Privacy policy

Data we process

We process only what the service needs to answer your customers and run your orders.

• Your account: workspace name, email address, optional phone number, and your recharge transactions. You sign in with Google — we never see or store a password for you.
• Connected channels: Facebook Page ID and name, Instagram account ID, the access tokens Meta issues to us, and your WhatsApp session.
• Conversations: messages, photos and voice notes your customers send to your Page, Instagram account or WhatsApp number, and the agent's replies.
• Orders: customer name, phone number, delivery address, products, totals, courier tracking code and delivery status.
• Catalog: your products, prices and photos, and the Facebook Page posts you choose to import.

How we use it

To reply to your customers on your behalf, create orders, book and track parcels, check a phone number's delivery history, charge credits, keep the service secure and give you support. We do not sell personal data and we do not use it for advertising.

Who receives it

We share data only with the services that make the product work:

• Meta Platforms, to receive and send Messenger and Instagram messages.
• WhatsApp, through our WhatsApp Web gateway, to receive and send WhatsApp messages.
• Our AI model provider (currently Google, through the paid Gemini API), which receives conversation text, photos and voice notes to write each reply.
• Steadfast Courier, which receives the customer's name, phone number, address and cash-on-delivery amount when a parcel is booked.
• UddoktaPay, which processes your recharge payments. We never see your wallet PIN or card number.
• Our hosting and storage providers, which store the data on our behalf.

Delivery history check

To warn you about likely fake orders, we keep, per phone number, a count of parcels delivered and cancelled across all merchants. Other merchants see only those counts, never your order details or your customers' names and addresses.

How long we keep it

We keep your data while your workspace is active. When you delete your workspace, we delete its conversations, orders, catalog and channel tokens. Payment records may be kept longer where the law requires it.

Deleting your data

Merchants: disconnect your channels in Dashboard → Channels, then email support@haatbotai.com from your account email and ask us to delete your workspace. We confirm when it is done.

Customers who messaged a Page that uses HaatBot AI: ask the Page to delete your conversation, or email support@haatbotai.com with the Page name and your phone number or Facebook name.

Facebook users can also remove our app at Facebook Settings → Apps and Websites; we then stop receiving data from that account.

Security

All traffic uses HTTPS. Sign-in is handled by Google (Firebase Authentication) — we store no passwords. Incoming webhooks are verified by signature. Each merchant's data is isolated, so one merchant cannot read another's products, chats or orders.

Changes and contact

If we change this policy, we update the date at the top and tell merchants in the dashboard. Questions: support@haatbotai.com.