Privacy policy
Updated October 12, 2026
WhatBot, operated by The WhatBot Inc, provides business messaging, a shared inbox, and automation. For privacy questions, contact info@thewhatbot.com.
Information we process
We process workspace login details, connected business account identifiers and authorization tokens, contact profiles, messages and attachments, comments and supported interactions, custom field values, automation settings, and delivery and activity records. We receive this information from workspace users and the Meta accounts they authorize.
How we use information
We use this information to connect business accounts, display and respond to conversations, run configured automations, provide support, and protect the service. A workspace controls its automations and can pause them for a contact. We do not sell personal information or use Meta platform data for advertising.
Service providers and AI
Meta processes messages sent through its platforms. Our hosting providers process data to operate the service. If a workspace enables AI features, relevant conversation content, attachments, and configured business information may be sent to its selected AI provider, including OpenAI, to generate replies and carry out configured tasks. Workspace administrators control AI configuration. We do not use Meta platform data to train general-purpose AI models.
Google user data
A workspace can connect Google Sheets and Google Calendar by signing in with Google. For Google Sheets, WhatBot asks only for access to the spreadsheets a person chooses in Google's file picker or that WhatBot creates for them (the drive.file permission), and never reads the rest of their Google Drive. It reads and writes rows in those spreadsheets as the workspace's flows, rules and AI agents are set up to do, such as saving an order or looking up a price. For Google Calendar, WhatBot adds, updates and removes events for the workspace's bookings in the calendar chosen, and reads that calendar's events and calendar list only to keep busy times free and to let the person choose a calendar. WhatBot also receives the Google account's email address and name to show which account is connected.
WhatBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models, and people at WhatBot read it only with the workspace's permission for support, for security, or where the law requires. Sheet rows a workspace chooses to give its AI agent can be sent to its selected AI provider to answer customers, as described above. Google sign-in tokens are encrypted at rest. A workspace administrator can remove a Google account in WhatBot, and anyone can remove WhatBot's access under Security in their Google Account settings; WhatBot then stops reading and writing their sheets and calendars.
Security and retention
Connections use server-side credentials encrypted at rest. Access to inbox data requires a workspace session. We retain data while needed to provide the service or meet legal obligations. Deleted data is removed from active systems; copies in restricted backups expire through the backup retention cycle and are not used for ordinary operations.
Your choices
Workspace administrators can disconnect a channel, pause automation, reset contact custom fields and AI history, or delete a contact and its associated data. Disconnecting a channel stops new processing but retains existing chat history. Meta data-deletion requests remove the connected account authorization and associated contact data. To request access, correction, export, or deletion, contact us at the address above. See data-deletion instructions.