Privacy Policy

From Customers (via WhatsApp)

When a customer messages a business through TriniBot on WhatsApp, we may collect and process the following:

• Name (if provided during the conversation);
• Phone number;
• Message content, including questions and requests;
• Media metadata for supported WhatsApp messages, such as voice notes, images, documents, filenames, captions, and WhatsApp media identifiers;
• If voice-note transcription is enabled by the business, audio may be retrieved from WhatsApp and processed by ElevenLabs Scribe speech-to-text; the resulting transcript, provider/model metadata, and transcription status may be stored with the business conversation;
• Payment references and customer-submitted proof of payment when used for a configured deposit workflow;
• Booking information, such as requested dates, times, and service selections;
• Appointment status and history.

From Businesses

When a business sets up TriniBot, we may collect:

• Business name, category, location, description, public contact details, and optional website or business social-page URL;
• Services, pricing, operating hours, and other information the business chooses to publish on its hosted TriniBot Business Profile;
• WhatsApp Business account credentials and configuration details;
• Services offered, including pricing and duration;
• Operating hours and availability;
• Business policies, including deposit requirements and FAQs.
• Connected Google account email address, if Google Calendar is enabled;
• Selected Google Calendar identifier and display name;
• Google OAuth access and refresh credentials stored securely on the server to maintain the authorised Calendar connection;
• Calendar free/busy availability results and Google Calendar event identifiers created for TriniBot appointments.
• Subscription plan preferences, activation and renewal dates, AI conversation session counts, and ElevenLabs transcription duration used to measure subscribed usage and operate fair-use controls.

We use the information we collect to:

• Facilitate bookings and appointment management between businesses and their customers;
• Provide automated customer support and replies through WhatsApp;
• Send booking confirmations, appointment reminders, incomplete-booking follow-ups, and other communications enabled by the business, subject to WhatsApp messaging rules and customer opt-out settings;
• Present customer conversations, payment-review information, operational metrics, and customer journey stages to the relevant business owner;
• Operate a public TriniBot-hosted Business Profile for an activated business when that feature is enabled;
• Provide the business with a public profile URL that may be used for customer sharing or third-party business onboarding processes;
• Meter AI-assisted customer chat sessions and voice processing to display usage, manage subscription allowances, and detect unusual consumption;
• Operate, maintain, and improve the TriniBot platform;
• Comply with applicable legal obligations.

TriniBot uses the Meta WhatsApp Business Platform to send and receive messages between businesses and their customers. When you message a business through TriniBot, your messages are processed by Meta Platforms, Inc. ("Meta") as part of the WhatsApp Business Platform. Your use of WhatsApp is also subject to WhatsApp's Terms of Service and Privacy Policy. We encourage you to review Meta's privacy practices at whatsapp.com/legal/privacy-policy.

Google Calendar is an optional integration that a business owner may choose to connect. When enabled, TriniBot requests only the Google Calendar permissions needed to provide the selected scheduling features.

• List calendars available to the connected Google account so the business can choose which calendar TriniBot should use;
• Check free/busy availability to prevent bookings from being offered during existing busy periods;
• Create, update, and cancel TriniBot appointment events on the selected calendar.

For availability checks, TriniBot uses Google's free/busy service rather than downloading the contents of existing calendar events. TriniBot stores the connected account email, the selected calendar identifier and name, and server-side OAuth credentials needed to keep the authorised connection active. These credentials are not exposed to customers or other businesses using TriniBot.

Google Calendar data is used only to provide the calendar connection and scheduling features requested by the business. We do not sell Google user data or use Google Calendar data for advertising, marketing, or user profiling. A business may disconnect Google Calendar from TriniBot at any time; when disconnected, TriniBot removes its stored OAuth credential and stops future Calendar access.

The use of raw or derived Google user data received through Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that data to create, train, or improve foundational or generalized artificial intelligence or machine learning models.

Google Calendar information is handled separately from TriniBot's conversational AI services. Our Google Calendar integration uses server-side API requests to list a connected business's calendars, check busy time ranges, and manage TriniBot appointment events. Existing Google Calendar event titles, descriptions, attendees, and full event contents are not downloaded for AI processing. Google OAuth tokens, calendar-list responses, and free/busy API responses are not included in prompts to TriniBot's AI intent-detection service or sent to ElevenLabs for voice transcription.

TriniBot uses Base44's managed AI integration solely to interpret WhatsApp customer enquiries using the customer's message, the business's service information and the WhatsApp conversation stage. When the business enables voice-note understanding, ElevenLabs Scribe processes WhatsApp audio for transcription; it does not receive Google Calendar API data from this integration. Calendar free/busy results are evaluated by application scheduling logic, not supplied to a model.

We do not sell your information to any third parties. We may share information only in the following circumstances:

• Public Business Profiles: When a hosted Business Profile is active, selected business information may be publicly accessible without login, including the business name, category, location, description, public contact number, services, pricing, operating hours, and any website link supplied by the business. Private account credentials, owner login information, payment credentials, WhatsApp API tokens, and customer conversation data are not published on these pages.
• Service providers: We engage trusted service providers that assist us in operating the platform, such as hosting, data storage, and messaging infrastructure. These providers are bound by confidentiality obligations and are only permitted to use information as necessary to provide services to us.
• Meta: As described above, message data is processed through the Meta WhatsApp Business Platform.
• Google: If a business connects Google Calendar, TriniBot exchanges the minimum necessary calendar information with Google Calendar APIs to list calendars, check availability, and create, update, or cancel TriniBot appointment events.
• AI processing: Base44's managed AI integration processes relevant WhatsApp message text and business service details to identify customer intent. If enabled, ElevenLabs Scribe transcribes customer WhatsApp voice notes. Google Calendar API data is not submitted to these AI integrations for model inference or training.
• Legal compliance: We may disclose information where required by law, court order, or to protect our rights and the safety of others.

We implement reasonable technical and organisational security measures designed to protect information against unauthorised access, loss, misuse, or alteration. These measures include access controls, encrypted credentials, and secure infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain information for as long as necessary to provide the TriniBot service to businesses and their customers, and to comply with legal or accounting requirements. Conversation history, booking records, and related data may be retained while a business remains active on the platform. When information is no longer required, or when a business closes its account, we may delete or anonymise the associated data in accordance with our retention practices. Google OAuth credentials are retained only while the Google Calendar connection remains authorised and are removed from TriniBot when the business disconnects that integration. If a hosted Business Profile is disabled or the business leaves TriniBot, the public page stops displaying the business information. The profile slug may remain reserved so that a URL previously associated with one business is not reassigned to another business.

You may have the right to request access to, correction of, or deletion of personal information we hold about you. To make such a request, or if you have questions about how your information is handled, you may contact us using the details below. We will respond to verified requests within a reasonable timeframe and in accordance with applicable law. Business owners can also disconnect Google Calendar from TriniBot at any time and may separately revoke TriniBot's Google access through their Google Account permissions.

TriniBot is not intended for use by individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

If you have any questions or concerns about this Privacy Policy or your personal information, please contact us: