Privacy Policy
How AHCCify collects, uses, stores and deletes personal data, including messages sent through Instagram, Facebook Messenger, WhatsApp, our website chat and our phone assistant.
1. Who we are
AHCCify is a business automation and AI assistant platform based in Sant Cugat del Vallès, Barcelona, Spain. In this policy, "AHCCify", "we" and "us" mean the AHCCify business that operates this website (ahccify-ahccify-website3.vercel.app) and the AHCCify platform.
2. Our two roles
When we act for ourselves. We decide how your data is used (we are the "controller") when you visit our website, send our contact form, create an AHCCify account, or message AHCCify's own Facebook Page, Instagram account (@ahccify), WhatsApp number or website chat.
When we act for a business that uses AHCCify. Businesses use AHCCify to answer their own customers. When you message one of those businesses, that business is the controller and decides how your data is used; AHCCify processes the data on its behalf (we are a "processor"). For those conversations, please also read the business's own privacy policy. You can still send us a deletion request (see Data Deletion); we pass it to the business concerned and act on its instructions.
3. What we collect and why
| Where it comes from | What we store | Why |
|---|---|---|
| Instagram Direct and Facebook Messenger | Your Instagram- or Page-scoped user ID (a number Meta assigns, not your username), the text of your messages, the type of any attachment (for example "image"), message IDs, timestamps, and our replies. | To read and answer your messages and to let the business's team continue the conversation. |
| Your phone number, the profile name WhatsApp shares, message text, message IDs, timestamps, our replies, and whether you opted in to or out of updates. | To answer your messages, send appointment reminders you booked, and respect opt-outs. | |
| Website chat | A random visitor ID stored in your browser, your messages and our replies. | To answer your questions and keep the conversation together. |
| Phone assistant | Your phone number, call times and duration, a call summary and transcript, and, when the business enables it, a call recording (you are told at the start of the call when a call may be recorded). | To answer calls, book appointments and take messages. |
| Details you share in a conversation | For example your name, e-mail, phone, company, what you need, budget or timeline, and appointment bookings. | To answer you, book appointments, send confirmations and reminders, and let the business follow up. |
| Our website contact form | Company name, your name, e-mail, phone (optional) and your message. | To reply to your inquiry. |
| AHCCify accounts (business customers) | Name, e-mail, password (stored only as a secure hash by our authentication provider), workspace settings, uploaded business documents, and billing status. | To provide the platform and manage subscriptions. |
| Data deletion requests | The details you give us in the request and its reference code and status. | To handle your request and show that we did. |
We do not sell personal data, and we do not use your messages for advertising.
4. AI processing
The assistant's replies are generated automatically by an AI model provided by OpenAI. To write a reply, we send OpenAI the conversation so far, the business's instructions and relevant extracts from the business's own knowledge base (its services, prices and policies). Documents that businesses upload to their knowledge base are also sent to OpenAI to create search indexes ("embeddings").
The assistant can hand a conversation to a person at the business at any time, for example when you ask for a human. E-mails the assistant drafts for you are reviewed and approved by a person before they are sent. The assistant does not make decisions about you that have legal or similarly significant effects.
5. Instagram, Messenger and WhatsApp
- Meta delivers your messages to us. We only receive messages you send to an account connected to AHCCify; we cannot read your other conversations.
- We only send replies to messages you sent us, within the time limits Meta sets (generally 24 hours after your last message). We do not send promotional messages on Instagram or Messenger.
- If you unsend (delete) an Instagram or Messenger message, we remove its text from our inbox and do not reply to it.
- To ask for deletion straight from the chat, send the message delete my data (also borrar mis datos or احذف بياناتي). You will receive a reference code. Because the request comes from your own account, we can identify your data without further checks.
- Messages also remain in your Instagram, Messenger or WhatsApp app and with Meta, under Meta's own privacy policy. We cannot delete copies held by Meta.
6. Legal bases (EU GDPR)
- Taking steps at your request and performing a contract: answering your messages, booking appointments, providing the platform to account holders.
- Legitimate interests: keeping conversation history so a person can follow up, and preventing abuse (for example rate limits and webhook signature checks).
- Consent: WhatsApp updates you opted in to. You can withdraw at any time by sending STOP (or BAJA).
- Legal obligations: billing and tax records for paid subscriptions.
7. Service providers we use
We share personal data only with providers that help us run AHCCify, and only for the purposes below.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database, sign-in and server functions. All AHCCify data listed above is stored here. | European Union (Frankfurt, Germany) |
| OpenAI | Generates assistant replies and knowledge-base search indexes. | United States |
| Meta Platforms (Instagram, Messenger, WhatsApp Business Platform) | Delivers messages between you and the business. | Meta's global infrastructure |
| Vapi | Runs phone calls for the phone assistant, including transcription and, where enabled, recording. | United States |
| Resend | Sends e-mails (booking confirmations, notifications, deletion-request confirmations). | United States |
| Stripe | Processes subscription payments for AHCCify account holders. We never see full card numbers. | Stripe's infrastructure |
| Vercel | Hosts this website. | Global content delivery network |
| Google Fonts and jsDelivr | Deliver the fonts and a code library this website loads; they receive your IP address when your browser requests these files. | Global content delivery networks |
Only if a business connects them to its workspace: HubSpot or Pipedrive (to add contacts or deals to the business's CRM) and Shopify, WooCommerce, Salla or Zid (to look up products and order status). Data is then shared with those services on the business's instructions.
8. International transfers
Our database is in the European Union. Some providers above process data outside the European Economic Area, mainly in the United States. Where that happens, the transfer relies on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.
9. How long we keep data
- Conversations, contacts, bookings and call records are kept while the business uses AHCCify, until the business deletes them, or until we delete them after a deletion request. We do not currently delete them automatically after a fixed period.
- Unsent messages: their text is removed from our inbox when you unsend them.
- WhatsApp opt-outs: if you opted out of updates, we keep your number on a do-not-message list even after deleting your other data, so you are never messaged again.
- Deletion requests: we keep the request, its reference code and status as a record that we handled it.
- Billing records of account holders are kept as long as tax law requires.
- Backups: deleted data can remain in our database provider's backups until those backups expire on their normal schedule.
10. Security
Data is encrypted in transit (HTTPS). Each business can only access its own workspace, enforced in the database. Access tokens and API keys for connected services are stored in an encrypted vault and are never sent to browsers. Incoming Meta and payment webhooks are verified with cryptographic signatures, and the website chat and deletion-request form are rate-limited against abuse.
11. Your rights
Under the EU General Data Protection Regulation you can ask us to give you access to your personal data, correct it, delete it, restrict or object to its use, or receive it in a portable format, and you can withdraw consent at any time.
- Deletion: use our Data Deletion page or send "delete my data" in the chat.
- Any other request: use our contact form or e-mail ahccify.privacy@natarapp.com and describe your request. We may ask you to confirm your identity before acting on it.
- Complaints: you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority in the EU country where you live.
12. Cookies and local storage
We do not use advertising or analytics cookies. This website and the chat store a few items in your browser's local storage: the chat's random visitor ID, your language choice, display preferences and, for account holders, the sign-in session. You can clear them at any time in your browser settings.
13. Children
AHCCify is a service for businesses and is not directed at children under 14. If you believe a child has given us personal data, please send a deletion request.
14. Changes to this policy
We will update this page when our practices change and change the "Last updated" date above.
15. Contact
AHCCify, Sant Cugat del Vallès, Barcelona, Spain. For privacy questions e-mail ahccify.privacy@natarapp.com or use our contact form; for deletion use the Data Deletion page.