Privacy Policy

1. Who we are

Havio ("Havio", "we") provides the Havio Messaging Center, a business messaging service that lets businesses ("Customers") manage WhatsApp and Facebook Messenger conversations with their own customers ("End users"). Customers can also manage the Instagram direct messages of the Instagram professional account linked to their Facebook Page. The service is operated by Havio-AI. For personal data that Customers process through Havio, the Customer is the controller and Havio acts as its processor; for the data of Customers' own staff accounts, Havio is the controller.

2. Data we collect

• Business user accounts: name, email address, hashed password, multi-factor authentication settings, role and team membership, and sign-in and security logs (IP address, browser, time).
• Connected messaging accounts: WhatsApp Business Account and phone-number identifiers, Facebook Page identifiers and names, display name, and access tokens granted through Meta (stored encrypted). For Instagram, the identifier, username, name and profile picture link of the Instagram professional account linked to a Customer's Facebook Page.
• Messages and contacts: the content of messages sent and received through the Customer's WhatsApp numbers and Facebook Pages, media files, delivery and read statuses, and End users' phone numbers, WhatsApp names and identifiers, and, on Messenger, the Page-scoped identifier, name and profile picture link Meta provides, plus any notes, tags or fields the Customer adds. On Instagram, the content of direct messages sent and received through the Customer's Instagram account, and the End user's Instagram-scoped identifier, name, username and profile picture link Meta provides. When an End user replies to a Customer's Instagram story or mentions the Customer in their own story, we keep only the link to the story Meta provides, never a copy of the story itself; it stops showing once Meta no longer serves it.
• Purchase history: when a store is connected, HMC keeps a copy of the store's order history for the store's customers (orders, items, totals, discounts, invoice references — never card or payment details, never the invoice files), shown only to the store's team and deleted with the contact or when the store is disconnected.
• Technical data: service logs and diagnostics needed to run and secure the service.

We use only strictly necessary cookies (to keep you signed in and protect against cross-site request forgery). We do not use advertising cookies.

3. How we use data

• To deliver and receive messages on behalf of Customers and show conversations in the Havio dashboard.
• To connect, monitor and maintain the Customer's messaging accounts (for example, number health, token validity and webhook status).
• To secure the service: authentication, fraud and abuse prevention, virus scanning of received files, and tamper-evident audit logs.
• To provide support and communicate with business users about the service.
• To meet legal obligations.

We do not sell personal data, and we do not use end-user message content for advertising.

4. Data from Meta

Havio uses Meta's WhatsApp Business Platform (Cloud API). When a Customer grants Havio access through Facebook Login for Business / Embedded Signup, we use the permissions granted only to provide the messaging features the Customer requested: managing the connected WhatsApp Business Account, sending and receiving messages, and managing templates. When a Customer connects a Facebook Page through Facebook Login for Business, we use the permissions granted only to list the Customer's Pages, connect the chosen Pages to Havio, and send and receive Messenger messages for them; we keep the Page's access token (encrypted), never the person's own Facebook token. Our use of data received from Meta complies with Meta's Platform Terms and developer policies.

When a Customer also connects the Instagram professional account linked to a connected Facebook Page, we use the Instagram permissions granted only to read which account is linked to the Page, to read the name, username and profile picture of the people who message it, and to send and receive its Instagram direct messages. We use the Page's access token for this; no separate Instagram token is stored.

5. Sharing

We share data only as needed to run the service:

• Meta Platforms, to send and receive WhatsApp and Messenger messages. Meta's own terms and privacy policy apply to data Meta processes. Meta also carries the Instagram direct messages of a connected Instagram account.
• Infrastructure providers that host our servers, databases and file storage, under contracts that require them to protect the data.
• Authorities, when required by law.

Data within one Customer's workspace is isolated from other Customers.

6. International transfers

Data may be processed outside Israel, including in the European Union and the United States, by Meta and by our hosting providers. Where required, we rely on appropriate safeguards for such transfers.

7. Retention

• Messaging data and media are kept while the Customer's account is active, subject to the retention settings the Customer configures.
• When a Customer disconnects a channel or closes its account, the related access tokens are revoked or deleted, and the Customer's data is deleted within 30 days, except where we must keep it longer by law. Backups are overwritten on a rolling basis.
• Security audit logs are kept for as long as needed to protect the service and meet legal requirements.

8. Security

We protect data with encryption in transit (TLS) and encryption of stored credentials, strict per-tenant data isolation in the database, role-based access with multi-factor authentication for sensitive actions, verification of webhook signatures, and virus scanning of received files. No system is perfectly secure; we will notify affected Customers of a breach as required by law.

9. Your rights

Depending on where you live (including under Israel's Privacy Protection Law and the EU GDPR), you may have the right to access, correct, delete or export your personal data, and to object to or restrict certain processing. Business users can exercise these rights by contacting us. End users should contact the business they messaged, since that business controls their data; we will help the business respond.

10. Data deletion instructions

To delete data held by Havio:

• Businesses: in Havio, go to Settings → Channels → WhatsApp and disconnect your number, and to Settings → Channels and disconnect each Facebook Page, then email privacy@havio-ai.com from your account email asking us to delete your workspace. We confirm and complete deletion within 30 days. Disconnecting a Facebook Page also disconnects its Instagram account; to stop Instagram alone, choose Disconnect Instagram on the Page.
• Removing Havio's access in Meta: in Meta Business Settings, open Integrations or Business Integrations, and remove the Havio app. This stops all further access to your WhatsApp Business Account and your Facebook Pages. It also stops access to the Instagram accounts linked to those Pages.
• End users: contact the business you messaged, or email privacy@havio-ai.com with the phone number you used or, for Messenger, the name of the Facebook Page you messaged and your name on Facebook. We will pass your request to that business and act on its instructions: your contact and Messenger profile details are deleted or anonymised as for WhatsApp. Do the same for Instagram: write to the business, or email us with, for Instagram, the username of the Instagram account you messaged and your own Instagram username. We find your data by the Instagram-scoped identifier Meta gives you for that account, and your Instagram profile details are deleted or anonymised the same way.

11. Children

Havio is a business service and is not directed to children under 16.

12. Changes

We may update this policy. We will post the new version on this page with a new effective date, and notify business users of material changes.

13. Contact

Havio-AI · privacy@havio-ai.com