Privacy Policy

Vibes of Kheya is an AI sales assistant for online shops. A business (“merchant”) connects its Facebook Page, Instagram account or WhatsApp Business number, and our AI answers that business's customers and records their orders. This policy explains what information we handle, why, who processes it, how long we keep it, and how to have it deleted.

1. Information we collect

From merchants (our customers)

• Account details: name, email address, phone number and business name.
• Store settings you enter: products, prices, delivery charges, reply rules.
• Billing records: payments and refills you make to us.

From Meta (Facebook, Messenger, Instagram, WhatsApp) — only after a merchant connects

• The list of Pages / Instagram accounts the merchant manages, and an access token for the one they choose.
• Messages that people send to the merchant's Page, Instagram account or WhatsApp number, including photos and voice messages, and the replies sent.
• Comments on the merchant's posts and ads, and the post's text, so the AI can answer in the comment and inbox.
• The sender's page-scoped ID and the name shown in the conversation.
• Order details the customer gives in the chat: name, phone number, delivery address, product, size and colour.

From visitors to our website

• Pages visited and how you arrived (our own analytics, and Microsoft Clarity for page-usage recordings).
• Anything you type into our sign-up or contact forms.

2. How we use it

• To reply to the merchant's customers on the merchant's behalf, answer product and delivery questions, and record orders in the merchant's portal.
• To show the merchant their conversations, orders, complaints and usage.
• To bill the merchant for the messages the AI handled.
• To find and fix errors and keep the service secure.

We use data received from Meta only to provide these features to the merchant who connected it. We do not sell it, rent it, use it for advertising, or share it with data brokers. We do not use it to train AI models.

3. Who processes it

• Google Cloud — hosting and database (Firebase / Firestore, Cloud Run), and Vertex AI (Gemini), which reads a conversation to write the reply. Google processes this data under its Cloud terms and does not use it to train its models.
• Meta — delivers the messages and comments through its APIs.
• Services a merchant chooses to connect — e.g. a courier (Pathao, Steadfast), an order system (BizMation, WooCommerce) or Google Sheets. An order is sent there only when the merchant has connected that service.
• Microsoft Clarity — website usage analytics on our own website only.

4. How long we keep it

• Conversation history and orders are kept for as long as the merchant's account is active, because the merchant needs them to serve their customers and handle returns.
• When a merchant disconnects a Page, we stop receiving new data from it at once.
• When a merchant closes their account, or a person asks us, we delete the data as described below.
• Billing records are kept as long as the law requires.

5. Deleting your data

• Anyone who used Facebook Login with our app can remove the app in Facebook Settings → Apps and Websites. Facebook then tells us, and we delete the data tied to that login automatically. You get a confirmation code you can check on our data deletion page.
• A customer who messaged a shop can email info@vibesofkheya.com with the shop name and their phone number or Facebook name. We delete the conversation and the customer details in it within 30 days and tell the shop.
• A merchant can ask us to delete their account and all its data by emailing info@vibesofkheya.com from the account's email address.

Full instructions: vibesofkheya.com/data-deletion

6. Security

Data is encrypted in transit (HTTPS) and at rest (Google Cloud encryption). Page access tokens are stored in our database and used only by our servers to send replies. Each merchant can see only their own stores' data, and staff access is limited to people who need it to run the service.

7. Children

Our service is for businesses and is not directed at children under 13.

8. Changes

If we change this policy we update the date at the top of this page.