Privacy Policy

Our customers — businesses that create a workspace, sign in, and use the product. If that is you, we hold your account details directly.

Their customers — people who message those businesses on WhatsApp, Messenger, or Instagram. We process this data on the business’s behalf, as their service provider. If you have messaged a business that uses Connect AIOS and want your data corrected or deleted, you can contact that business or reach us directly (see “Your rights” below).

• Account data: your name, email address, business name, and sign-in credentials (passwords are handled by our authentication provider and are never visible to us).
• Contact and conversation data: names, phone numbers, social handles, and the content of messages exchanged between a business and its customers through connected channels. This reaches us through the official Meta Platforms APIs (WhatsApp Business Platform, Messenger, and Instagram messaging) after the business connects those channels.
• Campaign data: the audiences, templates, and delivery results of marketing campaigns a business runs through the platform.
• Connected social account data: if a business connects a TikTok account, TikTok gives us that account’s public profile (display name, username, avatar, verification status) and account-level stats (follower, likes, and video counts), plus the business’s own post performance (view, like, comment, and share counts on each post). This comes through TikTok’s Login Kit and Display API, only after the business completes TikTok’s own consent screen, and is shown only to the business that connected the account — it is not shared with other workspaces and is not used to train any AI model. A business can revoke this access at any time from TikTok’s own account settings or from ours.
• Usage and log data: standard technical records (timestamps, IP addresses, errors) that keep the service reliable and secure.

• To run the service: routing messages, storing conversations, sending campaigns.
• To power AI features: drafting replies, summarising conversations, and answering business questions. Message content is processed by OpenAI acting as our AI processor. Under OpenAI’s API terms, data sent through the API is not used to train their models.
• To provide support when you ask for it.
• To keep the platform secure and prevent abuse.

We never sell your data. Not account data, not contact data, not message content. We also do not use one business’s data to benefit another.

Every business gets its own tenant. Data is stored in PostgreSQL (hosted by Supabase) with row-level security enforced by the database itself, so one workspace’s records are isolated from every other workspace’s at the storage layer — not just in application code.

We share data only with the service providers we need to operate, and only for the purposes above:

• Supabase — database hosting and authentication.
• Cloudflare — application hosting and receiving incoming channel messages (webhooks).
• Meta Platforms — the messaging channels themselves. Data received from Meta’s APIs is used only to provide the service and in accordance with Meta’s Platform Terms and Developer Policies.
• TikTok — if a business connects a TikTok account, we receive that account’s profile and post performance data via TikTok’s APIs, used only to display it to the business that connected it and in accordance with TikTok’s Developer Terms of Service and Developer Policies.
• OpenAI — AI processing of message content, as described above.

We may also disclose data if the law requires it, or as part of a merger or acquisition — in which case this policy continues to apply to data collected before the change.

Data is processed on infrastructure that may be located outside Trinidad and Tobago, including in the United States. We keep your data while your workspace is active. When a workspace is deleted, its tenant data is removed from production systems, with residual copies in encrypted backups expiring on their normal rotation schedule.

You can access, correct, export, or delete your data. Businesses can manage most of this in the product; for anything else — including full account deletion, or a request from an end customer of one of our businesses — email dpo@connect-ltd.com and we will respond within 30 days. Deletion requests remove personal data from production systems; we may retain minimal records where the law requires it (for example, billing records).

Data is encrypted in transit, access is limited to what each role needs, secrets are kept in managed secret stores rather than code, and tenant isolation is enforced at the database layer. No system is perfectly secure, but if a breach affects your data we will notify you without undue delay.

Connect AIOS is a business tool and is not directed at children under 18. We do not knowingly collect data from children.

If we change this policy in a way that matters, we will update the effective date above and notify workspace owners by email or in the product before the change takes effect.

Kaology LLC, United States.
Local support: Connect Limited, Trinidad and Tobago.
Privacy and data requests: dpo@connect-ltd.com