Privacy Policy

1. Data we collect

Account data. Name, email address, business name, timezone, plan and billing records (card payments are processed by our payment provider; we never see or store full card numbers).

Workspace content. The FAQs, business rules, agent name and tone, uploaded media, and customer conversation history you need the AI to work with.

Connected-channel data. Only for channels you personally connect through each platform's consent screen, and only the minimum each surface needs:

• Gmail: message content and metadata of the mailbox you connect, used to answer customer mail in Live Inbox.
• YouTube: channel identity plus the videos and metadata you choose to publish through Scheduler.
• TikTok: profile info and, per your separate consents, either video publishing data or direct-message content for inbox support.
• Meta (Facebook, Instagram, Messenger): page identity, granted page/IG accounts, and message content the AI answers. Instagram can also be connected through a standalone Instagram app with the same data scope.
• Google Business Profile: business location identity and the posts you publish to it through Scheduler (publishing only, same consent family as YouTube).
• LinkedIn (personal and Company Pages): profile or organization identity and the posts you publish. Company Pages are a distinct connection with organization scopes.
• Other publishing channels (Pinterest, X, Reddit, Discord, Slack, Mastodon, Threads, Bluesky, VK, Dribbble, Tumblr, Kick, Twitch, Whop, Medium, DEV, Hashnode, WordPress, ListMonk, Lemmy and similar): account identity and the posts or messages you send through them, plus Telegram bot tokens you paste in and WhatsApp activity on numbers you link. Key-paste channels use tokens or credentials you provide; OAuth channels use that platform's consent screen.
• Messaging extras (Nostr, Moltbook, Farcaster, MeWe, Skool where supported): account identifiers and the messages or posts you send through them. Availability varies by plan and platform approval.
• WhatsApp: phone number, business account identity and message content, connected through Meta Embedded Signup, Cloud API credentials you paste, Twilio credentials you paste, or QR pairing. Conversations are answered in Live Inbox like any other messaging channel.

Technical data. Login sessions, IP address, device and browser type, and basic usage logs used for security, abuse prevention and reliability.

2. How we use Google and YouTube data (Limited Use)

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In practice: Gmail content is used only to answer that same email thread, and never written to memory stores, analytics, training data, or any secondary system. AI-generated replies are produced per request through our processing pipeline and are not used to create, train, or improve generalized machine learning models. Lead details you ask us to capture from email stay in your own workspace database and are never used for model training. Where we access Google user data (Gmail content, YouTube channel data), use is limited to providing and improving the features you can see in the product, answering mail, publishing videos you approve, and showing connection status. Specifically: we do not use Google data for advertising, we do not sell or transfer it to third parties except to operate the service (hosting, encrypted storage), we do not allow humans to read it except with your consent, for security and abuse investigation, to comply with law, or for internal operations under the platform's allowed purposes, and we do not keep it longer than section 6 allows. Gmail authorization is requested as a separate consent from YouTube authorization, so you can use either without the other.

3. How we use TikTok and Meta data

TikTok profile, video and message data is used only for the surface you consented to: Login Kit data powers video publishing to Scheduler; messaging-scope data powers DM support in Live Inbox. The two consents are separate and each can be revoked independently. Meta page, Instagram and Messenger data is used only to deliver AI support inside your connected pages and accounts. Before a connected app passes full platform audit, some platforms restrict new posts to private-only visibility; that restriction lifts once the platform approves the app.

4. Sharing: who else sees data

We share data only where the service requires it: the platform you connected (messages and posts necessarily travel through that platform's API), our hosting and encrypted-database providers, our payment processor for billing, and AI model providers that generate replies under strict processing terms. No sale of personal data, no advertising use, no data-broker transfers. If the law compels disclosure (court order or equivalent), we comply to the minimum extent required and tell you unless legally barred.

5. Security

Traffic is encrypted in transit (TLS), provider tokens are stored encrypted at rest, sessions expire (30-day absolute limit plus inactivity logout), access to production systems is limited to what each role needs, and we keep backups so an incident does not become data loss. No system is perfectly secure; if we discover a breach affecting your data we will notify you and the relevant authorities as the law requires.

6. Retention: how long data stays

Account and workspace data stays while your account is active. Conversation history follows your plan's retention window. Provider tokens live only while the channel stays connected, disconnecting revokes our side immediately. After cancellation, workspaces deactivate and remaining data is deleted automatically after 30 days. Backups roll off on their own cycle and are not used to restore deleted workspaces. Anything you ask us to erase sooner is handled under section 8 and the Data Deletion page.

7. Cookies and tracking

We use strictly necessary cookies and storage for login sessions, theme and security (including bot protection on sign-in). Analytics, where present, is aggregate and never builds advertising profiles. Blocking cookies may sign you out or limit features.

8. Your rights (NDPR, GDPR, CCPA and equivalents)

Wherever you live, you can ask us to confirm what we hold about you, get a copy of it, correct it, restrict or object to specific processing, withdraw a platform consent (disconnect the channel), and erase your personal data. The fastest path for erasure is the Data Deletion page (self-serve disconnect plus email request with timelines). Identity checks apply so we never hand your data to someone pretending to be you. If you feel we mishandled a request, you can complain to your data protection authority (for example the NDPC in Nigeria or your EU supervisory authority) without losing any other remedy.

8.1 Your login email: view and change it

Your login email is shown in Settings → Login & account inside the app. You can change it yourself at any time: enter the new address and we send it a confirmation link (valid 24 hours). Nothing switches until that link is clicked — your current address keeps working meanwhile. Clicking it moves your login, sessions and workspace to the new address, and we email the old address as a takeover tripwire (if you did not ask for the change, contact [email protected] immediately). New addresses already used by another workspace are refused rather than merged.

9. Children

TelyChat is a business tool and is not directed at children under 18. We do not knowingly collect children's data; if you believe a child provided data through a connected business account, contact us and we will remove it.

10. Changes to this policy

Material changes come with at least 14 days notice by email or in-product notice, and platform reviewers re-check this URL on every app review, so the version here is always the current one. Continued use after the effective date counts as acceptance.

11. Contact

Privacy questions, rights requests and complaints: [email protected]. We aim to answer every request within 30 days (sooner for deletion where section 8 timelines apply). Controller: Metrohyp, operating TelyChat.