Privacy Policy

GoChatly is independent of Meta, Facebook, Instagram, and WhatsApp. It is not owned, operated, or endorsed by Meta Platforms, Inc.

• Our role
• Information we collect
• Facebook, Instagram, and WhatsApp
• How we use information
• Who we share it with
• How long we keep it
• Security
• Your choices and deletion
• Cookies
• Contact

1. Our role

For information about a GoChatly account holder and their team, we are the controller. For messages, orders, and bookings about that business’s own customers, the business is the controller and we process the data on its instructions, only to provide the workspace they asked for.

2. Information we collect

Account and billing

• Name, email, phone number, role, business name, and business type. Passwords are stored only as a salted hash. One-time sign-in codes are kept only until they expire.
• Plan, balance, invoices, and payment status. Card and wallet credentials are handled by the payment processor. We do not store the full card or wallet number.

Workspace content

• Messages, attachments, comments, and metadata (time, channel, and sender id) from Facebook Messenger, Instagram, WhatsApp, and the business’s web chat.
• Customer details the conversation or an order contains, such as name, phone number, delivery address, and order history.
• Rulebook text, products, services, documents, links, and images the business uploads so its own assistant can answer from that material.

Usage

• IP address, browser and device type, pages used, and feature counts such as the number of AI replies, so we can run, secure, and bill the service.

3. Facebook, Instagram, and WhatsApp

A business connects a channel only when someone who manages that Page, Instagram professional account, or WhatsApp Business account starts Meta Login or WhatsApp Embedded Signup inside GoChatly. We request only the permissions needed to run the inbox they connect:

• pages_show_list. The business must choose which Facebook Page to connect. This permission lists only the Pages that the person manages.
• pages_manage_metadata. Message delivery needs a webhook on the selected Page. This permission subscribes that Page to message notifications.
• pages_messaging. The inbox has to receive customer messages and send the business’s replies on Messenger.
• pages_read_engagement. When the business chooses to train its own assistant on its public content, this permission reads that Page’s published posts and reels. It is not used to advertise.
• instagram_basic. Instagram messages arrive through the professional account linked to the Page. This permission identifies that account.
• instagram_manage_messages. The inbox has to receive and reply to that account’s Instagram direct messages.
• instagram_manage_comments. The business can read and reply to comments on its own Instagram account from the same inbox.
• whatsapp_business_management. WhatsApp Embedded Signup has to show the business’s own WhatsApp Business account and phone number so the business can connect them.
• whatsapp_business_messaging. The inbox has to receive and send WhatsApp messages for that connected number.

From those connections we receive and store:

• Page id and name, Instagram id and username, WhatsApp phone-number id, and WhatsApp Business account id.
• Access tokens, encrypted at rest, used only to send and receive messages and to keep the webhook subscription for that connection.
• The customer’s name, message text, attachments, timestamps, and message ids. On WhatsApp we also store the WhatsApp id as the customer phone number.
• Comment text the business’s Instagram account receives, when comment access is connected.
• When a chat starts from an ad or a link, a short referral label: ad id, title, source, reference, and time. We do not store ctwa_clid, the ad click URL, or the referrer URL.

We use this platform data only to provide the inbox, orders, and support tools the business turned on. We do not sell it. We do not use it to advertise to those people, to build audiences for other businesses, or to train a model that answers another workspace’s customers. Message text is sent to Google (Gemini) or OpenAI only through their API endpoints, and only to draft a reply for that conversation or to make an embedding for that workspace. Those API terms prohibit using that content to train their foundation models. Published posts are read only when the business syncs them into its own workspace.

Disconnecting a channel in GoChatly deletes the stored token and stops new messages from that Page, Instagram account, or WhatsApp number. Existing conversations stay in the workspace until the business deletes the workspace or a person asks us to delete their copy. Removing GoChatly from Facebook, Instagram, or WhatsApp settings revokes our access. Instructions for both cases are on the Data Deletion page.

4. How we use information

• Run the inbox, deliver and receive messages, and manage orders, bookings, and tickets.
• Turn the business’s own rulebook, catalog, and uploads into embeddings stored for that workspace, so its assistant can answer from that material.
• Send verification codes, billing notices, and service messages.
• Prevent abuse, debug failures, measure usage for the plan the business bought, and meet legal duties.

We do not sell personal information.

5. Who we share it with

• Meta, so messages can be delivered on Facebook, Instagram, and WhatsApp under Meta’s own terms.
• AI providers Google (Gemini) and OpenAI. Message text is sent only through their API endpoints, and only to draft a reply for that active conversation or to make an embedding for that workspace. Their API terms prohibit using, or training foundation models on, that content.
• Payment processors such as bKash, Nagad, and card processors, to take subscription and top-up payments.
• Courier services the business connects, such as Steadfast, Pathao, RedX, Paperfly, or CarryBee, and only the order details needed to book a parcel.
• Infrastructure providers that host the app, database, cache, email, SMS, and error monitoring.
• Authorities or advisers when the law requires it, or when it is needed to protect people or the service.
• A buyer of the business, if GoChatly is sold or merged, with notice to account holders.

People the business invites to its workspace can see the conversations and orders that their role allows. We do not give one business access to another business’s workspace.

6. How long we keep it

We keep workspace data while the account is active. When the owner requests deletion, the workspace is locked immediately. After we confirm the request we remove channel subscriptions, stored files, tokens, and workspace records. Deletion is completed within 30 days of receiving the request. We may keep invoices, payment records, and security logs for as long as Bangladesh tax or accounting law, or an open dispute, requires. Details and the request steps are on the Data Deletion page.

7. Security

Connections use encryption in transit. Passwords are hashed. Channel tokens are encrypted at rest. Each workspace is separated from the others, and staff see only what their role allows. No system is perfectly secure. Use a unique password and email support@gochatly.com if you suspect unauthorised access.

8. Your choices and deletion

You may ask us to:

• confirm what we hold about you and send a copy;
• correct information that is wrong;
• delete your information or close the workspace;
• stop optional processing that depends on a choice you can withdraw.

Account holders use Profile, then Delete workspace, or email privacy@gochatly.com. A person who only messaged a business on Facebook, Instagram, or WhatsApp should use the Data Deletion page. On that request, GoChatly directly and permanently deletes the platform data it holds for that person, including access tokens, message logs, and uploaded media. Deletion is completed within 30 days of receiving the request. You may complain to a regulator where you live.

9. Cookies

Essential cookies and local storage keep you signed in and remember the theme. A banner asks before any optional analytics or marketing preference is stored. That choice is kept in local storage under gochatly_cookie_consent. Rejecting optional cookies does not block the product. The language cookie NEXT_LOCALE remembers English or Bengali on the public site.

10. International transfers

We operate from Dhaka, Bangladesh. Meta, AI providers, and hosting providers may process data in other countries. Where the law requires a safeguard for that transfer, we use one.

11. Children

GoChatly is for businesses. It is not directed at anyone under 18. We do not knowingly collect their information. Email privacy@gochatly.com if you believe we have, and we will delete it.

12. Changes

We will post changes on this page and change the effective date. If a change is material, we will also email account holders or show a notice in the product.

13. Contact

Veldora Technologies
571, ECB Chattar, Manikdi, Dhaka Cantonment, Dhaka-1206.
Privacy: privacy@gochatly.com
Support: support@gochatly.com
Phone: +8801910806844