Privacy Policy

WhatsApp AI Agent — personal assistant service

Overview

This is a personal AI assistant service that the account owner runs on their own WhatsApp Business number using the official WhatsApp Cloud API provided by Meta. When you message that number, the service receives your message and — if automatic replies are enabled — may generate and send a reply.

What we receive and store

• WhatsApp messages you send (message text, sender phone number, message ID, and timestamp) may be received by the service.
• Messages and conversation data may be stored in the service's own database so the assistant can keep conversation context, and so the account owner can review activity in a private admin dashboard.
• Basic contact details — your WhatsApp phone number and, if the owner adds one, a display name — are stored to identify the conversation.
• Short conversation summaries and small memory notes may be generated to help replies stay consistent. These are created only when the owner enables that feature, and the owner can view, edit, or remove them in the dashboard.

AI processing

When automatic AI replies are enabled, message content may be sent to third-party AI model providers to generate a response. Only the conversation text needed to produce a reply is sent, and only to providers the owner has configured. If AI replies are disabled for the service or for your conversation, your messages are not sent to any AI provider.

If you send an image, its image data is sent to Google Gemini online for OCR. If you ask a question about an image or PDF, or request an image edit, that file is also sent to Gemini so it can perform the requested task. Spreadsheet analysis and supported spreadsheet edits run in the service without sending spreadsheet contents to an AI provider. Media bytes used by these file workflows may be held temporarily in server memory while a follow-up session is active (up to 15 minutes); they are not written to the service's conversation database by these workflows. Generated image edits are AI previews and may not preserve exact fonts or layout. The account owner can disable these media workflows at any time from the service dashboard: with media processing off, images and documents are neither downloaded nor sent to any AI provider, and with AI image editing off, edit requests are declined while image OCR and questions keep working.

Message content is never used for advertising, sold, or shared with anyone other than the configured AI providers described above.

Google Drive access (owner authorization)

The application uses Google OAuth solely for the Google Drive functionality it needs: the account owner authorizes the application once, and generated notice documents (PDF files) are saved to a dedicated folder in the owner's own Google Drive so they can be re-downloaded through the bot on request.

• Scope is limited: the application requests only the https://www.googleapis.com/auth/drive.file scope. Under this scope the application can only see and manage the files it created itself — every other file in the Drive stays invisible to it.
• What is stored in Drive: only the documents the application generates (notice PDFs). Nothing from your WhatsApp conversations is written to Drive.
• Google account information: the OAuth flow provides the application with a refresh token — an access credential only. The application does not request Gmail, Contacts, profile, or full-Drive scopes.
• Revocation: the owner can revoke this access at any time at myaccount.google.com/permissions, after which the application can no longer read or write any Drive files.

Third-party services

• Meta (WhatsApp Cloud API) — receiving and sending WhatsApp messages.
• AI model providers configured by the owner — generating reply text for enabled conversations (see AI processing above).
• Google Gemini — image/document understanding when those features are used.
• Google Drive (OAuth) — storage of generated notice documents, as described above.
• Hosting provider — runs the service (standard operational server logs).

Who can see stored data

Only the account owner, through a password-protected admin dashboard. The service does not display conversation content publicly.

Data retention and deletion

Data is kept only while the account owner operates the service. You can request deletion of your stored data at any time — see the Data Deletion page for how.

Security

Incoming webhook traffic is verified with Meta's signature mechanism, admin access is password-protected with server-side sessions, and provider credentials are stored only on the server. No system is perfectly secure, but the service is built to keep your data accessible only to the account owner.

Changes

This policy may be updated as the service evolves. The current version is always available at this URL.