Privacy Policy

Last updated: June 26, 2025

This policy applies to the KokoBot platform and services available at kokobot.chat.

1. Introduction

KokoBot ("we", "our", "us") operates the AI-powered sales chatbot platform available at kokobot.chat. This Privacy Policy describes how we collect, use, store, and protect information when businesses and their customers use our services, including integrations with the Meta (Facebook) Messenger Platform, WhatsApp, Viber, and other messaging channels. By using KokoBot, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 From Facebook / Meta Messenger

  • Page-Scoped User ID (PSID): A unique identifier assigned by Facebook to each user who messages a connected Page. This is not the user's real Facebook ID and cannot be used to identify them across other apps or pages.
  • Display Name: The name shown on the user's Facebook profile, received when they initiate a conversation.
  • Message Content: The text, images, and attachments that users send to the business Page through Messenger.
  • Profile Locale: Language/region setting, used to respond in the appropriate language.
  • We do NOT collect email addresses, phone numbers, or any other personal profile data from Facebook unless the user explicitly provides it during a conversation.

2.2 From End Customers (via chatbot conversation)

  • Name, phone number, and delivery address — only when placing an order through the chatbot.
  • Order items and purchase history.
  • Appointment booking details (if the business uses the appointment feature).

2.3 From Business Owners (Shop Accounts)

  • Email address (used for login and communication).
  • Shop name, logo, and product catalog.
  • Channel connection credentials (Facebook Page access tokens, stored securely).
  • Billing information (handled by third-party payment processors — we do not store card numbers).

3. How We Use Information

  • To operate the AI chatbot and respond to customer messages on behalf of connected businesses.
  • To receive, process, and manage orders placed through the chatbot.
  • To provide business owners with conversation history, order management tools, and analytics dashboards.
  • To send broadcast promotional messages to customers who have explicitly opted in.
  • To schedule and manage customer appointments.
  • To improve the accuracy, performance, and safety of our AI models.
  • To send transactional notifications (e.g. order confirmations) to customers.
  • To comply with legal obligations and resolve disputes.

4. How We Share Information

We do not sell, rent, or trade your personal information to third parties. We share data only in the following limited cases:

  • With the Business Owner: Customer messages and order details are shared with the business whose Page the customer contacted. This is the core function of the service.
  • Service Providers: We use Supabase (database hosting), Google Gemini AI (AI response generation), DigitalOcean (cloud hosting and object storage), and Cloudflare (CDN/security). These providers process data only to the extent necessary to deliver their services and are bound by confidentiality agreements.
  • Meta Platforms: We use the Meta Messenger Platform API to send and receive messages. Meta's own privacy policy governs data on their platform.
  • Legal Requirements: We may disclose data if required by law, court order, or to protect the rights and safety of our users.

5. Facebook Data Usage Policy

KokoBot's use of information received from the Facebook Messenger Platform complies with Meta's Platform Policies. Specifically:

  • We access only the permissions necessary to deliver the messaging and order management service.
  • Facebook data (PSIDs, messages) is used solely to provide chatbot responses and order processing on behalf of the connected business Page.
  • We do not use Facebook user data for advertising or targeting purposes.
  • We do not transfer or sell Facebook user data to any third party.
  • We store Facebook data only for the retention periods described in Section 6.
  • Business owners can disconnect their Facebook Page at any time, which terminates our access to new data from that Page.

6. Data Retention

  • Conversation messages: Retained for up to 12 months from the date of the conversation.
  • Order data: Retained for up to 3 years for business record-keeping purposes.
  • Customer opt-in/subscription records: Retained for as long as the subscription is active, or until opt-out.
  • Business account data: Retained for the duration of the account and for 30 days after deletion.
  • You may request earlier deletion by contacting us at the address in Section 9.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information:

  • All data is stored in Supabase with row-level security (RLS) policies enforced at the database level.
  • All data transmission uses HTTPS/TLS encryption.
  • Facebook Page access tokens are encrypted at rest.
  • Access to production systems is restricted to authorized personnel only.
  • Regular security audits and dependency updates are performed.

8. Your Rights and Choices

  • Access: You may request a copy of your personal data we hold.
  • Correction: You may request correction of inaccurate data.
  • Deletion: You may request deletion of your personal data. We will comply within 30 days, subject to legal retention requirements.
  • Opt-out of Broadcasts: Reply "STOP" or "unsubscribe" to any broadcast message to opt out immediately.
  • Disconnect Facebook Page: Business owners can disconnect their Page from KokoBot at any time through the dashboard Settings.
  • To exercise any right, email us at: [email protected]

9. Children's Privacy

KokoBot is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly.

10. Cookies and Tracking

Our dashboard application uses session cookies to maintain your logged-in state. We do not use third-party advertising cookies or cross-site tracking technologies. Public-facing pages may use analytics to measure page views (aggregated, non-identifiable data only).

11. International Data Transfers

Your information may be stored and processed on servers located in Singapore and the United States (DigitalOcean and Supabase infrastructure). By using KokoBot, you consent to the transfer of information to these locations. We ensure appropriate safeguards are in place for any such transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify business owners via email and post a notice on the dashboard. The "Last Updated" date at the top of this page will be revised. Continued use of KokoBot after changes constitutes acceptance of the updated policy.

13. Contact Us

💬 KokoBot Demo