 days.

7. Your rights and deletion requests

Clients can access, correct, export or delete their data. A Client's customer can ask for their messages to be deleted, through the business or directly by writing to info@ibradevs.com; we complete deletion within 30 days. Instructions are also on our Data Deletion page.

8. Children

The service is for businesses and is not directed at children under 13. We do not knowingly collect children's data; if we learn we have, we delete it.

9. Changes and contact

We will post changes on this page and notify Clients of material changes by email or in the dashboard.

Questions and requests: info@ibradevs.com — Ibra devs, Baghdad, Iraq.