Privacy policy

inbox-pilot (“we”, “us”) provides an AI assistant that helps businesses reply to their customers on Messenger, Instagram, WhatsApp and website chat. This policy explains what data we process and why.

Who controls the data

Businesses that use inbox-pilot own their customer conversations, names and contact details. We process that data only to provide the service on their behalf. For your own account (name, email, profile photo from Google) we are the controller.

What we collect

• Account data: your name, email address and password (stored hashed), and your profile picture if you sign in with Google or Facebook.
• Business data: business details, products, services, knowledge base documents, AI instructions, orders, leads and bookings you create.
• Conversation data: messages, photos and voice notes your customers send to your connected pages, accounts and numbers, and the replies sent.
• Integration credentials: Facebook page tokens, WhatsApp tokens, AI provider keys, courier and WooCommerce keys — always stored encrypted.
• Billing data: credit purchases and usage logs. Card payments are processed by Stripe; we never see full card numbers.

How we use it

• To generate AI replies, recognise products in photos and transcribe voice notes.
• To create orders, leads and bookings and send delivery or booking updates.
• To show analytics, bill AI credits and send service emails (sign-up, invitations, payment receipts, low-balance alerts).

We do not sell personal data, show ads, or use tracking cookies. We use only the cookies needed to keep you signed in.

Service providers

We share data only with processors needed to run the service: Meta (Messenger, Instagram, WhatsApp), the AI provider you choose or that powers credits (e.g. OpenAI, Anthropic, Google, OpenRouter, Groq, DeepSeek), our hosting and backup providers, Stripe for card payments, your WooCommerce store and the courier companies you connect.

Facebook & Instagram data

We access page messages, comments and basic profile information only for pages you connect, only to reply on your behalf, and in line with Meta’s Platform Terms. You can disconnect a page at any time from Channels, and request deletion as described below.

Retention & deletion

Data is kept while your business account is active. When you delete a business or request deletion, we remove conversations, customer records, AI instructions, orders, bookings, products, knowledge documents, saved keys and team accounts within 7 days. Encrypted backups expire within 8 weeks. We keep anonymised AI cost records for accounting. See data deletion.

Security

Credentials are encrypted at rest, traffic is encrypted in transit, team members only see the pages they are allowed to, and backups are encrypted.

Your rights

You can access, export, correct or delete your data at any time from Settings, or by emailing [email protected].