Privacy Policy

EasyManage ("we", "our", "us") operates a business management platform that integrates AI assistance, WhatsApp Business API messaging, email communication, and a REST API for mobile and third-party integrations.

This Privacy Policy explains what personal data we collect, why we collect it, how it is stored and protected, and your rights as a user or end-customer interacting with businesses that use our platform.

Our platform integrates with the WhatsApp Business API (via Meta/Facebook) to allow businesses to communicate with their customers and employees through WhatsApp.

What We Process via WhatsApp

• Incoming and outgoing WhatsApp messages (text, audio, images, documents)
• Sender phone numbers and WhatsApp profile names
• Routing decisions based on your configured workflow
• Session state and conversation history per user
• Verification tokens exchanged during webhook handshake

How It Works

Each company configures its own WhatsApp Phone Number, Access Token, and Webhook on Meta's Developer Console. Incoming messages are routed to our webhook endpoint (/api/v1/whatsapp/webhook?company=...) using signature verification (App Secret). Messages may be processed by our AI assistant if the user is routed to the AI agent node.

Data Retention for WhatsApp

WhatsApp messages are retained for as long as the company account is active or until explicitly deleted by a company administrator. Debug webhook logs are temporary and can be cleared from the admin panel at any time.

Our platform includes an AI-powered assistant (powered by Google Gemini models and optionally OpenAI TTS) available via the web dashboard, mobile API, and WhatsApp channel.

What the AI Processes

• Text messages and prompts you send to the assistant
• Images, documents, and voice files you upload
• Chat history for context continuity within a session
• Generated audio responses (when TTS is enabled)
• Business-specific context (company name, user role, etc.)

Third-Party AI Providers

Your prompts may be transmitted to Google's Gemini API or OpenAI's API for processing. These providers have their own privacy policies that govern data handling:

• Google Privacy Policy
• OpenAI Privacy Policy

AI Logs

AI interaction logs are available to company administrators for debugging. These logs can be viewed and cleared from the AI Settings panel at any time.

We use email for the following purposes within the platform:

• Transactional emails: Account registration, password resets, subscription confirmations, and invoices.
• Internal messaging notifications: When a user receives an internal message or conversation invite.
• Mail Client module: If your company uses our integrated mail client, emails sent and received are processed through your configured IMAP/SMTP server. We do not store the content of those emails on our servers beyond your session.
• Email Content templates: Reusable email templates created by company administrators are stored and associated with the company account.

Our platform exposes a REST API (/api/v1/...) secured via Laravel Sanctum tokens for mobile applications and authorized third-party integrations.

API Data Handling

• API tokens are issued per user and scoped to their permissions
• All API requests are authenticated and logged for security auditing
• Tokens can be revoked at any time from the Security Settings page
• API access must be explicitly granted by a company administrator

Public Endpoints

A small number of endpoints are publicly accessible without authentication (e.g., scanner device configuration by token, WhatsApp webhook). These are designed with minimal data exposure and are protected by other security mechanisms (signed tokens, HMAC signatures).

We implement industry-standard security measures to protect your personal data:

• Encryption at rest: Sensitive credentials (WhatsApp access tokens, app secrets, API keys) are encrypted before storage.
• HTTPS/TLS: All data in transit is encrypted using SSL/TLS.
• Two-Factor Authentication (2FA): Supported via TOTP for all user accounts.
• Device session management: Users can view and revoke active sessions from any device.
• Webhook signature verification: All incoming WhatsApp webhook payloads are verified using HMAC-SHA256.
• Role-based access control: All features are permission-gated based on user roles and group assignments.

We use the following cookies and browser storage mechanisms:

We do not use advertising or tracking cookies.

Our platform integrates with the following third-party services. Each is subject to its own privacy policy:

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right of Rectification: Correct inaccurate or incomplete data from your profile settings.
• Right of Erasure: Request deletion of your account and associated personal data.
• Right to Restrict Processing: Ask us to limit how we use your data.
• Right to Data Portability: Receive your data in a portable, machine-readable format.
• Right to Object: Object to certain types of processing, including automated decision-making.
• WhatsApp Data Reset: Company administrators can reset WhatsApp session data for individual users from the user management panel.

We retain personal data for as long as necessary to provide the service and comply with legal obligations:

• Account data: Retained while the account is active. Deleted within 30 days of account closure request.
• WhatsApp messages: Retained as long as the company account is active unless deleted by the administrator.
• AI chat history: Retained per session. Administrators can clear AI logs at any time.
• Webhook debug logs: Temporary — cleared on demand or automatically after 30 days.
• Payment records: Retained for 7 years as required by financial regulations.
• Security & audit logs: Retained for 90 days.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Application: EasyManage
• Email: privacy{{ parse_url(config('app.url'), PHP_URL_HOST) }}
• Platform: http://localhost:8000

We will respond to all legitimate requests within 30 days. For complex requests, we may need up to 90 days, in which case we will notify you of the extension.