Privacy Policy

01 Overview

Makutano AI ("Makutano", "we", "us") provides an AI sales assistant that answers customer questions, captures leads and drafts quotations for businesses ("Operators") across websites, WhatsApp and other channels. We take privacy seriously and only collect what we need to run the service reliably and securely.

By creating an account, connecting a WhatsApp number, or interacting with an assistant powered by Makutano, you acknowledge the practices described here.

02 Our role & scope

Makutano plays two distinct roles depending on the data:

• Controller — for Operator account data (your name, email, business details, billing and how you use the product). We decide how this data is handled.
• Processor — for the customer conversations, leads and messages that flow through an Operator's assistant. That content belongs to the Operator; we process it on their behalf to deliver the service, under their instructions.

If you are a customer chatting with a business that uses Makutano, that business is the controller of your conversation. Please also review their own privacy notice.

03 Information we collect

04 WhatsApp & Meta Platform data

Makutano integrates with the WhatsApp Business Platform (operated by Meta) so an Operator's AI assistant can reply to customers from the Operator's own WhatsApp number.

What we access from Meta, only after you explicitly connect your account through Meta's official Embedded Signup flow:

• Your WhatsApp Business Account and phone number identifiers, display phone number and verified business name.
• A business access token that authorises sending and receiving messages. This token is encrypted at rest and is never exposed to any browser or third party.
• Inbound and outbound message content and delivery/read status, so the assistant can respond and keep an accurate history.

How we use it: solely to operate the messaging features you enabled — routing each message to the correct business, generating grounded replies, updating proposals and notifying the Operator. We do not sell WhatsApp or Meta data, use it for advertising, or share it with unrelated parties.

Our use of information received from Meta APIs follows Meta's Platform Terms and Developer Policies. You can disconnect your number at any time from Portal → WhatsApp, which stops all further access.

05 How we use information

• Provide, operate and secure the assistant, proposals, leads and analytics.
• Generate AI answers, quotations and summaries grounded in the knowledge you provide.
• Route and deliver messages on the correct channel and number.
• Send service, billing and notification messages.
• Measure usage, prevent abuse, debug issues and improve the product.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use the private content of Operator conversations to train third-party foundation models.

06 AI processing & service providers

To deliver the service we share the minimum necessary data with vetted providers ("subprocessors") who process it on our instructions:

Providers may change as the service evolves; we keep this list current and require each to protect data under contract.

07 Sharing & disclosure

We share information only:

• with the subprocessors above, to run the service;
• with the Operator whose assistant a customer interacts with (they receive the lead and conversation);
• when required by law, legal process, or to protect the rights, safety and security of users and the public;
• in connection with a merger, acquisition or asset sale, under continued confidentiality.

We never sell or rent personal information.

08 How we protect data

• Data is encrypted in transit (TLS) and access tokens — including WhatsApp credentials — are encrypted at rest (AES-256-GCM).
• Each tenant's data is logically isolated; messages and credentials are scoped so one business can never read or send from another's number.
• Access to production systems is restricted, and secrets are never exposed to browsers or logs.

No system is perfectly secure, but we work continuously to safeguard your information and to respond quickly if an issue arises.

09 Data retention

We keep information for as long as your account is active and as needed to provide the service, then only as long as required for legitimate business or legal purposes. Operators can delete knowledge, leads, proposals and conversations from their workspace. Disconnecting WhatsApp removes our ability to use the stored token, and connection records are deleted or de-activated on request.

10 Your rights & choices

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal information, and to object to certain processing. To exercise these rights, contact us using the details below — we will respond within a reasonable timeframe. If you are a customer of an Operator, you can also contact that business directly.

12 International transfers

We operate from Tanzania and use providers located in other countries, including the United States. Where data crosses borders, we rely on appropriate safeguards and require our providers to protect it to a comparable standard.

13 Cookies

We use only the cookies necessary to sign you in and keep your session secure. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies in your browser, though signing in requires them.

14 Children's privacy

The service is intended for businesses and adults. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will remove it.

15 Changes to this policy

We may update this policy as the service and legal requirements change. We will revise the "Last updated" date above and, for material changes, provide additional notice. Continued use after an update means you accept the revised policy.

16 Contact us

Questions or requests about privacy? Reach the Makutano team: