Privacy Policy

1. What Lamuai does

Lamuai is a software service for businesses of any kind. A business creates an account, connects its own Facebook Pages and Instagram professional accounts, and uses Lamuai to answer customer messages and comments with AI, take orders in the chat, understand photos and voice messages that customers send, hide or delete comments, and work in one shared inbox.

2. Who is responsible for which data

For your own account and workspace, we decide how the data is used. For the conversations between a business and its customers, the business decides; we process that data on the business's behalf only to provide the service to it.

3. Data we collect

Account data: your name, email address, password (stored only as a secure hash by our authentication provider), language and theme choices, and your workspace (business) name, type and timezone.

Connected Facebook Pages and Instagram accounts: when you connect, Facebook Login gives us access only to the Pages and accounts you choose. We store the Page or Instagram account ID and name, the permissions you granted, connection status and dates, and a Page access token.

• Page access tokens are encrypted at rest (AES-256-GCM), are never shown in the browser and are never written to logs.
• Your personal Facebook user access token is used once during login to list your Pages and is then discarded. We do not store it, your Facebook user ID or your Facebook password.

Customer conversations: when a person messages or comments on a connected Page or Instagram account, we receive and store the messages and comments, the person's Page-scoped ID (an ID Meta creates for that Page only), their public profile name, and the replies sent by the AI, by automatic rules and by the business's team. Message and comment content is encrypted at rest (AES-256-GCM) and is never written to logs.

Photos and voice messages from customers: we keep Meta's link to the file and what we understood from it (for example the matched product, or the transcript of a voice message), encrypted together with the message. We do not copy the file to our own storage. To understand it, the file is sent to an AI provider (see section 5).

Shared posts: when a customer shares one of the business's own posts in a chat, we read that post's text and picture from Meta to find the product it shows. We keep the result (for example the matched product), not the picture.

Order details: when a customer orders in the chat, we store what they give for the order: name, phone number, address and delivery area, the items, options, quantities, prices and totals, the payment method, and a bKash or Nagad number and transaction ID if they type them. Names, phone numbers and addresses are stored encrypted.

Deliveries: when the business books a parcel with a courier it connected (Steadfast or Pathao), we send that courier the recipient's name, phone number and address, the amount to collect and a short item description, through the business's own courier account. We store the consignment ID, tracking code, delivery status updates, the amount to collect and the courier's charge, not a copy of the address. The courier account keys the business enters are encrypted (AES-256-GCM); only their last 4 characters are shown.

Order check: for each order we compute a fake-order risk score from the order itself and the same phone number's earlier orders in that shop (cancelled orders, returned parcels, many orders in a short time). Only a keyed hash (HMAC-SHA256) of the phone number is kept for this. The score is shown only to the business's team; it never cancels an order and is never shown to the customer.

Inbox data: replies the business's team writes in the inbox, tags, conversation summaries written by AI, saved replies, and questions and answers the business adds to its knowledge base (also ones created from a conversation with "Teach").

Reply style: after a Page or Instagram account is connected (and when the shop presses Re-scan), its past replies are read once to learn the shop's reply style; the messages are not stored, only the resulting style description.

Webhook event data: Meta notifies us when something happens on a connected Page or Instagram account. For each event we store the account, the kind of event, Meta's event ID, the time, the Page-scoped ID of the person who caused it, and the content needed to answer it (encrypted). Events from Pages that are not connected to a workspace are not stored.

Business information you enter: business profile, products, prices, product photos, delivery charges, payment numbers you show to customers (for example a bKash or Nagad number), order settings and reply rules.

One free trial per business: to check this, we keep a keyed hash (HMAC-SHA256) of the connected Page ID, the sign-up email address and the shop's phone number, not the values themselves.

Billing records: packages and their limits, usage counts, a wallet ledger, payment requests, coupons used and invoices. For now, packages are paid by manual bKash or Nagad payment to the number shown in the dashboard: we record the method, the sender number and the transaction ID you enter, check them and approve or reject the request; refunds are recorded too. We do not collect payment card details.

Technical and security data: sign-in events, security logs and an audit log of administrative actions. Our logs are built to exclude tokens, passwords and message content.

Guide videos: the dashboard's guide videos are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you open a video; when you do, YouTube (Google) receives your IP address and browser information under its own privacy policy.

4. How we use data

• To provide the service: connect accounts, receive events, show the inbox, take orders and send the replies the AI, the business's rules or its team send.
• To write replies: AI answers customer messages and comments, using the business's information, its product catalog and the conversation.
• To understand photos, voice messages and shared posts that customers send, and to summarise conversations for the business's team.
• To keep the service secure, prevent abuse and spam, and follow Meta's platform rules (for example the 24-hour messaging window and opt-outs).
• To count usage against packages and package limits, show in-app notices when AI replies run low (at 80 % and 95 % used; we do not send billing emails), keep billing records and invoices, and allow one free trial per business.
• To book deliveries with the courier the business connected, show their status, and send the customer short delivery updates (booked with tracking code, out for delivery, delivered) only inside Meta's 24-hour messaging window.
• To contact you about your account and important changes to the service.

We do not sell personal data, and we do not use it to train AI models of our own.

5. Who processes data for us

We use the following service providers. Each receives only the data it needs to do its job for us:

• Supabase: database, authentication and file storage for product photos. Data is stored in Singapore (ap-southeast-1).
• Vercel: hosting of the application; requests are processed in Singapore.
• Meta Platforms: Facebook and Instagram, the source of Page data and the channel replies are sent through.
• Couriers chosen by the business (Steadfast, Pathao): only when the business books a delivery. They receive the recipient's name, phone number, address, the amount to collect and a short item description, and process them under their own privacy policies.
• AI providers, as configured by us: currently OpenAI and Google (Gemini). They receive the conversation text, the business information and catalog needed for a reply, customer photos and product photos for matching, and voice messages for transcription.
• Upstash (QStash): runs background jobs. It receives job references (IDs), not message content.
• The email provider that sends account emails (sign-up confirmation and password reset).
• YouTube (Google): only when you open a guide video in the dashboard.

Some providers process data outside Bangladesh. We choose providers with appropriate security commitments.

6. Where data is stored and how it is protected

Our database is located in Singapore. Data is encrypted in transit (HTTPS). Access tokens, courier account keys, message and comment content, conversation summaries and customers' names, phone numbers and addresses in orders are additionally encrypted with AES-256-GCM. Each business's data is kept separate from other businesses (tenant isolation), and access by our staff is limited and logged.

Product photos are kept in Supabase Storage and can be opened by anyone who has their link, so Facebook and Instagram can show them to customers.

7. How long we keep data

• Account and workspace data: while the account exists; deleted when the account is deleted.
• Page access tokens: deleted immediately when a Page is disconnected.
• Webhook event data: deleted by a daily job, at most 30 days after it arrived.
• Customer messages (with photo and voice links, transcripts and what we understood from them): deleted by a daily job 90 days after each message. A conversation with no newer message is deleted with them.
• Comments: the text, the commenter's name and our replies are deleted by the same job after 90 days. A record without content stays, so the same comment is never answered twice.
• Orders, tags and the business's customer records: kept while the shop's account exists, until the shop deletes them, or until the shop deletes one customer's data (see section 8): that deletes their messages, transcripts, summaries and tags and removes their name, phone number and address from their orders.
• Delivery records (consignment ID, tracking code, status history, amounts): kept with the order. When the shop deletes one customer's data, the delivery records keep only the consignment ID, status and amounts. Courier account keys are deleted when the shop disconnects the courier.
• Customer memory (a short note, the products of interest and how the customer asked to be addressed, encrypted): kept while the shop's account exists, until the shop clears it in the inbox, or until the shop deletes that customer's data.
• Billing records, AI usage records (these never contain message content) and audit logs: as long as needed for accounting, legal and security reasons.
• Trial check hashes: kept to allow only one free trial per business.
• Data deletion request records: the confirmation code and status, without personal details.

8. Your rights

You can ask to access, correct, export or delete your personal data, and you can object to or restrict certain processing. Many changes can be made in the dashboard. For anything else, email support@lamuai.com. We may need to verify your identity first.

If you are a customer who messaged a business that uses Lamuai: that business controls your conversation data. Ask the business to delete it. The business can delete your messages, transcripts, summaries and tags and remove your name, phone number and address from your orders in its inbox; its delivery records then keep only the consignment ID, status and amounts. A courier that delivered a parcel keeps its own records under its own policy. If you cannot reach the business, email support@lamuai.com and we will pass your request on and help.

9. How to delete your data

You can disconnect a Page at any time in Connections, delete your account, remove Lamuai in your Facebook settings, or email support@lamuai.com. Step-by-step instructions are on our Data deletion page.

10. Children

Lamuai is a service for businesses and is not meant for anyone under 18.

11. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and tell account owners about important changes.

12. Contact

Lamuai, Dhaka, Bangladesh. Privacy and data deletion: support@lamuai.com. Support: support@lamuai.com.