Privacy Policy

1 Introduction

IA One, LLC ("we," "us," or "our") operates a messaging-based business management platform that provides inventory tracking, purchase order management, and related business tools to commercial clients through Meta's messaging platform APIs, including WhatsApp Business API, Facebook Messenger, and Instagram Messaging (collectively, the "Service").

This Privacy Policy describes how we collect, use, store, and protect information when you interact with our Service via any of the supported messaging platforms. By sending a message to any of our business accounts, you acknowledge that you have read and understood this policy.

Our Service is intended for use by authorized representatives of businesses that subscribe to our platform. It is not intended for personal consumer use.

2 Data We Collect

When you interact with our Service through any supported messaging platform, we receive and store data delivered to us via the platform's API webhooks. This includes all information that the platform transmits as part of the messaging interaction. Specifically, we collect and retain the following:

Data Category	Details	Source
Contact Information	Phone number (WhatsApp), platform user ID, display name, profile name	Platform webhook
Message Content	Full text of all messages sent to and from the Service, including text, media (images, documents, audio), interactive responses (button replies, list selections, quick replies), and message metadata (timestamps, message IDs, statuses)	Platform webhook
Business Data	Inventory items, product names, quantities, pricing, purchase orders, supplier information, and any other business information you communicate through the Service	Your messages
Conversation Metadata	Conversation IDs, delivery/read receipts, message statuses, error codes, timestamp of each interaction	Platform webhook
Profile Information	Business name, role, and any other identifying information you provide during onboarding or through conversation	Your messages
Technical Data	Business Account IDs, page IDs, phone number IDs, webhook event types and payloads	Platform webhook

Important: We store all data received from the messaging platform API webhooks, including the full payload of each event. This data is necessary to operate the Service, maintain conversation context, process your requests, and provide accurate business management functionality.

3 How We Use Your Data

We use the data we collect for the following purposes, all directly related to providing and improving the Service:

Delivering the Service: Processing your messages, executing inventory queries, managing purchase orders, and responding to your requests through our messaging bots.
Conversation Context: Maintaining conversation history so the bot can provide accurate, context-aware responses across interactions.
Business Records: Storing inventory data, purchase orders, and transaction history as part of the core functionality you use.
Service Improvement: Analyzing usage patterns (in aggregate) to improve bot accuracy, response quality, and feature development.
Technical Operations: Monitoring system performance, debugging errors, and ensuring the Service operates reliably.
Customer Support: Assisting with issues you report about the Service.

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Service.

4 Third-Party Service Providers

To operate the Service, we rely on the following third-party providers who may process your data on our behalf:

Provider	Purpose	Data Accessed
Meta Platforms	Messaging infrastructure — delivers and receives all messages via WhatsApp, Messenger, and Instagram	All message content and metadata as per Meta's Privacy Policy
Amazon Web Services (AWS)	Cloud infrastructure — hosts our application, databases, and processing services (including DynamoDB, ElastiCache, ECS Fargate)	All data stored and processed by the Service
AI Providers (see Section 5)	Natural language processing — interprets your messages and generates responses	Message content sent to and from the bot

Each of these providers operates under their own privacy policies and data processing agreements. We select providers that maintain industry-standard security practices and contractual data protection commitments.

5 AI-Powered Processing

Our Service uses artificial intelligence to understand your messages and provide intelligent responses. This is a core part of how the Service operates.

How it works: When you send a message to the Service, the content of your message may be sent to a third-party AI provider for natural language processing. The AI provider processes the text, generates a response, and returns it to our system. Your message content is transmitted to and processed by the AI provider's servers.

Current and future providers may include:

OpenAI (OpenAI, L.L.C.) — via their API, which operates under OpenAI's API Data Usage Policy. As of the date of this policy, OpenAI does not use API input or output data to train their models.
Amazon Bedrock — a managed AI service by AWS that hosts various foundation models within AWS infrastructure.
Other AI providers — we may adopt additional or alternative AI providers in the future. We will update this policy accordingly.

What is sent to AI providers: The text content of your messages and relevant conversation context needed to generate an accurate response. We do not send your phone number or personal identifiers to AI providers unless it is included in the message text you wrote.

What is not sent: We strip personally identifiable metadata (phone numbers, platform user IDs) from the data sent to AI providers where technically feasible. However, if you include personal or sensitive information in the body of your messages, that content will be processed by the AI provider.

Note: We may change AI providers or host our own AI models at any time. Regardless of the provider, the same data handling principles described in this policy will apply. Any material change in how AI providers handle your data will be reflected in an update to this policy.

6 Data Storage & Security

Your data is stored on cloud infrastructure operated by Amazon Web Services (AWS), with servers primarily located in the United States.

We implement the following security measures:

Encryption at rest: All data stored in our databases is encrypted using industry-standard AES-256 encryption.
Encryption in transit: All data transmitted between our systems, third-party providers, and messaging platforms is encrypted via TLS 1.2 or higher.
Access control: Database access is restricted to authorized application services through IAM policies. No human operator has routine access to message content.
Tenant isolation: Data from different business clients is logically separated and isolated at the database level.
Logging and monitoring: We maintain security logs to detect unauthorized access. Phone numbers and personal identifiers are masked in application logs.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7 Data Retention

We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

Data Type	Retention Period
Conversation history	Duration of active subscription, plus 90 days after termination
Purchase orders and transaction records	Duration of active subscription, plus up to 5 years for accounting and legal compliance
Inventory data	Duration of active subscription, plus 90 days after termination
Contact information (phone number, name)	Duration of active subscription, plus 30 days after termination
Session and cache data (Redis)	24 hours (automatically expired)

When a business subscription is terminated, we will delete or anonymize all associated user data within the timeframes specified above, unless a longer retention period is required by law or for legitimate business purposes (such as maintaining financial records).

8 Data Sharing

We do not sell, rent, or trade your personal data or business information to any third party.

We may share your data only in the following limited circumstances:

Service providers: As described in Sections 4 and 5, with providers who process data on our behalf to operate the Service.
Legal obligations: If required by law, court order, or governmental request, we may disclose your data to comply with applicable legal requirements.
Protection of rights: If necessary to protect our rights, safety, or property, or that of our users or the public.
Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections described in this policy.

We will never share the content of your messages or your business data (inventory, purchase orders, pricing) with other clients of our Service or any unrelated third party.

9 Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate personal data.
Deletion: Request deletion of your personal data (see Section 10).
Data portability: Request an export of your data in a machine-readable format.
Opt out: Stop receiving messages from the Service at any time by sending "STOP" to any of our messaging accounts or by contacting us at the email below.

To exercise any of these rights, contact us using the information in Section 13. We will respond to your request within 30 days.

10 Data Deletion

You may request deletion of your data at any time by sending an email to privacy@iaoneve.com with the subject line "Data Deletion Request." Please include the phone number or username associated with your account.

Upon receiving a valid deletion request, we will:

Delete your conversation history, profile information, and contact data within 30 days.
Delete or anonymize associated business data (inventory, purchase orders) within 30 days, unless retention is required for legal or accounting purposes.
Send you a confirmation via email once deletion is complete.

Please note that deletion of your data may also be initiated by your employer or business administrator, as the business client controls the subscription.

For detailed data deletion instructions, including requests related to Meta/Facebook, please refer to our Data Deletion Instructions page.

11 Children's Privacy

Our Service is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data through the Service, please contact us immediately and we will take steps to delete that information.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Notify active users via a message on the applicable platform when feasible.

Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

IA One, LLC
Email: info@iaoneve.com
Privacy inquiries: privacy@iaoneve.com
Website: iaoneve.com