Privacy policy

• Account data of the people who sign in: name, e-mail address, a hashed password, their role and language.
• Business data the owner gives us during sign-up or later: the company profile, products and prices, clients, team, policies, files and images they upload, and pages of their website or social profiles they ask us to read.
• Messages on the channels a business connects (website chat, WhatsApp, Telegram, Facebook Messenger, Instagram), with the sender's name and number or account id as the platform provides them.
• For connected accounts (Facebook Pages, Instagram, WhatsApp Business, TikTok, Google Drive): the access tokens the platform gives us, the account's id and name, and the content we publish for the business.
• Technical logs: request times, errors and IP addresses, kept for security and to fix problems.

• To run the business's AI agents: answer its customers, prepare posts, invoices, tasks and reports, and ask the business's people for approval before public, money or hiring steps.
• To publish posts and send messages on the accounts the business connected, when it asks us to.
• To keep the service secure, fix problems and prevent abuse.

• Hetzner Online (Germany): our servers and database.
• OpenRouter and the AI model providers it routes to: the text and images an agent works on, to produce its answer. They do not get account passwords or access tokens.
• Meta, Google, TikTok and Telegram: only what is needed to read from and post to the accounts a business connected.
• Services that read public web pages and public profile information during sign-up (for example Jina Reader, Brandfetch and Apify), when the owner shares a link.

We use data from connected Facebook, Instagram, WhatsApp, TikTok and Google accounts only to provide the features the business turned on in Taqam, never to build advertising profiles, and we do not sell it. Our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google Drive access uses the drive.file scope: we only see the files the user picks.

Access tokens are encrypted at rest (AES-256-GCM). Passwords are stored only as hashes. Every agent action is logged, and public, money and hiring steps wait for a person.

As long as the business uses Taqam. When a business disconnects an account, we delete its tokens at once. When a business closes its account or asks us to delete its data, we delete it within 30 days, except what the law requires us to keep.

You can ask to see, correct or delete your data at [email protected]. Business owners can disconnect any channel on the Channels page at any time. To delete data that came from Facebook or Instagram, follow the steps on the data deletion page.