Privacy Policy

Chatbucks is a product of Chatbucks Technologies Limited, a company registered in Nigeria. We run the Chatbucks platform: Chatbucks AI agents that answer customers on websites, WhatsApp and Instagram; Chatbucks Invoice for invoices, checkout and payouts; the Chatbucks Marketplace; and Chatbucks delivery, including the Chatbucks Rider app.

Under the Nigeria Data Protection Act 2023 (the NDPA), Chatbucks Technologies Limited is the data controller for the personal data described in this policy, except where we process data on a business's instructions (see section 2). You can reach us at [email protected].

This policy applies to you if you are:

• a business user: you or your organisation has a Chatbucks account and uses the dashboard, Chatbucks AI, invoicing, the Marketplace or delivery;
• a customer of a business: you message a business's Chatbucks AI agent on its website, on WhatsApp or on Instagram, receive an invoice, pay through Chatbucks, or order on the Chatbucks Marketplace;
• a rider or fleet: you deliver for Chatbucks through the Chatbucks Rider app, or run a fleet of riders;
• a visitor to our websites.

When you message a business through Chatbucks, that business decides why your messages are collected and is the controller of its own customer relationship; we process the conversation on its behalf and under this policy. Where the business has its own privacy notice, it applies alongside this one.

A business can connect its WhatsApp Business number and its Instagram professional account to Chatbucks so that its Chatbucks AI agent can reply there. When it does, Meta Platforms (through the WhatsApp Business Platform and the Instagram messaging API) gives us:

• the messages customers send to that number or account, and the agent's replies;
• the customer's WhatsApp number or Instagram-scoped user id, and the profile name Meta shows;
• the business's account details needed to send and receive messages (phone number id, account id, access tokens).

We use this Meta data only to:

• answer customers on the business's behalf, with the agent or a person at the business;
• send order, invoice, payment and delivery updates in the same conversation;
• keep the conversation history the business and the customer can see;
• detect abuse and keep the service working.

We do not use Meta data for advertising, we do not sell it, we do not use it to build profiles for any other purpose, and we do not share it with anyone except as set out in section 6. Access tokens are stored encrypted. When a business disconnects a channel, or removes Chatbucks from its Meta or Instagram settings, we delete the stored tokens at once and stop receiving messages for that channel. Our use of this data follows the Meta Platform Terms, the WhatsApp Business Terms of Service and the Instagram Platform Policy; our data deletion page explains how to have it removed.

Section 25 of the NDPA requires a lawful basis for each use. Ours are:

• Performing a contract: running your account, answering customers, issuing invoices, taking payments, paying out, and delivering orders.
• Legal obligation: identity verification, record-keeping, tax and anti-money-laundering rules, and responding to lawful requests from regulators.
• Legitimate interests: keeping the service secure, preventing fraud and abuse, improving how the agents answer, and telling you about service changes, where those interests do not override your rights.
• Consent: location sharing in the Rider app, marketing messages, and any other use we ask you about first. You can withdraw consent at any time.

Conversations may be sent to the AI model providers we use to generate the agent's replies. We send only what is needed to answer, we do not allow those providers to use it to train their models, and we do not use your conversations to train models of our own.

• The business you deal with: it sees the conversations with its agent, its customers' orders, invoices and delivery details.
• Riders and fleets: a rider delivering your order sees your first name, the delivery address and a phone number to call, and nothing else.
• Service providers acting on our instructions: cloud hosting, databases and backups, AI model providers, email and SMS providers, identity verification providers, and payment and banking partners that move money.
• Meta Platforms: messages sent on WhatsApp and Instagram pass through Meta's systems under Meta's own terms and privacy policy.
• Regulators and the law: where Nigerian law requires it, or to protect our rights, our users or the public.

We do not sell personal data.

Some of our providers (for example cloud hosting, AI models and Meta) process data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows: a country or provider the Nigeria Data Protection Commission recognises as giving adequate protection, or contractual terms that bind the provider to protect your data to the standard this policy sets.

• Conversations: 365 days from the last message in the conversation, after which they are deleted, unless the business or the customer asks for them to be deleted sooner (see our data deletion page).
• WhatsApp and Instagram access tokens: deleted immediately when a channel is disconnected.
• Account data: for as long as your account is open, and afterwards for as long as the law requires.
• Invoices, receipts, payments and payouts: for the period Nigerian financial and tax law requires us to keep transaction records, even after an account is closed.
• Riders' identity data (BVN, NIN, date of birth, address and the result of verification): for as long as the rider account is open and afterwards only as the law requires, after which it is deleted.
• Logs and technical data: for a short period for security, then deleted or anonymised.

Under the NDPA you can ask us to:

• confirm whether we hold your personal data and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, where we have no legal reason to keep it;
• restrict or object to how we use it, including for direct marketing;
• give you your data in a portable form;
• withdraw consent you gave earlier.

Email [email protected] from the address on your account. We may ask you to confirm your identity first. We respond within the time the NDPA allows and will tell you if we cannot do what you ask and why. You can also complain to the Nigeria Data Protection Commission.

Data is encrypted in transit and at rest, access is limited to staff who need it and is logged, secrets and channel tokens are stored in a managed secret store, and payments are handled by licensed providers. No system is perfectly secure; if a breach affects you we will tell you and the Commission as the NDPA requires.

Chatbucks accounts are for people aged 18 or over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

Our dashboard uses cookies and browser storage to keep you signed in and remember your settings. The website chat widget keeps the current conversation in the visitor's browser so it survives a page reload; nothing in it is used to track visitors across other sites.

We may update this policy as the service or the law changes. The date at the top shows the latest version. For material changes we will notify business users by email or in the dashboard before they take effect.

For questions about this policy or to exercise your rights, contact us using the details below.