Privacy Policy

This Privacy Policy explains what data SmartMessage AI ("we", "us") collects, how we use it, and the choices available to you. It applies to businesses that sign up for the Service ("you", the "business") and, where relevant, to that business's own customers who message the business on WhatsApp ("your customers").

For your customers: SmartMessage AI acts on behalf of the business you're messaging — we process your messages as a service provider to that business, not as an independent party collecting data for our own purposes. Questions about how your data is used should go to the business itself in the first instance.

1. Information we collect

From the business (you): business name, owner and staff names, email addresses, uploaded logo and branding, product catalog (names, prices, descriptions, images), business hours and policies, bank/payment details you choose to add for order collection, and your own usage of the dashboard.

From your customers, via WhatsApp: their phone number, WhatsApp display name, and the content of messages they send — text, images (including payment-proof screenshots for orders), and any order or delivery details they provide.

Automatically: basic technical data needed to run the Service (login timestamps, IP address for security/rate- limiting purposes, and error logs).

2. How we use this information

• To operate the dashboard, inbox, orders, and analytics you use;
• To generate AI replies to your customers' WhatsApp messages, based on your product catalog and settings;
• To send and receive messages via the Meta WhatsApp Cloud API on your behalf;
• To detect and prevent abuse, and to enforce our Terms of Service (including the rate limits described there); and
• To bill you for the subscription and to communicate service notices (trial ending, AI usage limits, account suspension, etc).

We do not sell your data or your customers' data, and we do not use customer WhatsApp conversation content to train our own models.

3. AI processing of WhatsApp conversations

When a customer messages your business, the conversation (and relevant product/knowledge-base content you've provided) is sent to Anthropic's API to generate a reply. This happens for every conversation where you have AI replies turned on. Anthropic processes this content to generate the response and, per their own terms, does not use API inputs to train their models by default. You can turn AI replies off for an individual conversation or overall in your settings at any time — turning it off stops sending that conversation's content to Anthropic going forward.

4. Who we share data with (sub-processors)

• Meta Platforms, Inc. — operates the WhatsApp Cloud API that all messages travel through. Meta's own privacy policy governs its handling of that data.
• Supabase — hosts our database, authentication, and file storage (product images, payment-proof uploads, logos).
• Anthropic — processes conversation content to generate AI replies, as described above.
• Resend — sends transactional emails (password resets, monthly reports) on our behalf.

We don't share data with anyone else except where required by law, to protect our legal rights, or with your explicit consent.

5. Data retention

We keep your business data and customer conversation history for as long as your account is active, so your dashboard, order history, and AI context stay useful. If your account is suspended, data is retained (not deleted) so service can resume normally on reactivation. If you cancel or your account is terminated, we retain data for a reasonable period afterward [placeholder — e.g. 90 days] in case you want to reactivate or export it, then delete it, unless a longer period is required by law or you request earlier deletion.

6. Data location

Data is hosted on Supabase's cloud infrastructure and processed by the sub-processors listed above, which may store or process data outside Sri Lanka. By using the Service, you consent to this cross-border processing where applicable. [Placeholder — confirm this is compliant with any Sri Lankan data protection requirements applicable to your business, e.g. the Personal Data Protection Act.]

7. Security

We use industry-standard measures to protect data — encrypted connections (HTTPS), database access controls scoped per business, rate limiting on login/signup, and restricted internal access to production data. No system is perfectly secure, and we can't guarantee absolute security.

8. Your rights and choices

As the business owner, you can access, correct, or export most of your data directly from the dashboard, and can request deletion of your account and associated data by contacting us. If you're a customer of one of our business users and want your WhatsApp conversation data removed, please contact that business directly — we act on their instructions for their customers' data.

9. Children's privacy

The Service is intended for business use and is not directed at children. We don't knowingly collect data from children through the dashboard itself.

10. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the effective date above and, for material changes, make reasonable efforts to notify account owners.

11. Contact

Questions about this Privacy Policy, or requests regarding your data, can be sent to support@smartmessageai.com.