Privacy Policy

1. Who we are

TorbChat AI (operated by AIM2BOOM, "TorbChat AI", "we", "us") is a software platform that lets businesses ("clients") run an AI-assisted assistant on messaging channels such as Facebook Messenger, Telegram and website web chat. For the customer conversations a client handles through TorbChat AI, the client is the controller of that data and TorbChat AI acts as its service provider (processor). For client account and billing information, and for the operation and security of the platform itself, TorbChat AI is the controller.

2. Data we collect

• Account data — business name, the name, email address and phone number of the people who sign up, hashed passwords, or, if you use Google sign-in, the basic profile details Google shares with us (name, email).
• Business content — information a client provides to configure their assistant: business details, products, services, prices, payment instructions, uploaded documents and knowledge-base content, and personality/tone settings.
• Usage and technical data — connection status, message counts, analytics events, audit logs, IP address, browser type and error logs used to operate, secure and support the service.

3. Facebook / Meta account and Page data

When a client connects a Facebook Page through Facebook Login (or, for platform administrators, a manually supplied token), we receive and store only what is needed to run the connection:

• The Page ID and Page name, and the Page Access Token (stored encrypted) that authorizes TorbChat AI to send and receive messages for that Page.
• The list of Pages the logged-in Facebook user manages (requested with the pages_show_list permission) so the user can choose which Page to connect.
• The permissions requested are limited to Messenger messaging and webhook subscription for the chosen Page (such as pages_messaging and pages_manage_metadata). We do not post to your Page, and we do not access your personal Facebook profile, friends or timeline.

Data received from Meta is used only to provide the Messenger integration to the client who connected the Page, in line with the Meta Platform Terms and Developer Policies. We do not sell it, use it for advertising, or share it with data brokers.

4. Messenger message data

When a customer messages a connected Page, Meta delivers the message to us through a webhook. We process and store the Page-Scoped ID (PSID), the customer's display name where Meta provides it, the message text, attachments (images, audio, files) and timestamps, together with the replies sent by the AI assistant or by the client's staff. This conversation history is shown only to the client that owns the Page and its authorized team members.

5. Customer information

Besides messages, a conversation may contain details customers choose to share with a business, such as their name, phone number, delivery address, order details and payment confirmation (for example a screenshot of a transfer). Customer records are created per client and are never visible to other clients. Customers should avoid sending sensitive information (such as government ID numbers, card numbers or health data) in chat.

6. How we use data

• To deliver, receive and reply to messages on connected channels, and to show conversation history, orders and customer records to the client.
• To maintain channel connections (for example webhook subscriptions and token validity checks).
• To generate AI replies grounded in the client's own business information, and to let staff take over a conversation.
• To provide analytics, notifications and broadcasts that the client has requested.
• To secure the platform, prevent abuse, debug problems and provide support.
• To comply with legal obligations. We do not sell personal data and do not use customer conversations to train our own models.

7. AI processing

To produce replies, relevant parts of a conversation, together with the client's business information and knowledge base, are sent to a third-party AI model provider (currently Google Gemini) for processing. Voice messages may be transcribed, and spoken replies may be generated, by speech providers. AI output may be inaccurate, and clients can review conversations and take over from the assistant at any time. Where available, we use provider settings and agreements that prevent customer content from being used to train the provider's general models; please see the provider's own terms for details.

8. Data storage and security

Data is stored on servers we control or rent from our hosting provider. Access tokens and API credentials are stored encrypted, passwords are hashed, traffic is protected with HTTPS/TLS, and access is restricted by role so that each client can only reach its own workspace data. Uploaded files are kept in private storage that requires an authorized login. No system is perfectly secure; if we become aware of a breach affecting your data we will notify affected clients as required by law.

9. Third-party service providers

We share data only with providers needed to run the service, each limited to its purpose:

• Meta Platforms (Facebook Login, Messenger Platform) — channel connection and message delivery.
• Telegram — delivery for clients that connect a Telegram bot.
• Google — Gemini AI processing and optional Google sign-in.
• Speech providers (such as ElevenLabs or a self-hosted voice model) — voice transcription and text-to-speech where a client enables voice.
• Hosting, email and infrastructure providers — storing data and sending service emails.

We may also disclose data when required by law or to protect our rights, users or the public, or in connection with a merger or sale of the business.

10. Data retention

We keep account and conversation data while the client's account is active so the service works. Disconnecting a Facebook Page deletes its stored Page Access Token immediately. When a client account is deleted, its workspace data (customers, conversations, messages, uploaded files and settings) is removed, and remaining backups and logs are purged within 30 days. We may keep limited records longer where required for legal, tax, security or fraud-prevention purposes. Clients may also delete individual conversations, documents and customer records at any time.

11. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. If you are a customer of a business that uses TorbChat AI, please contact that business first, as it controls your conversation data; we will assist it in responding. You may also contact us directly using the details below, and you have the right to complain to your local data protection authority.

12. Account and data deletion

• Disconnect a Page: in your workspace go to Settings › Channels › Messenger and choose Disconnect or Delete Messenger. You can also remove TorbChat AI under Settings › Business Integrations in your Facebook account.
• Delete your account or data: email [email protected] from your account email address. We verify your identity and complete deletion within 30 days.

Full step-by-step instructions are on our Data Deletion Instructions page.

13. Children

TorbChat AI is intended for businesses and is not directed at children under 13 (or the higher minimum age in your country). We do not knowingly collect their data; contact us if you believe we have.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows the latest revision, and we will give notice of material changes in the product or by email.

15. Contact us

TorbChat AI (AIM2BOOM) — Privacy enquiries and data requests: [email protected]. Website: torbchat.ai.