Privacy Policy

From customers who message a business using AI Employee:

• Your profile name and phone number, or the platform account identifier the messaging service gives us (WhatsApp, Instagram, Facebook Messenger, or TikTok).
• The content of your messages, including any photos, videos, or voice notes you send.
• Order details you provide during a conversation — name, delivery address, phone number, and the items ordered.

From business users of the platform: a username, a hashed password, and role.

We also record technical logs (timestamps, request paths, error details) needed to operate and secure the service.

We never collect payment card details. Orders are cash on delivery, so no card, bank, or payment credentials are requested, transmitted, or stored at any point.

• To deliver your messages to the business and its replies back to you.
• To generate AI-assisted replies, product recommendations, and sizing guidance.
• To create and fulfil orders, including passing details to a delivery company.
• To keep a conversation history so staff have context on a returning customer.
• To monitor service health, prevent abuse, and debug failures.

We do not sell personal data, and we do not use it for advertising or profiling.

Message content is sent to a third-party AI provider to generate a reply. Depending on the business's configuration this is either a hosted model provider or a self-hosted model running on our own servers. Where a hosted provider is used, message content is transmitted to that provider solely to produce the reply.

An AI reply may be sent automatically or held for a human to approve, depending on how the business has configured its account. A human member of staff can read any conversation at any time.

• Meta Platforms— messages are delivered through WhatsApp, Instagram, or Messenger, and are subject to Meta's own privacy terms.
• TikTok— where a business has connected a TikTok account, messages and any content it publishes are delivered through TikTok and are subject to TikTok's own privacy terms.
• Our AI provider — message content, for reply generation only.
• Delivery companies — the name, address, phone number, and order contents needed to deliver a physical order.
• Hosting and infrastructure providers — who store the data on our behalf under contract.
• Authorities — where we are legally required to disclose.

A business can connect its own accounts on WhatsApp, Instagram, Facebook Messenger and TikTok. Connecting one means the business owner grants us access through that platform's own authorisation screen; we never ask for a platform password.

For a connected TikTok account we hold:

• The account identifier TikTok issues for the connection, used to route messages and posts to the right account and to match an incoming TikTok notification to the right business.
• The basic profile fields TikTok returns at the point of connection — the display name and avatar — shown in the dashboard so the owner can confirm which account they connected. We do not read followers, audience data, or anything beyond this.
• The access and refresh tokens TikTok issues. Both are encrypted at rest. TikTok's access token lasts about 24 hours and its refresh token about 30 days, and refreshing rotates both, so we renew them on a schedule for as long as the connection is active.

Where a business publishes content to TikTok through AI Employee, the video or image and its caption are transmitted to TikTok on that business's instruction, together with the posting options it chose. We never publish to an account other than the one the business connected, and we never add watermarks, logos or promotional text to it.

A business can disconnect TikTok at any time from the dashboard. Disconnecting deletes the stored tokens and account identifier immediately, and we make no further calls to TikTok for that business. Content already published stays on TikTok and is removed from there, not from here. The same applies to the other connected platforms.

Data is stored on servers located in the European Union (Finland). Some of the processors listed above operate outside the EU, which means your data may be transferred internationally.

Conversations and orders are retained while the business account that received them remains active, so staff can see the history of a returning customer.

Photos and voice notes you send are deleted after 90 days. The message stays in the conversation so the business can still see that you sent something, but the file itself is removed and cannot be recovered. This happens automatically — you do not need to ask. Media can still be removed sooner on request, and everything is removed when an account is closed.

Access and refresh tokens for a connected platform account are kept only while that connection is active. They are deleted when the business disconnects the platform or closes its account, and they expire on their own if a connection is left to lapse.

When a business closes its account, its data — including conversations and customer records — is deleted.

• All traffic is encrypted in transit with HTTPS.
• Each business's data is isolated at the database level, so one business can never read another's conversations or customers.
• Passwords are stored only as salted hashes, never in readable form.
• Third-party credentials and access tokens are encrypted at rest, and staff accounts lock after repeated failed sign-in attempts.

No system is perfectly secure, but we work to protect your data using measures appropriate to its sensitivity.

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can also object to how we use it or ask us to restrict it. Write to us at the address below and we will respond within 30 days.

If you are messaging a business through AI Employee, that business controls your conversation data — we will pass your request on to them where appropriate.

AI Employee is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we will delete it.

We may update this policy as the service changes. The date at the top always reflects the current version, and material changes will be communicated to the businesses using the platform.

Shady Obeed
Online service, operating worldwide
shady.obid@gmail.com