Privacy Policy

For a business's conversations with its own customers, the business is the controller and Olbongo processes the data on its behalf and on its instructions. For the business's own account with us (its users, plan and billing), Olbongo is the controller.

When a business connects its own WhatsApp Business Account through WhatsApp Embedded Signup (or its Instagram or Messenger account), we receive, only for the accounts the business chose to share:

• Business account details: the WhatsApp Business Account ID, phone number IDs, display phone numbers and names, and the access token the business granted to Omni.
• Messages: messages its customers send to and receive from the business (text, images, documents, voice notes, locations, button and list replies), with the sender's phone number or account ID and profile name, and delivery and read statuses.
• Account events: message template statuses and categories, phone number quality and messaging limits, marketing message preferences, and account alerts.
• Facebook Login for Business: used only to let the business grant Omni access to its WhatsApp account during Embedded Signup. We do not store the Facebook profile of the person who signs in.

• To deliver the business's messages to its customers and its customers' messages to the business.
• To show the business its inbox, contacts, tickets and history, and to run the automations and AI assistant it set up.
• To create and manage the business's message templates, and keep its account in good standing.
• To secure the service, prevent abuse, and meet legal obligations.

We do not use data received from Meta's platforms for advertising, we do not sell it, and we do not use it to build profiles of people across businesses. One business never sees another business's customers or conversations.

When a business turns on an AI assistant, the content of the conversation it answers is sent to the AI model provider the business's Omni configuration uses (for example Anthropic, OpenAI or Google), only to generate that reply. We use these providers through their business APIs, under terms that do not allow them to train their models on it. A business can turn AI off at any time, and nothing is sent to a model provider while it is off.

• Meta, to send and receive messages on the business's behalf.
• Our infrastructure providers, which host the service and its databases.
• The AI model provider, as described above, when the business uses AI.
• Services the business itself connects (its CRM, point of sale or ticketing system), only as the business configures.
• Authorities, where the law requires it.

All traffic is encrypted in transit (TLS). The access tokens businesses grant us, and every other credential, are encrypted at rest with AES-256-GCM. Access is limited to each business's own users, by role, and administrative actions are recorded in an audit log.

• Conversations and contacts are kept for the business until it deletes them or closes its account.
• Automation run records and technical logs are kept for a limited period and then deleted automatically.
• The access token for a WhatsApp account is deleted when the business disconnects it in Omni, and when the business removes Omni as its partner in Meta, which also turns its channels off.

A business can disconnect a channel in Omni, or remove Omni from its WhatsApp account in Meta Business Suite, at any time. To have its conversations and account data deleted, it can write to us. A customer of a business should contact that business, which controls its own conversations, and we help it act on the request. Full instructions: Omni data deletion.

Questions about this policy or your data: privacy@olbongo.com. We may update this policy; the date above shows the latest version.