This Privacy Policy transparently details how AutoBiz collects, isolates, and protects merchant and consumer data. It explicitly discloses our AWS cloud hosting, Cloudflare network security, Google Analytics telemetry, and Google Cloud Vertex AI zero-training guarantees.
Last Updated & Certified: September 2026 · Colombo, Sri Lanka
AWS Cloud Hosting
Hosted on Amazon Web Services with AES-256-GCM encryption at rest and TLS 1.3 in transit.
Cloudflare Edge Shield
Global Anycast proxy, enterprise WAF, and DDoS mitigation safeguarding customer data.
Zero AI Training
Vertex AI & Whisper models never retain or train on merchant prompts or buyer dialogues.
Multi-Tenant Isolation
Strict database-level tenant separation ensuring zero cross-merchant data leakage.
SECTION 1
1. Introduction & Regulatory Scope
AUTOBIZ (“we”, “our”, “us”) operates an enterprise conversational AI commerce engine for Sri Lankan businesses. This Privacy Policy outlines how we collect, process, store, and protect information when you utilize our platform to automate conversations across WhatsApp Business Cloud API, Facebook Messenger API, and Instagram Messaging API.
We operate as an official Meta Tech Provider and comply with international privacy standards and Sri Lankan law:
Meta Platform & Developer Policies
WhatsApp Business Terms & Policies
Sri Lanka PDPA (Act No. 9 of 2022)
General Data Protection Regulation (GDPR)
SECTION 2
2. Information We Collect & Process
2.1 Merchant Business Information
When you register an account, we collect your full name, business name, business email, contact phone number, billing address, and Meta Business Manager ID.
2.2 Business Knowledge & Training Documents
Product catalogs, pricing spreadsheets, FAQ lists, business hours, and operational policies uploaded to train your custom AI agent. This data is strictly scoped to your tenant database.
2.3 Customer Conversation Data (End-Users)
When end-customers message your business via WhatsApp, Messenger, or Instagram, we process messages as a data processor on your behalf:
WhatsApp: Phone number (WA-ID), profile name, message text, audio voice note files, and uploaded bank transfer slip images.
Messenger & Instagram: Page-Scoped User IDs (PSID / IGSID), profile display names, and conversation text. (Meta never exposes personal phone numbers or email addresses from Messenger/Instagram DMs to our platform).
SECTION 3
3. AI Architecture & Zero-Training Guarantee
STRICT OPT-OUT FROM PUBLIC MODEL TRAINING:Your merchant data, customer chat histories, customer audio voice notes, and bank slip images are processed strictly for real-time inference. Under our enterprise agreements with Google Cloud Vertex AI and OpenAI, your data is NEVER used to train, retrain, or improve public AI models.
Google Cloud Vertex AI (Gemini 2.5 / 2.0 Flash): Powers Sinhala, Tamil, and Singlish conversational reasoning within an isolated enterprise project boundary in Google Cloud.
Mandatory First-Message AI Disclosure: All initial bot messages identify the agent as an AI assistant. This cannot be disabled.
Transient Processing: Audio voice notes and customer media attachments are converted to text or securely processed and are not retained by external AI providers after the request lifecycle completes.
SECTION 4
4. Meta Channels & 24-Hour Window Governance
All conversational routing adheres strictly to Meta Platform policies:
• 24-Hour Messaging Window: Automated AI responses are hard-blocked after 24 hours from the customer's last message.
• Outbound Template Messaging: Marketing broadcasts beyond the 24-hour window require Meta-approved templates and documented customer opt-in.
• Official Cloud API & Anti-Spam Compliance: Using AutoBiz will never cause your account to be banned because all messaging runs through official Meta Cloud APIs. Standard account health is simply maintained by normal business communication: avoiding unsolicited spam messages that lead customers to report or block your number. AutoBiz assumes zero liability for merchant-initiated spam or recipient reports.
• No Data Resale: AutoBiz never sells, rents, or licenses Meta customer records to advertising brokers.
SECTION 5
5. How We Use Collected Information
Delivering automated customer support and conversational sales on your connected channels.
Transcribing WhatsApp audio voice notes and extracting order data.
Securely routing customer order attachments and payment receipts for merchant dashboard viewing.
Compiling customer delivery details for merchant Cash on Delivery fulfillment.
Administering prepaid LKR wallet balances, credit deductions, and invoices.
Providing authorized technical support, bug diagnostics, hands-on onboarding, and AI assistant training/optimization via secure administrative access (“Login as Owner”) as authorized under our Terms of Service.
Protecting platform integrity and enforcing anti-spam policies.
SECTION 6
6. Data Sharing & Third-Party Sub-Processors
We disclose below all third-party cloud infrastructure, edge routing, AI inference, and telecommunications providers utilized to operate AutoBiz:
Amazon Web Services (AWS)
United States / Global Regions
Purpose: Cloud server hosting, compute (EC2), media storage (S3), and encrypted database layers
Data Processed: Encrypted account data, catalog media, order records, and bank slip images
🛡️ Privacy Standard: AES-256 encryption at rest and in transit. SOC 1/2/3, ISO 27001 certified.
Amazon Web Services (AWS) Hosting: AutoBiz backend services, PostgreSQL database clusters, Redis caching layers, and media storage reside on hardened AWS infrastructure. All database volumes are encrypted using AWS KMS with AES-256 keys.
Cloudflare Network & Edge Security: All external web requests pass through Cloudflare Anycast edge nodes. Cloudflare provides automated DDoS mitigation, TLS 1.3 encryption, and Web Application Firewall (WAF) filtering before traffic enters our private VPC.
To monitor system health, detect technical errors, and optimize search performance, we utilize standard, privacy-respecting analytics and indexing tools:
Google Analytics (GA4):Tracks aggregated, anonymized metrics such as pageviews, session lengths, browser device types, and conversion funnel milestones. IP masking is enabled. GA4 does NOT capture private customer chat contents, bank transfer details, or passwords.
Google Search Console:Monitors website crawl performance, sitemap indexing, and search discovery queries to ensure documentation and landing pages remain accessible.
Microsoft Bing Webmaster Tools:Assists with technical diagnostics, search indexing verification, and edge crawl health for public website pages.
SECTION 9
9. Data Security & AES-256-GCM Token Encryption
All Meta API access tokens, Google Calendar OAuth credentials, and channel API secrets are encrypted at rest using AES-256-GCM authenticated encryption. Encryption keys are stored independently in environment keyrings.
Database Multi-Tenancy: Every database query is strictly scoped by tenant_id. It is architecturally impossible for one merchant to query or view another merchant's contacts, orders, or conversation history.
SECTION 10
10. Data Retention Periods & Deletion Protocol
• Active Account Data: Retained for the duration of your active subscription.
• Customer Conversations: Retained for 12 months by default, or deleted immediately upon merchant request.
• Compliance & Opt-Out Logs: Retained for 24 months to satisfy Meta audit requirements.
How to Request Data Deletion: Merchants or consumers can email support@autobiz.lk with the subject line “Data Deletion Request”. All associated database records will be permanently purged within 30 days.
SECTION 11
11. Customer Opt-Out Rights (STOP / UNSUBSCRIBE)
Any customer can permanently stop automated messaging on WhatsApp, Messenger, or Instagram by texting STOP, UNSUBSCRIBE, CANCEL, or QUIT.
Upon receipt, the AI agent is instantly silenced in real time, the opt-out is recorded in an immutable ledger, and no further automated outreach will occur unless the customer texts START to re-subscribe.
SECTION 12
12. Meta Developer & Tech Provider Compliance
AutoBiz connects exclusively via official Meta Cloud APIs and enforces:
• Mandatory SHA-256 Webhook validation
• 1-Click human takeover escalation paths
• Automated 24-hour service window gating
• Zero unofficial QR scrapers or third-party web bots
SECTION 13
13. International Transfers & Sri Lanka PDPA
Our services are engineered in Sri Lanka and hosted on global AWS infrastructure. Under the Sri Lanka Personal Data Protection Act (PDPA No. 9 of 2022) and international transfer standards, data transferred across international borders is protected under Standard Contractual Clauses (SCCs) and enterprise data processing agreements.
SECTION 14
14. Your Privacy Rights (Access, Rectification & Export)
Merchants and consumers have the statutory right to:
Access and export conversation transcripts and customer lists via CSV.
Rectify inaccurate business information or product catalog listings.
Request permanent deletion of account credentials and conversational history.
Revoke Meta API authorizations at any time directly through Meta Business Manager.
SECTION 15
15. Contact Us & Privacy Desk
For privacy inquiries, audit verification, or data subject access requests: