AUTOBIZ Logo
FeaturesPricingDocsBlogContact
Log InStart for Free

Privacy Policy

Last updated: June 2026

1. Introduction & Scope

AUTOBIZ ("we", "our", "us") is an AI-powered business messaging automation platform. This Privacy Policy explains exactly how we collect, use, disclose, and safeguard your information when you use our platform — including when it is used to automate conversations over WhatsApp Business API, Facebook Messenger API, and the Instagram Messaging API.

We are an official Meta Tech Provider and operate in full compliance with:

  • Meta Platform Terms and Meta Developer Policies
  • WhatsApp Business Terms of Service
  • Meta Business Messaging Policy
  • Instagram Platform Policy
  • Facebook Pages Terms
  • GDPR (for users in the European Economic Area)

This policy applies to: (a) merchants who create an AUTOBIZ account, and (b) end-customers who interact with a business through AUTOBIZ's AI agent on WhatsApp, Messenger, or Instagram.

2. Information We Collect

2.1 Account & Business Information (Merchants)

When you create an AUTOBIZ merchant account, we collect:

  • Full name, email address, and phone number
  • Business name, address, and industry type
  • Meta Business Manager ID and associated Facebook/Instagram account information
  • WhatsApp Business Account (WABA) ID and phone number ID
  • Facebook Page ID and Instagram Professional Account ID

2.2 Business Configuration Data

To power your AI agent, we store:

  • Product and service catalog, pricing, and descriptions
  • Business policies, FAQs, and knowledge base documents you upload
  • Business operating hours, holidays, and scheduling rules
  • AI personality settings (tone, language preferences, greeting messages)
  • Custom rules and workflows you configure

2.3 Meta API Credentials

We securely store access tokens required to operate your connected channels. All credentials are encrypted using AES-256-GCM at rest and transmitted only over HTTPS/TLS:

  • WhatsApp: WhatsApp Cloud API access token, Phone Number ID, WhatsApp Business Account ID
  • Facebook Messenger: Facebook Page Access Token, Facebook Page ID, Facebook App ID
  • Instagram: Instagram User Access Token, Instagram Business Account ID, linked Facebook Page ID

2.4 Customer Conversation Data (End-Users)

When customers message a business through WhatsApp, Messenger, or Instagram, we process and store the following data on behalf of the merchant (acting as a data processor):

  • WhatsApp: Customer phone number (WA-ID), display name from WhatsApp profile, message content and timestamps, media attachments, message IDs, delivery and read statuses, interactive element responses (button taps, list selections)
  • Facebook Messenger: Customer's Page-Scoped User ID (PSID) — a unique, Facebook-assigned identifier that does NOT expose the customer's real Facebook profile to us — display name, message content and timestamps, attachments, message IDs
  • Instagram DM: Customer's Instagram-Scoped User ID (IGSID) — similarly anonymised — display name from Instagram profile, message content and timestamps, attachments, message IDs

Important: For Messenger and Instagram, we only receive the platform-scoped user ID (PSID/IGSID), not the customer's real email address, phone number, or full Facebook/Instagram profile. This is by design — Meta only shares what is necessary for message routing.

2.5 Platform Usage Data

  • Dashboard activity, page views, and feature usage (anonymized)
  • IP address, device type, and browser metadata for security purposes
  • API usage metrics (message count, credit consumption per channel)
  • Error logs and system health data (no personally identifiable information)

3. AI Processing of Messages — Mandatory Disclosure

AUTOBIZ uses Artificial Intelligence (AI) technology to process and automatically respond to customer messages. This is the core feature of our platform. All three supported messaging channels — WhatsApp, Facebook Messenger, and Instagram DM — are powered by AI automation. Here is exactly how it works:

  • AI-Generated Responses: When a customer sends a message to a business using AUTOBIZ, the message is read by our AI system, which generates an appropriate response based on the business's knowledge base, rules, and conversation history. These responses are not written in real time by a human employee.
  • Mandatory First-Message AI Disclosure: Our platform is hardcoded to identify itself as an AI Assistant in the very first message of every new conversation on all three channels. For example: "Hi there! I'm the AI Assistant for [Business Name]. How can I help you?" This disclosure is a non-negotiable platform requirement and cannot be disabled or overridden by any merchant configuration.
  • Honest AI Identification: If a customer directly asks "Are you a bot?", "Am I talking to an AI?", or similar questions, our AI is programmed to always answer honestly that it is an AI assistant. It will never deny being an AI when sincerely asked.
  • Natural Language Understanding (NLU): All incoming messages are analyzed using NLU to detect intent, language, and context before generating a response.
  • Multi-language Support: The AI processes messages in English, Sinhala, Tamil, and Singlish (romanized Sinhala), responding in the same language the customer uses.
  • AI Knowledge Training: Your business information (FAQs, product catalog, documents, website content) is used to train and inform the AI's responses. This data is strictly scoped to your tenant — it is never mixed with another business's data.
  • Human Handover: The AI is programmed to automatically transfer conversations to a human agent when: it cannot answer a question, the customer requests a human, the customer expresses frustration, emergency keywords are detected, or after 3+ repetitions of the same unanswered question.
  • Opt-Out of AI at Any Time: Customers can permanently disable AI messaging by sending STOP or UNSUBSCRIBE (see Section 9 for full details).

4. How Each Channel Works — User Consent & Messaging Rules

4.1 WhatsApp Business

AUTOBIZ uses Meta's official WhatsApp Cloud API. Businesses can only send automated messages within the 24-hour messaging window — i.e., within 24 hours of the customer's last inbound message. Outside this window, only pre-approved Message Templates may be sent. Customers initiate conversations by messaging the business's WhatsApp number directly.

4.2 Facebook Messenger

AUTOBIZ uses Meta's Messenger Platform API (Pages). Businesses can only send automated replies within the 24-hour messaging window following a customer's message. The business cannot initiate a Messenger conversation unprompted — the customer must send the first message. Outside the 24-hour window, only approved Message Tags or Sponsored Messages (if separately enabled) may be used.

4.3 Instagram Direct Messages

AUTOBIZ uses Meta's Instagram Messaging API. Similar to Messenger, businesses can only send automated replies within the 24-hour window after a customer sends a DM, reacts to a Story, or mentions the business in a Story. The business cannot send unsolicited Instagram DMs.

5. How We Use Your Information

  • Operate and maintain the AUTOBIZ platform and AI agents across all connected channels
  • Process and route customer messages via the WhatsApp, Messenger, and Instagram APIs
  • Generate AI responses using the business's trained knowledge base
  • Enforce Meta's 24-hour messaging window policy across all three channels
  • Detect and process opt-out requests (STOP, UNSUBSCRIBE) and maintain opt-out records
  • Trigger human handover when escalation criteria are met
  • Detect and block prohibited content (spam, emergency keywords, abusive language)
  • Send booking confirmations, appointment reminders, and transactional notifications
  • Process billing, credits, and invoice generation
  • Send platform security and service alerts to merchants
  • Provide anonymized analytics and performance reports to merchants
  • Comply with legal obligations and Meta's audit requirements

We do NOT use customer conversation data for advertising, profiling, or selling to third parties. We do NOT use conversation content to train general-purpose AI models.

6. Data Sharing & Third-Party Processors

We do NOT sell, rent, trade, or monetize your personal or customer data. Data is shared only in the following strictly necessary situations:

  • Meta (Facebook/WhatsApp/Instagram): Message content and routing data is transmitted to and from Meta via the respective APIs (WhatsApp Cloud API, Messenger API, Instagram API) solely to deliver and receive messages.
  • AI Processing Services: Message context is sent to AI model providers solely to generate responses. We explicitly opt out of any AI provider programs that would use your data to train their general-purpose models.
  • Cloud Infrastructure: Our platform is hosted on cloud servers. Data is stored in encrypted form. Our infrastructure providers do not access your data for any purpose other than hosting.
  • Legal Requirements: We may disclose data if required by law, court order, or regulatory authority.

7. Data Isolation & Security

AUTOBIZ operates a strict multi-tenant architecture — your business data is completely isolated from all other businesses. Every database query is scoped to your tenant ID, enforced at the application layer. Security measures include:

  • AES-256-GCM encryption for all Meta API credentials and sensitive fields at rest
  • HTTPS/TLS 1.3 for all data in transit
  • JWT-based authentication with short expiry, plus refresh token rotation
  • Role-based access control (RBAC): Owner, Admin, Staff — each with scoped permissions
  • Redis-backed deduplication to prevent duplicate message processing
  • Full immutable audit log of all compliance-critical actions (opt-outs, handovers, data deletions)
  • Webhook signature verification on all incoming Meta webhook events

8. Data Retention

We retain your data for the following periods:

  • Account & business data: For the lifetime of your active account, and for 90 days after account closure
  • Customer conversation messages (all channels): 12 months from the date of the message, unless you request earlier deletion
  • Audit logs (opt-outs, handovers, deletions): 24 months for compliance purposes
  • API usage metrics: 12 months
  • Encrypted Meta API tokens: Until revoked by the merchant or until the connected account is disconnected

Data Deletion Requests: To request deletion of your account and all associated data (including customer conversation logs and Meta API configurations), email support@autobiz.lk with the subject "Data Deletion Request". We will process your request within 30 days. You can also type "delete my data" in any AUTOBIZ AI conversation.

9. Opt-Out / Unsubscribe from AI Messaging

Every customer who receives AI-automated messages through any AUTOBIZ-powered channel has the legally protected right to opt out at any time, as required by Meta's Business Messaging Policy.

How to Opt Out (All Channels)

  • WhatsApp: Reply with STOP, UNSUBSCRIBE, CANCEL, END, or QUIT. Our system will send a confirmation prompt and permanently disable automated messages upon your confirmation.
  • Facebook Messenger: Send STOP or UNSUBSCRIBE in the Messenger conversation. The same opt-out flow applies — you will receive a confirmation prompt and automated messaging will stop permanently.
  • Instagram DM: Send STOP or UNSUBSCRIBE in the Instagram Direct Message conversation. Opt-out is processed the same way across all channels.
  • Email: Contact us at support@autobiz.lk to opt out on behalf of a specific number, PSID, or IGSID.

What Happens After Opt-Out

  • AI messaging is permanently disabled for your contact record across all channels
  • You receive a final confirmation: "You have been successfully unsubscribed from automated messages. You will not receive any further automated messages. Reply START at any time to resume."
  • Your opt-out is recorded in an immutable audit log
  • No further automated messages will be sent — not through WhatsApp, Messenger, or Instagram

How to Re-Subscribe

Reply with START, SUBSCRIBE, YES, or RESUME in any conversation with the business on any channel. Your opt-in is immediately re-activated.

10. Meta Platform Compliance

As a Meta Tech Provider, AUTOBIZ strictly complies with:

  • WhatsApp Business Terms of Service — 24-hour window, template messaging for outbound
  • Meta Platform Terms — data use restrictions, no unauthorized scraping, no re-selling of data
  • Meta Developer Policies — limited data use, security requirements, audit cooperation
  • Meta Business Messaging Policy — prohibition of spam, opt-out enforcement, prohibited content
  • Instagram Platform Policy — user-initiated conversations only, 24-hour window
  • Facebook Pages Terms — page-scoped identity (PSID) usage restrictions

Specific enforcement mechanisms in our platform:

  • 24-Hour Window: Automated AI responses are hard-blocked outside the 24-hour window on all channels
  • Opt-Out Enforcement: STOP/UNSUBSCRIBE is detected by regex pattern matching with Redis-backed state — it cannot be bypassed
  • Prohibited Content: Emergency, abusive, and profanity patterns are detected and blocked before AI processing
  • Human Handover Path: A frictionless path to a human agent exists at all times on all channels
  • Webhook Security: All incoming Meta webhooks are validated with the HMAC-SHA256 hub.signature_256 header

11. Children's Privacy

AUTOBIZ is a business-to-business platform. Our services are not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has submitted data through our platform, contact us at support@autobiz.lk and we will delete it promptly.

12. International Data Transfers

Your data may be processed and stored on servers outside your country of residence, including in regions where Meta's infrastructure is located. By using AUTOBIZ, you consent to this transfer. We ensure appropriate safeguards are in place (such as standard contractual clauses where applicable) to protect your data in accordance with this Privacy Policy regardless of where it is processed.

13. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Request your data in a machine-readable format
  • Objection: Object to certain types of data processing
  • Restriction: Request restriction of processing while a dispute is resolved

To exercise any of these rights, contact support@autobiz.lk. We will respond within 30 days.

14. Contact Us

For privacy-related questions, data requests, or compliance concerns:

  • Email: support@autobiz.lk
  • WhatsApp: 0729995959
  • Privacy Policy URL: https://autobiz.lk/privacy
  • Data Deletion URL: https://autobiz.lk/privacy (see Section 8)