Skip to content
Broadchat
← Back

Privacy Policy

Last updated: September 1, 2026

1. Introduction

the Service Provider ("Company", "we", "us") operates the the Service Provider platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information: Name, email address, password (hashed), organization name, phone number.

Usage Data: Pages visited, features used, API calls made, IP address, browser type, device information.

Communication Data: Messages sent/received through the platform, contact information of your customers (as uploaded by you), campaign data, chatbot interactions.

Payment Data: Subscription details, wallet transactions. Payment processing is handled by third-party providers; we do not store card numbers.

3. How We Use Your Information

  • To provide and maintain the Service
  • To process transactions and manage subscriptions
  • To send WhatsApp messages on your behalf via Meta Cloud API
  • To provide customer support
  • To send administrative notifications (service updates, security alerts)
  • To improve and optimize the Service
  • To detect and prevent fraud or abuse

4. Data Storage & Security

Your data is stored on secure servers with encryption at rest and in transit (TLS 1.2+). We implement industry-standard security measures including:

  • Password hashing (bcrypt)
  • JWT-based authentication with short-lived tokens
  • Webhook signature verification (HMAC-SHA256)
  • Role-based access control
  • Multi-tenant data isolation
  • Rate limiting on API endpoints

5. Data Sharing

We do not sell your personal data. We may share data with:

  • Meta Platforms: Message content and phone numbers as required to deliver WhatsApp messages
  • AI providers (Google Gemini, Groq, OpenAI): Message content and audio sent to AI features (AI agents, AI routing, speech-to-text) when you use them
  • Service Providers: Database hosting, email delivery, payment processing
  • Legal Requirements: When required by law, court order, or governmental authority

Google user data

When you connect a Google account in Automations → App Authentications (Google OAuth app "API Chat"), we access only what your own workflows need: rows of the Google Sheets you select, files created or opened through the connection in Google Drive, events in Google Calendar, and your Google email address to label the connection. Tokens are stored encrypted. Google data is not sold, not used for advertising, not used to train AI models, and not read by people except with your permission for support, for security, or where the law requires it. Deleting the connection (or revoking access at myaccount.google.com/permissions) deletes the stored tokens.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. More about the Google integration.

6. Multi-Tenancy & Data Isolation

the Service Provider operates as a multi-tenant platform. Each tenant's data is logically isolated at the database level. Tenant administrators can only access data belonging to their organization. Super administrators may access aggregate statistics for platform management purposes.

7. Your Rights

You have the right to:

  • Access and export your data
  • Correct inaccurate information
  • Request deletion of your account and data
  • Withdraw consent for data processing
  • Object to certain processing activities

To exercise these rights, contact us at your service provider.

8. Data Retention

We retain your data for the duration of your subscription. After account termination, data is retained for 30 days for export purposes, then permanently deleted. AI reply logs are automatically deleted after 60 days. Audit logs are retained for 12 months.

9. Cookies & Tracking

We use essential cookies for authentication and session management. We do not use advertising trackers. We do not use third-party tracking cookies. Local storage is used to persist user preferences and authentication tokens.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email.

11. Contact Us

For privacy-related questions or concerns, contact our Data Protection Officer at your service provider.