Biznes Chat — Privacy Policy

1. Introduction

Biznes Chat is a mobile app and server for businesses that sell through Instagram. A business owner connects the business's Instagram professional account. The business's team then reads and answers Instagram direct messages in the app. Optionally, an AI assistant answers customers using only the business's own catalog and business information, and passes the conversation to a person when it cannot answer reliably.

This policy concerns two groups of people:

• App users: business owners and their team members (operators, viewers) who sign in to the app.
• Instagram customers: people who send direct messages to a business that uses Biznes Chat. They do not use the app; their messages reach Biznes Chat through Meta.

2. Information We Process

2.1 App users

• Account: email address, full name (if provided) and a user id. Sign-in uses email and password through Supabase Authentication; passwords are handled by Supabase and are not stored by our server.
• Business membership: the business(es) a user belongs to and their role (owner, operator, viewer).
• On the phone: the sign-in session is kept in the device's secure storage.

2.2 Business information entered by the business

• Business profile: name, category, description, phone, address, working hours, delivery terms and payment terms.
• Answers and style: frequently asked questions with answers, a tone/style note for the AI assistant, and an optional fallback message.
• Catalog: products with name, price, currency, category, description, availability, variants and image links.
• AI settings: auto-reply on/off, confidence threshold and tone.

2.3 Instagram customers' messages

When a customer writes to a connected business account, Meta sends the message to our server. We store:

• the customer's Instagram-scoped id, an identifier Meta assigns for that business. We do not request the customer's name, username or profile picture from Meta; customers appear in the app as "Instagram foydalanuvchisi";
• the message text, its time, who sent it (customer, a team member, or the AI assistant), delivery status, and the types of any attachments. Attachment files are not downloaded;
• the notification received from Meta for each message, as Meta sent it (it can include Meta-hosted links to attachments). It is used to process each message exactly once and for troubleshooting;
• conversation state: for example handled by the AI, waiting for a person, closed, unread count, and the reason a conversation was passed to a person.

Replies written by the business's team, and replies generated by the AI assistant, are stored the same way. Replies the business sends directly from the Instagram app may also be recorded.

3. Instagram / Meta Integration

• Connecting: the business owner signs in to Instagram in the phone's browser and approves the permissions instagram_business_basic and instagram_business_manage_messages. Biznes Chat never sees the Instagram password.
• What we keep: the business's Instagram professional account id and username, the connection status, the connection time and token expiry date, and short error codes.
• Access token: the token Meta issues for the account is stored encrypted (AES-256-GCM) with a key held only on the server. It is used only to send replies and to renew the token, is never shown in the app and is never written to logs.
• Token renewal: the token is valid for a limited time (about 60 days). Our server asks Meta to renew it shortly before it expires. If Meta refuses, the connection is marked "needs reconnecting".
• Receiving messages: our server subscribes the connected account to Meta's message notifications and accepts a notification only if it carries a valid Meta signature.
• Sending replies: replies are sent through Meta's Instagram API, and only within the period in which Instagram allows a business to answer a customer (24 hours after the customer's last message).

4. AI Processing (Google Gemini)

The AI assistant works only when the business owner has turned on AI auto-reply and the operator has configured an AI provider. In that case, for each new customer message, Biznes Chat sends one request to Google's Gemini API containing:

• the business profile (name, category, description, phone, address, working hours, delivery and payment terms), the frequently asked questions and the owner's style note;
• catalog data: the whole catalog when it is small, otherwise only the products that match the question (name, category, price, currency, availability, description, variants);
• the text of up to the last 10 messages of that conversation, each marked only as "customer" or "business", and the new message.

The request does not contain the customer's Instagram id, any names of customers or team members, access tokens, or other businesses' data. Our server checks every AI answer against the business's own data before sending it. Answers that are uncertain or not supported by that data are not sent, and the conversation is passed to a person.

Biznes Chat currently uses Google's free (unpaid) Gemini API tier, and Google processes these requests under the Gemini API terms. Under those terms, Google may use content sent to unpaid services, including the requests described above, to provide, improve and develop its products and services, and human reviewers may read it. Please do not send sensitive personal information (for example passport or bank card numbers) in messages to a business that uses AI auto-reply.

5. How We Use Information

• To let a business receive and answer its Instagram messages in one place.
• To let the AI assistant answer customers from the business's own information, when the business turns it on.
• To keep accounts secure: sign-in, roles, and separation between businesses.
• To operate, troubleshoot and protect the service, for example to avoid processing or sending a message twice.

We do not sell personal information, show advertising, use customers' messages for marketing, or train AI models with this data ourselves.

6. Data Storage and Security

• The server runs on Railway and the database on Supabase. Both are currently located in the Singapore (Asia-Pacific) region; this describes the present setup and is not a data-residency commitment.
• All connections use HTTPS.
• Instagram access tokens are encrypted at rest and bound to their business.
• Each business's data is kept separate in the database, and the server checks the user's membership and role on every request.
• Server logs contain request ids, paths, status codes and error codes. They do not contain passwords, tokens or message text.

7. Data Retention

• Business information, conversations and messages are kept while the business uses Biznes Chat. There is currently no automatic deletion period; data is deleted on request (section 9).
• The Instagram access token is erased immediately when Instagram is disconnected (section 8).
• The single-use records created while connecting Instagram become unusable after 10 minutes. They are not deleted automatically, and they contain no token.
• Server logs are kept by our hosting provider according to its log-retention settings.

8. Disconnecting Instagram

• The business owner can disconnect Instagram in the app (Settings → Instagram → "Uzish"). The stored access token is erased immediately and nothing more can be sent for that account.
• Existing conversations and messages are not deleted by disconnecting; they remain until deletion is requested.
• Disconnecting in the app does not remove Biznes Chat's access on Instagram. Until the account owner removes it in Instagram's settings, Meta may continue to send new message notifications. These are recorded as ignored (not shown in the app and not answered), together with their content, until deletion is requested.

9. Data Deletion Requests

Deleting an account, a business or conversations is not yet available as a button in the app, and Biznes Chat does not implement Meta's automatic data-deletion callback. Deletion is handled on request as described in the Data Deletion Instructions. Instagram customers may also ask for their messages to be deleted.

10. Third-Party Services

11. Children's Privacy

Biznes Chat is a tool for businesses and is not directed to children.

12. Changes to This Policy

We will update this policy when the service changes and will show the new effective date at the top of this page.

13. Contact

Questions and requests: yahyogupamov@gmail.com

14. Operator

Biznes Chat is operated by Yahyo, an individual developer based in Kokand, Uzbekistan. For questions or complaints about how your information is handled, write to yahyogupamov@gmail.com.

Qisqacha (o'zbekcha)

Biznes Chat — bizneslar Instagram Direct xabarlarini bitta ilovada o'qishi va javob berishi uchun xizmat. Ixtiyoriy ravishda AI faqat biznesning o'z katalogi va ma'lumotlari asosida javob beradi.

• Saqlanadi:
  • ilova foydalanuvchisining emaili va ismi;
  • biznes ma'lumotlari va katalog;
  • ulangan Instagram akkaunt id'si va username'i;
  • Instagram tokeni (shifrlangan holda);
  • mijozlar xabarlari va mijozning Instagram ichki id'si (ismi va rasmi olinmaydi).
• AI (Google Gemini): faqat AI yoqilgan bo'lsa ishlatiladi. Unga biznes ma'lumotlari va suhbatning oxirgi xabarlari yuboriladi; mijoz id'si va token yuborilmaydi. Hozir Gemini'ning bepul rejasi ishlatiladi: Google bu so'rovlardan o'z xizmatlarini yaxshilash uchun foydalanishi mumkin.
• Instagram'ni uzish: token darhol o'chiriladi. Eski suhbatlar esa so'rov bo'yicha o'chiriladi.
• O'chirish so'rovi: yahyogupamov@gmail.com