Privacy Policy

1. Scope & Applicability

This Privacy Policy operates in accordance with:

• Information Technology Act, 2000
• IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDP Act)

2. Information We Collect

Account information

• Name, email address, organization name
• Account identifiers and authentication data

Usage & technical data

• IP address, device and browser metadata
• Logs, timestamps, feature usage

Conversation data

• Chat messages, on the web and on WhatsApp
• Voice call recordings or transcripts, where a Business Customer has enabled recording
• AI-generated responses

3. WhatsApp Business Platform & Meta Data Processing

ThinnestAI is a Meta Tech Provider, integrating with the WhatsApp Business Platform so that Business Customers can send and receive WhatsApp messages through our AI chat agents. Embedded Signup — connecting a Business Customer's own WhatsApp Business Account (WABA) to our platform — runs on this application.

As part of this integration, we process the following on a Business Customer's behalf:

• The WhatsApp phone number of the person messaging the Business Customer
• Message content — text, media, and interactive replies — exchanged with the Business Customer's WhatsApp number
• Message metadata, including timestamps and delivery/read status
• The Business Customer's WABA profile information and approved message templates
• Access tokens issued by Meta that authorize us to send and receive messages on the Business Customer's behalf

This data is used solely to operate the AI agent answering on the Business Customer's behalf, and to give that Business Customer visibility into their own conversations inside our dashboard. For this data, ThinnestAI acts as a processor / technology provider — the Business Customer remains the data controller for their own end-customers' conversations. Meta's own handling of data that passes through the WhatsApp Business Platform is governed separately by Meta's Privacy Policy and the WhatsApp Business Solution Terms.

WhatsApp conversation data is retained under the same practices described in Section 6 below, and can be deleted on request — see our Data Deletion Instructions.

4. Purpose of Data Processing

We process personal data to:

• Provide and operate AI chat and voice services, including on WhatsApp
• Manage billing, usage, and support
• Improve system performance and security
• Comply with legal and regulatory obligations
• Improve our AI models and train our systems, as described below

For Business Customers on our Pay as you go plan, voice call recordings and transcripts may be used by us for model training and internal training purposes. For Business Customers on our Scale plan (and above), call recordings and transcripts are never used for this purpose. A Business Customer that does not want its calls used this way can move to the Scale plan.

5. Data Sharing & Subprocessors

We may share data with trusted third-party vendors, including:

• Meta — as required to operate the WhatsApp Business Platform integration
• LLM providers — OpenAI, Anthropic, Google, and others, depending on what a Business Customer's agent is configured to use
• Speech-to-text and text-to-speech providers, for voice agents
• Telephony and WebRTC providers, for voice calls
• Cloud infrastructure — Google Cloud Platform
• Payment processors — Razorpay

All vendors are bound by contractual confidentiality and security obligations.

6. Data Retention

• Personal and conversation data is retained only as long as necessary to provide the Service or meet legal requirements.
• You may request deletion of your data — see Section 9 and our Data Deletion Instructions.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards, including encryption in transit and access controls.

No system is completely secure; use of the Services is at your own risk.

8. Data Residency

Our infrastructure runs on Google Cloud Platform. Where a Business Customer selects an Indian AI provider, voice and conversation data is processed and stored within India. Where a Business Customer selects an international provider, data may be processed in that provider's data centers outside India, subject to the provider's own policies. Payment data is processed by Razorpay in accordance with RBI data localization requirements.

9. User Rights

Subject to applicable law, you may:

• Request access to your personal data
• Request correction or erasure
• Withdraw consent where applicable

Requests can be sent to hello@thinnest.ai, or via our Data Deletion Instructions.

10. Cookies

We use cookies and similar technologies to maintain sessions, analyze usage, and improve performance. Disabling cookies may impact functionality.

11. Children's Privacy

ThinnestAI does not knowingly collect personal data from individuals under 18 years of age.

12. Policy Updates

We may update this Privacy Policy from time to time. Continued use of the Services constitutes acceptance of the updated policy.

13. Contact

For privacy or data-related concerns: hello@thinnest.ai