Privacy Policy

1. Introduction

Aimi (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered WhatsApp scheduling assistant service.

By using Aimi, you agree to the collection and use of information in accordance with this policy. This policy is designed to comply with the Meta Terms for WhatsApp Business from Meta Platforms, Inc. (“Meta”) and applicable data protection laws, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

2. Information We Collect

2.1. Information You Provide

We collect information you provide directly:

• Account Information: Name, email address, phone number, business name, and WhatsApp Business number
• Business Data: Services offered, pricing, availability, staff information, and appointment settings
• Calendar Data: Google Calendar integration data (with your explicit consent) to sync appointments
• Communications: Messages you send to us for support or inquiries

2.2. Information Collected Through WhatsApp

Through the WhatsApp Business API, we process the following data as required for service delivery:

• Customer Phone Numbers: To send and receive appointment-related messages
• Message Content: Appointment booking conversations between your customers and our AI assistant
• Message Metadata: Timestamps, delivery status, and message identifiers

Important: We only process WhatsApp data as necessary to provide our scheduling services and comply with Meta's WhatsApp Business API policies. We do not use WhatsApp data for advertising purposes.

2.3. Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: Browser type, operating system, and IP address
• Cookies and Tracking: Similar technologies to improve and personalize your experience

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To process appointment bookings, send reminders, and manage scheduling through WhatsApp
• Account Management: To create and manage your account, process payments, and provide customer support
• Communication: To send you service updates, security alerts, and promotional communications (with your consent)
• AI Processing: To power our AI assistant that understands and responds to customer booking requests
• Analytics: To analyze usage patterns, improve our services, and develop new features
• Compliance: To comply with legal obligations and WhatsApp Business API requirements

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

• Contract: To fulfill our service agreement and provide scheduling services
• Legitimate Interest: To maintain and improve our services, prevent fraud, and ensure security
• Consent: For marketing communications and optional features (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

5.1. Third-Party Service Providers

We share data with trusted third parties:

• Meta Platforms, Inc.: As required for WhatsApp Business API services. Meta's privacy policy applies to data processed through their platforms
• Google: For Google Calendar integration (subject to Google's privacy policy)
• Cloud Infrastructure: Hosting and data storage providers (e.g., Cloudflare, AWS)
• AI Services: Language model providers for powering our AI assistant
• Payment Processors: To process subscriptions and payments

5.2. Data We Do Not Sell

We never sell your personal information or WhatsApp message data to third parties for advertising or marketing purposes.

5.3. Legal Requirements

We may disclose information if required to do so by law or in good faith belief that such action is necessary to: (a) comply with legal obligations; (b) protect and defend our rights; (c) prevent fraud or security issues; or (d) protect the rights, property, or safety of our users or the public.

6. Data Retention

We retain your personal data for different periods depending on the purpose:

• Active Accounts: While your account is active
• Appointment Records: For the duration of your account plus 2 years (for business records and compliance)
• WhatsApp Messages: As per WhatsApp Business API retention policies (typically 30 days for message content, longer for metadata)
• After Account Deletion: Personal data is securely deleted or anonymized within 30 days, except where required by law

7. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request limitation of data processing
• Withdraw Consent: Withdraw consent for marketing communications at any time

CCPA Rights (California): California residents have the right to opt-out of the sale of their personal information (though we do not sell personal data) and request disclosure of data categories collected.

To exercise these rights, contact us at contact@aimi.so.

8. WhatsApp-Specific Privacy Practices

As a WhatsApp Business API provider, we adhere to Meta's privacy requirements:

• We only process WhatsApp messages for the purpose of providing appointment scheduling services
• We do not use WhatsApp message content for training AI models or improving services without explicit consent
• We do not share customer phone numbers with third parties for marketing purposes
• We comply with WhatsApp's message content retention policies
• Your customers' WhatsApp data is protected according to Meta's Business Messaging Terms

For more information about Meta's privacy practices, visit: Meta Privacy Policy and WhatsApp Legal Info.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: Data is encrypted in transit (TLS/HTTPS) and at rest using industry-standard encryption
• Access Controls: Strict access controls and authentication for employees and systems
• Regular Audits: Regular security assessments and vulnerability testing
• Incident Response: Procedures to detect and respond to security incidents

Despite our best efforts, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Compliance with GDPR adequacy decisions where applicable
• Certifications under frameworks such as Data Privacy Framework (EU-US)

11. Children's Privacy

Our service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new policy on this page with an updated effective date
• Sending a notification via email or WhatsApp (for significant changes)

We encourage you to review this policy periodically. Your continued use of Aimi after changes constitute acceptance of the updated policy.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: