1. Introduction & Overview
Sayvy AI (“Sayvy”, “we”, “us”, or “our”) provides an intelligent conversational customer messaging and workflow automation platform. This Privacy Policy details how we collect, use, process, disclose, and safeguard personal information and Platform Data when you use our website, cloud applications, or connect messaging channels and integrations including the WhatsApp Business API (via Meta Platforms) and telephony providers.
2. Information We Collect
We collect information directly from you, automatically through your interaction with our services, and through authorized third-party APIs you configure:
- Account & Registration Information: Your full name, work email address, phone number, company name, billing details, and encrypted account credentials.
- WhatsApp & Meta Platform Data: When you connect your WhatsApp Business Account (WABA) to Sayvy AI, we process Meta Platform Data solely to facilitate messaging automation and support interactions:
- Contact identifiers: Sender phone numbers and WhatsApp User IDs.
- Communication payloads: Inbound and outbound message text, conversation timestamps, message delivery/read statuses, and media attachments (images, audio notes, or documents) exchanged in customer chats.
- Account configuration: WhatsApp Business Account IDs (WABA ID), Phone Number IDs, and authorization tokens granted via Meta OAuth for channel routing.
- Technical & Telemetry Data: IP addresses, browser types, session logs, operating systems, and platform performance diagnostics.
3. Purpose of Processing & Use of Information
We process personal information, Meta Platform Data, and API inputs strictly for legitimate business purposes authorized by you:
- To route, deliver, and automate responses to inbound customer inquiries across WhatsApp, web chat, and voice channels.
- To perform automated natural language understanding, sentiment detection, intent extraction, and AI response generation via our platform AI models.
- To execute predefined business workflows, tool calling, and action completions (such as scheduling appointments, issuing order updates, and answering FAQs).
- To maintain system reliability, monitor API latency, safeguard against unauthorized access, and prevent spam or abuse.
- To process billing transactions and communicate necessary administrative, security, and service updates.
4. Artificial Intelligence (AI) Processing
Sayvy AI integrates Large Language Models (LLMs) and conversational AI engines to analyze inbound messages and draft or send autonomous responses:
- Strict Zero Data Retention for Model Training: Neither Sayvy AI nor our upstream enterprise AI providers use your confidential business communications, Meta Platform Data, or customer messages to train, retrain, or improve public AI foundation models. All inference is processed transiently in memory for the real-time execution of your customer conversation.
- Enterprise Confidentiality: Prompt inputs and conversation turns are processed under commercial enterprise terms providing strict tenant isolation and zero persistent storage by AI inference providers.
5. Strict Prohibition on the Sale or Unauthorized Transfer of Data
In compliance with the Meta Platform Terms (Section 3) and global data protection regulations:
- No Sale of Data: We do NOT sell, rent, lease, or trade personal information or Meta Platform Data to any third party for financial or other consideration.
- No Ad Networks or Brokers: We do NOT transfer, license, or disclose Meta Platform Data to any ad network, data broker, information reseller, or advertising exchange.
- No Model Training on Private Data: We do NOT use your private customer message contents or Meta Platform Data to train generalized public AI foundation models or for behavioral advertising.
- Limited Purpose Processing: Meta Platform Data and AI API calls are used solely to provide and operate the specific messaging and automation features you have explicitly requested and authorized.
6. Data Retention & Storage Policy
We retain personal information and Meta Platform Data only for as long as necessary to fulfill the operational purposes described in this policy:
- Active Account Data: Stored for the duration of your active subscription and deleted within 30 days of account termination or cancellation.
- Customer Conversation & Meta Logs: Retained for the duration specified in your workspace retention settings (defaulting to 30 to 90 days for operational history and reporting), after which they are permanently purged.
- Authentication Credentials: Stored securely only while configured. When you disconnect a channel or account, associated tokens and credentials are permanently destroyed immediately.
- Temporary Transit Caches: Ephemeral webhook payloads and real-time AI prompt buffers used to process immediate message delivery are discarded immediately following transmission confirmation.
- Disconnection / Revocation: If you disconnect your WhatsApp channel or revoke app permissions, active data synchronization ceases immediately, and associated temporary tokens are invalidated.
7. User Data Deletion Instructions
According to Meta Developer Policies and global privacy laws (GDPR, CCPA), you have the right to request the deletion of your personal data and any Meta Platform Data collected through Sayvy AI. You can request deletion at any time through any of the following methods:
Method 1: Direct Email Request (Immediate Processing)
Email our Data Protection & Privacy team at [email protected] with the subject line “Data Deletion Request”. Include your account email and the associated WhatsApp Business Account ID. We will verify and permanently delete all associated data within 30 days and provide written confirmation.
Method 2: Revoking Access via Meta Business Settings
You may revoke access directly from your Meta / Facebook account:
- Go to your Meta Business Manager or Facebook profile Settings & Privacy → Settings.
- Navigate to Business Integrations or Apps and Websites.
- Locate Sayvy AI, click Remove, and choose “Send Request” to request data deletion.
8. Data Security & Encryption Standards
Sayvy AI maintains enterprise-grade technical and organizational measures to protect personal information and Meta Platform Data against unauthorized access, loss, or destruction:
- Encryption in Transit: All data transmitted between clients, our cloud infrastructure, external AI APIs, and Meta APIs is encrypted using TLS 1.3 protocols.
- Encryption at Rest: All stored records, message archives, and database volumes are encrypted using industry-standard AES-256 encryption.
- Token & Credential Security: OAuth access tokens and API credentials are securely stored using envelope encryption with cloud Key Management Services (KMS), isolated per tenant, and never exposed client-side or logged in plaintext.
- Access Control: Administrative access is restricted based on least-privilege role-based access control (RBAC), multi-factor authentication (MFA), and immutable audit logging.
9. Third-Party Subprocessors & Service Providers
We work with select third-party service providers who assist us in providing our services. All subprocessors are bound by strict data processing agreements and confidentiality obligations:
- Meta Platforms, Inc.: For WhatsApp Business Cloud API message transit.
- AI Inference Providers: For platform-managed AI processing (such as OpenAI, Anthropic, or Google Cloud Vertex AI) under commercial terms enforcing strict Zero Data Retention (ZDR) for model training.
- Cloud Infrastructure Providers: For secure database hosting, serverless compute, and containerized routing in ISO 27001 and SOC 2 certified environments.
- Payment Processors: For secure, PCI-DSS compliant payment gateway processing. We do not store raw credit card numbers.
10. Cookies & Tracking Technologies
We utilize essential session cookies strictly necessary to maintain user login states, protect against CSRF attacks, and ensure platform security. Non-essential performance and analytics cookies are enabled only upon your explicit opt-in through our Cookie Preferences banner. You can update your cookie preferences at any time through the link in our website footer.
11. Children's Privacy
Our platform and services are exclusively designed and intended for commercial business operations. We do not knowingly solicit or collect personal information from individuals under the age of 18. If we become aware that an underage individual has provided us with personal data, we will immediately take steps to delete that data.
12. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect changes in our platform features, legal obligations, or Meta Platform guidelines. When revisions occur, we will update the “Last Updated” date at the top of this page. For significant changes affecting data processing terms, registered users will receive advance notification via email or in-app announcement.
13. Contact Information & Data Inquiries
If you have questions, inquiries, or requests regarding this Privacy Policy, your personal information, or Meta Platform Data, please contact our team: