Privacy Policy

Last Updated: October 13, 2026

1. Who we are and what this policy covers

AIGEX Engage (“AIGEX”, “we”, “us”) is a tool for businesses. A business (the “Merchant”, “you”) connects its Facebook Page, Instagram account or WhatsApp business number, and our assistant answers the business’s customers, takes orders and hands difficult conversations to a person.

This policy explains what data we handle, why, who can see it and how long we keep it. For your own account data we are the data controller. For the data of your customers we act as a data processor on your instructions, and you are the controller. We apply the GDPR where it applies and the local data protection law that applies to you, including Tunisian Organic Law 2004-63.

2. The channels we connect and the Meta permissions we ask for

You connect a channel through Meta’s own login window. We never see your Facebook, Instagram or WhatsApp password. Meta gives us an access token limited to the permissions below. You can revoke it at any time in your Meta settings or by disconnecting the channel in AIGEX.

Facebook Pages

  • pages_show_list: list your Pages so you can choose one.
  • pages_read_engagement: read the Page’s basic details and check that the connection works.
  • pages_messaging: receive and send Messenger messages on the Page’s behalf.
  • pages_manage_metadata: subscribe the Page to webhooks so we receive messages and comments as they arrive.
  • pages_manage_engagement: reply to, like and hide comments on your posts.
  • business_management: list the Pages owned by your business portfolio.

Instagram professional accounts (with pages_show_list, pages_read_engagement, pages_manage_metadata and business_management as above)

  • instagram_basic: identify the Instagram account linked to your Page.
  • instagram_manage_messages: receive and send Instagram direct messages.
  • instagram_manage_comments: reply to, hide and delete comments on your posts.

WhatsApp business numbers

  • whatsapp_business_messaging: receive and send WhatsApp messages for your number.
  • whatsapp_business_management: read your WhatsApp Business Account and number, register the number on the WhatsApp Business Platform and subscribe it to webhooks.

Your WhatsApp Business Account belongs to your own Meta business portfolio, not to AIGEX, and Meta bills you directly for WhatsApp messages where its pricing applies. When you connect with one click, Meta’s window hands us a short-lived code that we exchange for the access token; we then register your number and protect it with a two-step verification code that we manage for you. Your use of WhatsApp is also governed by the Meta Terms for WhatsApp Business Platform and the WhatsApp Business Messaging Policy.

3. The data we handle

  • Your account: your name, e-mail address and login credentials (kept in hashed form by our authentication provider), your business name, type, address, phone number and website, your plan and usage counters, your settings and instructions for the assistant, and the devices on which you enable push notifications.
  • Your connected channels: Page, Instagram account and WhatsApp account identifiers, phone number identifiers and display names, access tokens (encrypted at rest) and the results of connection health checks.
  • Your catalogue and knowledge: your products, including those imported from your PrestaShop or Shopify store, with prices, stock and images; documents you upload; pages of your website you ask us to read.
  • Your customers’ data, processed on your behalf:
    • platform identifiers: the Page-scoped or Instagram-scoped id Meta assigns to a customer, and on WhatsApp the customer’s phone number or the business-scoped customer code Meta sends instead of it;
    • the name, username and profile picture link Meta provides;
    • messages: text, photos, voice notes, stickers, reactions, replies to your stories and posts, and the replies we send;
    • comments on your posts and the names of the people who wrote them;
    • order details given in the conversation: name, phone number, delivery address and city, items, amount and payment method;
    • ad data when a customer arrives from one of your ads: the ad’s id and title and Meta’s click id;
    • delivery and read receipts, and on WhatsApp Meta’s billing category for each message;
    • the list of customers you choose to exclude from automated replies.
  • Technical records: the webhook payloads we receive from Meta, delivery logs, a record of each AI call (model, timing, size, outcome), conversation processing logs and error reports.

4. How we use the data

  • To answer your customers with the assistant, take orders and hand conversations to you when needed.
  • To show you the inbox, orders, notifications and statistics, including results per ad.
  • To moderate comments on your posts as you configure.
  • To create shipments with your delivery company, when you enable that integration.
  • To keep the service reliable: retry failed deliveries, recover missed messages, detect abuse and enforce plan quotas.
  • To support you when you ask, and to investigate a conversation you report to us.
  • To improve the service with aggregated usage statistics and automated quality checks on conversations.

We do not use your data or your customers’ data to train AI models. We never sell personal data and never use it for advertising.

5. Artificial intelligence

We use Google’s Gemini API to generate replies, transcribe voice notes, describe and safety-check photos, and index your catalogue and documents so the assistant can search them.

What Google receives: the conversation text, the transcript or description we derive from a voice note or photo, the relevant parts of your catalogue, knowledge base and instructions, and the texts of your products and documents for indexing. Photos and voice notes themselves stay on Meta’s servers; we keep only the text we derive from them.

What Google does not receive: before any text leaves our servers we replace phone numbers, e-mail addresses, bank account numbers (RIB), card numbers and links with labelled placeholders. The real values are put back only when the reply is sent to the customer. Access tokens, passwords and your account data are never sent.

How Google may use it: we use the Gemini API as a paid service. Under Google’s terms for paid services, Google does not use the content we send, or the replies it generates, to improve its products; it keeps them for a limited period only to detect abuse and to meet legal obligations. Google’s Gemini API terms describe this in full. We do not train or fine-tune any model ourselves. If we change AI provider or service tier, we will update this section.

6. Service providers and where data is stored

  • Supabase: database, authentication and file storage, hosted in London, United Kingdom.
  • Vercel: runs the application, on servers in the United States.
  • Google: the Gemini API described above, on Google’s infrastructure.
  • Meta: the channels themselves (Facebook, Instagram, WhatsApp), under Meta’s own privacy policy.
  • Aramex: only when you enable it: the recipient’s name, phone number and address and the parcel details, to create and track shipments.
  • PrestaShop or Shopify: your own store. We read your products; we send no customer data to your store.
  • Browser push services (Apple, Google, Mozilla): only for the notifications you enable on your devices; they carry the notification text.
  • Telegram: technical alerts to our operators, containing identifiers and error details, not message content.

Each provider processes data only to provide its service to us, under its data-processing terms. Transfers outside your country rely on those providers’ standard safeguards, such as Standard Contractual Clauses.

7. Who can see your data

You, through your dashboard. Our staff, when needed to run the service, to help you, or to investigate a conversation you have reported to us, and only as far as needed. Nobody else, except the providers above and where the law requires it.

8. Your responsibilities towards your customers

You remain responsible for your customers’ data. Tell them, in your own privacy notice or in the conversation, that an assistant answers on your behalf and that their messages are processed to answer questions and fulfil orders. The assistant replies only to customers who write to you first, within the messaging windows Meta allows, and any customer can be handed to a person from your inbox. Obtain the consents the law and Meta’s policies require before you message customers outside those windows.

9. How long we keep data

  • Your account, channels, catalogue, conversations and orders: as long as your organisation exists.
  • Assistant drafts awaiting your approval: deleted 30 days after being sent, discarded or expired.
  • Conversation processing logs: 30 days. AI call records: 90 days.
  • Webhook payloads and delivery logs: kept for troubleshooting as long as your organisation exists.
  • Disconnecting a channel stops all use of it immediately. Its stored token is kept inactive until your organisation is deleted or you revoke it in Meta.
  • Deleting your organisation: access ends immediately. After a 30-day grace period, during which you can cancel, everything is permanently erased.

10. Security

All traffic is encrypted in transit. Access tokens are encrypted at rest. Each organisation’s data is isolated by database-level access rules. Every webhook from Meta is checked against Meta’s signature before it is processed. Sensitive values are masked before any text reaches the AI provider.

11. Cookies and embedded Meta code

Our dashboard uses only the essential cookies that keep you signed in. We run no analytics or advertising trackers. When you use the “Connect WhatsApp” button, Meta’s JavaScript SDK is loaded from Meta’s servers to open Meta’s login window, and Meta may set its own cookies under its own policies.

12. Age

AIGEX Engage is for businesses and is not intended for anyone under 18.

13. Your rights, disconnecting and deleting

  • Access and correction: your account data is editable in Settings. For anything else, write to us.
  • Disconnecting: disconnect any channel in Settings at any time, or revoke our access from your Facebook, Instagram or WhatsApp settings.
  • Deletion: delete your organisation from Settings (30-day grace period, cancellable). You can also ask us by e-mail to access, export or delete your data, including after removing our app from your Meta settings. We answer within 30 days.
  • Your customers: a customer of a Merchant should address requests to that Merchant; we help the Merchant answer them.
  • Complaints: where the GDPR applies you may complain to your supervisory authority; in Tunisia, to the INPDP.

14. Changes to this policy

We update this policy when the service changes and show the date at the top. Significant changes are announced in the dashboard.

15. Contact

For any privacy question or to exercise your rights:
Email: contact@aigex.org