Privacy Policy

This Privacy Policy explains how RhemaChat processes personal data through our websites, applications, and AI-powered WhatsApp sales workspace.

For customer-controlled WhatsApp conversations and lead records, the customer is generally the data controller and RhemaChat acts as its data processor. For account, security, billing, and service-operation data, RhemaChat may act as a controller.

• Account data, including name, email, organization, role, profile image, and authentication records.
• WhatsApp and lead data, including phone number, profile name, messages, media, delivery status, lead stage, assignment, notes, and conversation history.
• Business knowledge supplied by customers, including catalogs, FAQs, brochures, locations, pricing, and agent instructions.
• Usage and technical data, including IP address, device information, application events, error logs, AI token usage, and security audit records.
• Optional mobile data such as camera media, contacts, notifications, and precise location, only when a user invokes the related feature and grants permission.
• Contract and billing administration data. RhemaChat does not intentionally store full payment-card credentials.

• Provide the shared inbox, AI responses, lead management, assignment, analytics, and support features.
• Route and deliver messages through Meta's WhatsApp Business Platform.
• Generate responses and insights using customer-approved business knowledge and configured AI providers.
• Secure the service, prevent abuse, enforce tenant boundaries, investigate incidents, and maintain audit records.
• Administer contracts, subscriptions, service limits, and support requests.
• Meet legal obligations and enforce our agreements.

We process personal data as necessary to perform contracts, comply with legal obligations, protect legitimate security and operational interests, and, where required, based on consent. Customers are responsible for establishing a lawful basis for lead and WhatsApp data they instruct RhemaChat to process.

We use providers for messaging, hosting, authentication, databases, media delivery, monitoring, notifications, and AI processing. These may include Meta, Supabase, Cloudinary, infrastructure hosting providers, and configured AI providers.

We disclose data only as needed to provide the service, follow customer instructions, protect the platform, complete a corporate transaction, or comply with law. We do not sell personal data or use customer conversations for third-party advertising.

View our current subprocessor categories.

RhemaChat and its providers may process data in Indonesia, Singapore, Australia, the United States, or other locations where providers operate. We apply contractual and organizational safeguards appropriate to the services involved.

Customer content is retained for the duration configured in the service or customer agreement, then deleted or anonymized unless continued retention is required for security, disputes, audit, or law. Backup copies may remain for a limited recovery period.

Customers can request account or tenant deletion through an authorized administrator or by contacting us. WhatsApp and Meta users can follow our Data Deletion Instructions.

We apply tenant-scoped authorization, encryption in transit, encrypted storage for selected credentials, role-based access, multi-factor authentication for platform administration, audit logging, backups, and security monitoring. No system is completely secure, and customers must protect their accounts and connected business credentials.

Subject to applicable law, individuals may request access, correction, deletion, restriction, objection, withdrawal of consent, or a copy of their personal data. For lead data controlled by a RhemaChat customer, we may direct the request to that customer and assist them as their processor.

We may update this policy as the service and legal requirements change. Material changes will be communicated through the service or another appropriate channel.

Privacy requests: [email protected]