HelloChat Privacy Policy

Last updated: 3 November 2026

HelloChat is a service that answers a business's customers on its Facebook Page (Messenger and post comments) with an AI assistant, takes orders, books appointments and collects enquiries for the business, and hands conversations to the business's team. HelloChat is operated by Maple Service Solution Limited, 38 (3rd Floor), Shah Makhdum Avenue, Sector 13, Uttara, Dhaka-1230, Bangladesh ("we"), which also makes HelloKhata. This policy explains what personal data HelloChat handles, why, and your choices. Contact: info@mapleitfirm.com.

This policy covers HelloChat. Our general HelloKhata Privacy Policy covers our other apps and website. Where the two differ, this policy applies to HelloChat.

Two kinds of people, two roles

• Business users (owners and their team who use the HelloChat dashboard). For their account data we decide how it is used (we are the controller).
• People who message or comment on a business's Facebook Page ("customers"). We process their messages on behalf of that business, following its instructions (we are its processor or service provider). The business is responsible for its own privacy notice to its customers.

What we collect

From business users

• Name, email address and password (stored only as a secure hash), or your Google account name and email if you log in with Google.
• Your workspace and business settings: business description, policies, knowledge base, product catalog, team members and roles.
• Billing records: credit balance, usage, and top-up details you submit (amount, payment method, transaction ID and the mobile number you paid from).
• Login sessions (IP address and browser type) and a session cookie needed to keep you logged in. We use no advertising or analytics trackers.

From Facebook, when a business connects its Page

• The Page's ID and name, a Page access token (stored encrypted), the permissions granted, and the Facebook user ID and name of the person who connected it.

About customers of the business

• The page-scoped ID Facebook gives each person who messages the Page, and the name shown on their comments.
• Message and comment text, and attachments they send (such as photos and voice messages), together with the text our system derives from them (a description of an image, a transcript of a voice message).
• Details they choose to share in the conversation, for example a name, phone number and delivery address for an order, or information about their own business when they ask about a product.

How we use it

• To provide the service: write and send replies, answer comments, place orders, book appointments and record enquiries for the business, and show the conversation to the business's team.
• To keep the service secure and working: preventing abuse, fixing problems, and keeping each business's data separate from every other's.
• For billing and support of business users, and to send them service emails (password resets, invitations, low-credit and connection alerts).

We do not sell personal data, do not use it for advertising, and do not use one business's customer data for another business. Data received from Facebook is used only as allowed by Meta's Platform Terms.

AI processing

To write replies, the conversation and the business's settings are sent to Google's Gemini API, which generates the answer. Replies are produced automatically and can contain mistakes; businesses can review conversations and take over at any time, and the AI hands a conversation to the business's team when it cannot help.

Who else handles the data

We use these service providers, only to run HelloChat:

• Google LLC (Gemini API): generating AI replies and reading images and voice messages.
• Meta Platforms (Facebook Messenger platform): receiving and sending messages and comments.
• Resend, Inc.: sending service emails.
• [Hosting provider, country]: the servers that run HelloChat and store its data.

We may disclose data if required by law, and only the minimum necessary.

How long we keep it

• Business account data: while the account is active, and deleted on request.
• Conversations, orders and enquiries: while the business's account is active, or until the business or the person asks us to delete them.
• Page access tokens: deleted as soon as a Page is disconnected or the person who connected it removes the app on Facebook.
• Backups: kept for 14 days, then deleted.

Your choices and rights

• Business users can see and change their data in the dashboard, and can ask us to delete their account by emailing info@mapleitfirm.com.
• Anyone can ask what we hold about them, or ask for it to be corrected or deleted, by emailing info@mapleitfirm.com. Customers of a business can also ask the business directly.
• If you connected a Page with Facebook, removing HelloChat in your Facebook settings disconnects it and deletes its tokens. See Data deletion.

Security

Data is sent over HTTPS, Page tokens are encrypted at rest, each business's data is isolated at the database level, and access to the system is limited to the people who run it. Support access to a business's workspace is time-limited and recorded.

Children

HelloChat is a service for businesses and is not directed at children under 13.

Changes

We will post changes on this page and update the date above. Significant changes will be emailed to business users.

Contact

Maple Service Solution Limited, 38 (3rd Floor), Shah Makhdum Avenue, Sector 13, Uttara, Dhaka-1230, Bangladesh. Email: info@mapleitfirm.com.