Privacy Policy

1. Data Controller

TshlBot operates the platform available at tshlbot.online. For the purposes of applicable data protection law (including the GDPR), TshlBot acts as the data controller for account and usage data, and as a data processor for the customer conversation data that Tenants process through the platform.

2. Data We Collect

Account & Registration Data

When you register, we collect your name, email address, company name, and payment details (processed securely by Stripe — we do not store full card numbers).

Usage & Log Data

We automatically collect data about how you use the Service, including IP addresses, browser type, pages visited, timestamps, and feature interactions. This helps us maintain security and improve the platform.

Conversation & Message Data

Messages sent and received through your WhatsApp instances are stored to provide the core conversation management features. This includes message content, timestamps, sender/recipient identifiers, and media attachments.

WhatsApp Contact Data

Customer phone numbers and profile metadata received from the WhatsApp Business API are stored to link incoming messages to customer records. Numbers using WhatsApp's LID privacy system are masked and cannot be resolved to a real phone number.

3. Legal Basis for Processing

We process your personal data on the following bases:

• Contractual necessity — to provide and operate the Service you subscribed to
• Legitimate interests — to improve the platform, prevent fraud, and ensure security
• Legal obligation — to comply with applicable laws and regulations
• Consent — for optional features such as marketing communications

4. How We Use Your Data

• Providing, maintaining, and improving the Service
• Processing payments and managing subscriptions
• Sending transactional emails (account creation, password reset, billing receipts)
• Operating the AI auto-reply feature (message content is sent to the Anthropic API)
• Detecting and preventing fraud, abuse, or security incidents
• Complying with legal obligations and responding to lawful requests

5. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe — payment processing. Stripe Privacy Policy
• Anthropic — AI processing for auto-reply features. Anthropic Privacy Policy
• WhatsApp / Meta — message delivery via the WhatsApp Business API
• Infrastructure providers — hosting, database, and CDN services operating under data processing agreements
• Legal authorities — when required by law or to protect the rights of TshlBot or others

6. Data Retention

We retain your data for as long as your account is active. After account termination:

• Conversation and message data is deleted within 30 days
• Billing records are retained for 7 years as required by financial regulations
• Audit logs are retained for 2 years

You may request earlier deletion of your data by contacting us (see Section 12).

7. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage for sensitive fields, access controls, and regular security reviews. However, no system is completely secure — please use strong passwords and report any suspected breaches immediately.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we limit processing of your data
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@tshlbot.online. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies to operate the platform. For full details, please read our Cookie Policy.

10. International Data Transfers

Your data may be processed in countries outside your own. When transferring data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions by the European Commission.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or by a notice on the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

For privacy-related questions or to exercise your rights, contact our Data Protection team at privacy@tshlbot.online.