Privacy Policy

Last updated: October 22, 2026

This policy explains how MonyBot handles customer data when using our WhatsApp Business management platform.

Data We Collect

We collect basic account information, company details, Meta WhatsApp Business connection settings, and operational logs needed to provide and improve the service.

WhatsApp and Meta Data

When a customer connects WhatsApp Business, we store the data required for integration, such as WABA ID, phone number ID, and connection status. Messages, templates, and contacts are processed only to provide the requested platform features.

Messenger and Instagram Data

If a business connects its Facebook Page or Instagram professional account, we process the messages its customers send to that Page or account, and its staff's replies, solely on behalf of that business. We store the Page ID, the Instagram account ID, the sender ID Meta issues for each customer, and the message content and timestamps.

We do not use this data for advertising, we do not train any model on it, and we never share one business's messages with another. We do not post to the Page, and we do not read its posts or comments — messages only. A business can disconnect at any time from within the platform, which stops processing immediately, and may request deletion via our data deletion page.

How We Use Data

We use data to operate the dashboard, send and receive messages through Meta's official APIs (WhatsApp, Messenger and Instagram), manage templates and campaigns, protect accounts, and provide support.

Sharing

We do not sell customer data or use it for advertising. Service providers process data only to run the platform: our servers are hosted by Contabo GmbH in Germany, our website is served through Cloudflare, and notifications to a business's staff on our Android app are delivered through Google Firebase and include the customer's name and a short preview of the message. Limited data may be shared with Meta to deliver the integration, or with an authority where the law requires it.

Connections the Business Chooses

The business's own systems. A business may connect its own systems (its shop, delivery or accounting software) to receive its messages and their delivery statuses through webhooks and our API, using keys it creates. This data goes only to that business.

AI assistants (Claude and ChatGPT). Any member of a business may connect their account to an AI assistant such as Anthropic's Claude or OpenAI's ChatGPT, after explicitly approving it on a consent screen. The assistant acts with that member's permissions only, and asks for their confirmation before sending any message to a customer. What the assistant reads about customers is sent to the company that runs it so it can answer the member, and is governed there by that company's terms and privacy policy. This happens only when a member connects an assistant themselves; they can disconnect it at any time from the "AI assistants" page, and every action an assistant takes is recorded.

Smart seller. If a business switches on the "smart seller", each new customer message is sent, together with the recent messages of that conversation and the customer's name and previous orders, to the AI provider the business has chosen (Anthropic or Google) so it can write a suggested reply. Ordinarily the reply reaches the customer only after a member of the business's staff reads it and sends it themselves. If the business chooses to let the seller "answer on its own", the reply is sent automatically within rules the business sets (for example only outside working hours); the seller tells the customer it is an automated assistant, and hands the conversation to a person on a complaint or anything it does not know. Every reply is kept with what was done with it. The business can switch the feature off at any time.

Contact

For privacy questions, contact [email protected].