Privacy Policy

This policy explains how Konectus collects, uses, stores, and protects personal data. The service is operated by Konectus Technologies LLC, which is the data controller for the personal data described in this policy.

Data we process

Account data, workspace settings, conversation content, contacts, integration metadata, and audit logs needed to operate the service.

Why we process data

To provide chat automation, secure accounts, maintain platform reliability, and fulfill legal obligations.

Platform data from Meta (Facebook, Instagram, WhatsApp)

When you connect a Facebook Page, Instagram account, or WhatsApp Business number, Konectus receives data from Meta's platforms — such as message content, sender profile details, and the access tokens needed to send and receive messages on your behalf. We use this data solely to operate the messaging features you enable, and we handle it in accordance with Meta's Platform Terms and Developer Policies. We do not sell platform data, and we do not use it for advertising or for any purpose beyond providing the service.

Platform data from TikTok

When a business connects its TikTok Business account, Konectus receives through TikTok's Business Messaging API the direct messages customers send to that account (message text, conversation and message IDs, the sender's display name and the time), the account's username, display name and profile picture, and the access tokens needed to receive and answer those messages.

We use this data only to show the conversations in the business's inbox and to send the replies that the business's AI assistant or staff write. We only reply to conversations a customer started, and we never send bulk or promotional messages. We do not access the account's videos, followers, comments or analytics, and we never post content.

TikTok data is not sold, not shared with advertisers, not used for advertising or profiling, and not used to train AI models. To write a reply, the conversation text is sent to the AI model provider the business has selected, only to generate that reply. Access tokens are encrypted at rest. When a business disconnects TikTok, we delete the stored tokens immediately and stop receiving and sending messages for that account; its conversations stay in the inbox until the business deletes them or closes its account. We handle this data in accordance with TikTok's developer terms and policies.

Google user data (Google Calendar)

Connecting a Google Calendar is optional and is only used for appointment scheduling. This section describes exactly what Google user data Konectus accesses, how it is used, who it is shared with, how it is protected, and how long it is kept.

What Google user data we access

• Calendar events on the calendar you connect: we read the start and end time of your events, and we create, update and delete the events for appointments booked through Konectus.
• Your Google account email address, and your basic profile if you use Sign in with Google.

We do not access your email, contacts, files or any other Google data.

How we use it

• Busy periods are used only to stop the booking page offering a time when you are already committed. We store only the start and end time of those periods, never event titles, descriptions, locations or guests.
• We create an event when a customer books, and update or remove that same event when the booking is rescheduled or cancelled. We write only to events Konectus created, and never change your other events.
• Your email address is shown to you so you can see which Google account is linked. If you choose Sign in with Google, your email, name and profile picture are used to sign you in and fill in your profile.

We do not create aggregated or anonymised data sets from Google user data, and we do not use it for advertising, profiling, or any purpose other than the scheduling features above.

Who we share it with

We do not sell Google user data and we do not transfer it to third parties, with one exception: it is stored and processed on the infrastructure providers that run Konectus (our hosting provider and our content delivery and security provider), who act on our behalf and under our instructions. Google user data is not sent to OpenAI or to any other AI model provider, and it is never used to develop, improve or train artificial intelligence or machine-learning models.

Konectus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to delete it

• Google tokens and busy periods are kept only while the calendar stays connected.
• Disconnecting a calendar (Bookings → Share & sync) immediately deletes its stored tokens and the busy periods read from it. Appointments already recorded in Konectus are unaffected.
• Deleting a bot or your account deletes all Google user data held for it. See our Data Deletion page, or email [email protected].
• You can also revoke Konectus's access at any time from your Google account permissions.

Data protection mechanisms for sensitive data

Google user data, including the OAuth tokens that give access to your calendar, is sensitive data. We secure and protect it with the following data protection mechanisms:

• Encryption in transit. All traffic between your browser, Konectus and Google's servers travels over HTTPS (TLS).
• Encryption at rest. The Google access and refresh tokens for your calendar are stored encrypted with AES-256-GCM. The encryption key is kept separately from the database.
• Data minimisation. We request only the calendar permission the scheduling feature needs, and we store only the start and end time of your busy periods. We do not store event titles, descriptions, locations or guests.
• Restricted access. Our database is not reachable from the public internet. Access to production systems is limited to authorised personnel who need it to operate the service, and each customer's data is separated from every other customer's.
• Account security. Passwords are stored only as salted hashes, and two-factor authentication is available for every account.
• Deletion. Disconnecting a calendar deletes its stored tokens and the busy periods read from it. Deleting your account removes all Google user data we hold for you.

Third-party sub-processors

To operate the service we share limited data with trusted providers who process it on our behalf:

• AI model providers (OpenAI, Google and Anthropic) — conversation content is sent to the provider of the AI model the business has selected, only to generate automated replies.
• Stripe — subscription billing and payment processing.
• Google Workspace — delivery and receipt of transactional and support email (confirmations, notifications, account messages).
• Cloud hosting and infrastructure — to run and store the service securely.

These providers are bound by their own data-protection commitments and only process data as needed to deliver their function.

Retention

Data is retained while your account is active unless deletion is requested or legal retention is required.

Your rights (GDPR)

You can request export or deletion of your personal data through your authenticated account endpoints. See our Data Deletion page for how to delete your data and how long it takes.

Cookies

We use a small number of cookies to keep you signed in and to operate the service. See our Cookie Policy for details.

Data protection and security

Data is encrypted in transit with HTTPS (TLS). Google Calendar tokens, TikTok access tokens and WhatsApp Business credentials are encrypted at rest with AES-256-GCM. Passwords are stored as salted hashes, two-factor authentication is available, the database is not exposed to the public internet, and access to production systems is limited to authorised personnel.

Contact

Questions about privacy can be sent to [email protected], or by phone and WhatsApp on +1 (407) 782-8940. Konectus Technologies LLC is the data controller for the personal data described above.