Privacy Policy

1. Who we are

DAF Agents ("DAF Agents", "we", "us", or "our") provides business automation, shared inbox, customer-support, and AI-assisted workflow services. Businesses using our services are our customers. People who communicate with those businesses are their end users.

For customer message data, we generally act as a service provider or processor on the instructions of the connected business. That business remains responsible for its customer relationship, notices, permissions, and lawful use of the data.

2. Information we process

Business account information

• Names, business names, work email addresses, account identifiers, staff roles, and authentication records.
• Connected channel identifiers, including Facebook Page IDs, Instagram professional account IDs, WhatsApp Business Account and phone-number IDs.
• Authorization tokens and permissions needed to operate integrations. Tokens are stored server-side and protected from normal user access.

Customer communications

• Message content, attachments, sender identifiers, profile information made available by the connected platform, timestamps, delivery status, and conversation history.
• Customer details supplied during a conversation, such as contact information, order references, support requests, and preferences.

Business operational data

• Products, orders, policies, knowledge-base material, integration settings, agent instructions, audit records, and workflow results supplied or authorized by the business.

Technical data

• IP addresses, device and browser information, security logs, request metadata, errors, and service-usage information.

3. How we use information

• Authenticate users and provide the DAF Agents platform.
• Connect authorized business accounts and receive messages through official platform APIs and webhooks.
• Route conversations to the correct business workspace, generate or suggest customer-service responses, execute approved workflows, and support handoff to human staff.
• Maintain conversation history, order context, service quality, security, fraud prevention, troubleshooting, and auditability.
• Provide support, communicate service updates, enforce our terms, and comply with law.

We do not sell personal information or use customer message data for third-party advertising.

4. AI processing

Where a business enables AI-assisted features, relevant conversation and business context may be sent to contracted AI infrastructure providers solely to generate the requested response or complete the requested workflow. We require service providers to process this data under our instructions and appropriate confidentiality and security obligations.

5. Legal bases

Depending on the relationship and location, processing may be based on performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required. Connected businesses are responsible for establishing an appropriate legal basis for the customer data they instruct us to process.

6. How information is shared

We may share information only as needed with:

• The connected business and its authorized staff.
• Meta companies and other platforms selected by the business to deliver channel integrations.
• Hosting, database, storage, monitoring, communications, and AI infrastructure providers acting under contract.
• Professional advisers, authorities, or other parties when required by law or necessary to protect rights, safety, and service integrity.
• A successor in a merger, acquisition, financing, or sale, subject to appropriate confidentiality and notice requirements.

We do not disclose one business's message data to another business.

7. Retention and deletion

We retain information while the business account is active and as needed to provide the service. When an authorized deletion request is verified, we delete or de-identify covered production data within 30 days unless law, security, dispute resolution, or fraud prevention requires a longer period. Encrypted backup copies may remain for up to 90 days before automatic expiry and are not returned to active systems except for disaster recovery.

Businesses and end users can review the process on our Data Deletion Instructions page.

8. Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of the data, including access controls, tenant separation, encrypted transport, protected credentials, logging, backups, and restricted production access. No system is completely secure, and we cannot guarantee absolute security.

9. International processing

Our service providers may process data in countries other than the user's country. Where required, we use contractual or other lawful safeguards for international transfers.

10. Your choices and rights

Depending on applicable law, individuals may request access, correction, deletion, restriction, objection, or a copy of their personal information. End users should normally contact the business they messaged first because that business controls the customer relationship. We assist connected businesses with verified requests.

11. Children

DAF Agents is a business service and is not directed to children. Businesses must not intentionally use the service to collect children's personal information without a lawful basis and appropriate safeguards.

12. Changes to this policy

We may update this policy when our services, providers, or legal obligations change. We will publish the revised version here and update the effective date. Material changes may also be communicated to account administrators.