Privacy Policy

1. Information we collect

From the business (you, the account owner or a team member)

• Account details: name, email address, and password (stored as a salted hash, never in plain text).
• Business details you choose to provide: business name, hours, prices, policies, and the instructions you give your assistant.
• Your WhatsApp Business Account ID, phone number ID, and access token, obtained when you connect your number via Meta's Embedded Signup. Access tokens are encrypted at rest.
• Billing and plan information once payments are enabled for your account.
• Usage data: message volume, response times, and which features you use, so we can show you analytics and improve the product.

From your customers (the people who message your WhatsApp number)

• Their phone number and the content of messages they send to your business.
• Photos they send, if your assistant is configured to handle images - stored so you can view them later in your dashboard.
• Metadata about the conversation: timestamps, whether a reply came from the assistant or a team member, and any options they tapped.

We do not require your customers to create an account or agree to anything separately - they interact with your business on WhatsApp, and this policy covers how that conversation data is handled on our side.

2. How we use it

• To operate the assistant: generating replies grounded in your business information, presenting menus, and detecting when a customer wants a human.
• To show you a working inbox and analytics - conversation history, response-time metrics, and event notifications (bookings, purchases, cancellations, complaints).
• To send you operational emails: password resets, digest summaries you've opted into, and alerts about your WhatsApp account status.
• To maintain the security and reliability of the service, including detecting abuse of the platform.

We do not use your customers' conversation content to train general-purpose AI models, and we do not sell personal data to third parties, ever.

3. AI processing of messages

To generate a reply, an incoming message - along with the relevant business information you've provided and recent conversation context - is sent to a third-party AI language model provider for processing. We use more than one provider so that a reply can still be generated if one is temporarily unavailable; regardless of which provider handles a given message, the same privacy protections in this policy apply.

These providers process the message to generate a response and do not retain it for their own model training under our agreements with them. We do not send your customers' data to any AI provider for purposes unrelated to generating their reply.

4. WhatsApp & Meta

Ekuya connects to your WhatsApp Business Account through Meta's Cloud API as a registered Tech Provider. Meta's own privacy policy and WhatsApp Business Messaging Policy apply to messages as they pass through WhatsApp's platform, independently of this policy. We only receive and send messages for numbers you've explicitly connected, and only for the duration your account remains connected.

5. Data retention

Conversation history is kept for as long as your account is active, so you have a complete, searchable record of every customer interaction - we do not automatically delete or summarize away raw messages. If you close your account, we delete your business data and conversation history within 30 days, except where we're required to retain limited records for legal, tax, or dispute-resolution purposes.

You can request earlier deletion of specific conversations or your full account data at any time - see Contact below.

6. Sharing & disclosure

We share data only with the parties needed to run the service:

• WhatsApp/Meta, to send and receive messages on your behalf.
• AI providers, to generate replies (see AI processing above).
• Our email delivery and payment processing partners, strictly to send transactional emails or process billing.
• Law enforcement or regulators, only where legally required, and we'll notify affected account owners where legally permitted.

We never sell personal data, and we don't share it with advertisers.

7. Security

WhatsApp access tokens and any bring-your-own AI keys are encrypted at rest. Passwords are hashed, never stored in plain text. Access to the dashboard is scoped per business - no tenant can see another tenant's conversations, and every request re-checks that ownership. Media a customer sends is stored outside the public web root and only served after verifying the requesting account owns it.

No system is perfectly secure, and we can't guarantee absolute security - but we treat conversation data, access tokens, and account credentials as sensitive by default, not as an afterthought.

8. International transfers

Ekuya is built for businesses in Indonesia, but the infrastructure and AI providers we rely on may process data on servers located outside Indonesia. Where that happens, we rely on those providers' own contractual and technical safeguards to protect your data in transit and at rest.

9. Cookies

The dashboard uses a single essential session cookie to keep you logged in - nothing else. We don't use advertising or third-party tracking cookies on ekuya.com or in the dashboard.

10. Children's privacy

Ekuya is a business tool and isn't directed at children. We don't knowingly collect account information from anyone under 18. If a business's customers include minors messaging about products or services, that data is handled the same as any other customer conversation, under this policy.

11. Your rights

Consistent with Indonesia's Personal Data Protection Law (UU No. 27/2022) and similar frameworks, you can:

• Access the personal data we hold about your account.
• Correct inaccurate business or account information directly from your dashboard settings.
• Export your conversation and usage data (CSV export is available from your dashboard's Analytics and Conversations pages today; we can provide a fuller export on request).
• Delete your account and associated data, subject to the retention exceptions above.
• Object to a specific processing activity by contacting us - we'll respond and explain any limits on what we can change.

If your business's customers want to exercise these rights over their own message data, you as the account owner are their first point of contact, since it's your business relationship - we'll support you in fulfilling a verified request.

12. Changes to this policy

If we make a material change to how we handle data, we'll update the date at the top of this page and, for significant changes, notify account owners by email before the change takes effect.

13. Contact

Questions, data requests, or concerns about this policy can be sent to privacy@ekuya.com.