Privacy Policy

Overview

project4am is a self-hosted, multi-tenant AI customer-service assistant used by small businesses (each a "Business") to handle inbound customer messages on their own channels (web widget, Facebook Messenger, Instagram Direct, WhatsApp Business). This policy describes what data we process on behalf of those Businesses, how it is stored, and what rights end users (customers messaging the Business) have.

project4am is operated as a back-office tool by each Business. We do not display advertising, sell data, or use customer messages to train any public AI model.

Data we collect

When a customer interacts with a Business through project4am, we process:

• Message content — the text the customer sends and the reply the assistant generates.
• Platform identifiers — the platform-scoped user ID (PSID for Messenger, IGSID for Instagram, phone number for WhatsApp) that the messaging platform supplies in the webhook payload, so we can route the reply back to the right person.
• Conversation metadata — message timestamps, the channel used, and whether the message was handled by the bot or a human staff member.
• Business knowledge content uploaded by the Business (FAQs, tour descriptions, internal docs) which the assistant uses to answer questions.
• Staff account data — name, email, hashed password for users who log in to the admin dashboard. Used solely for authentication and role enforcement.

We do not request, store, or process:

• Payment instruments or financial account details.
• Government identification documents.
• Precise device location (latitude/longitude).
• Biometric identifiers.

How we use Meta platform data

When a Business connects a Facebook Page, Instagram Business account, or WhatsApp Business number, project4am uses the Meta-granted permissions strictly to:

• Receive inbound customer messages via webhook (instagram_business_manage_messages, pages_messaging).
• Send replies back to the customer through the Send API on the same conversation (pages_messaging, instagram_business_manage_messages).
• Display the list of pages the Business owns during channel setup so the Business can pick which page to connect (pages_show_list, pages_read_engagement).
• Subscribe the chosen page to webhook events (pages_manage_metadata).
• Optionally read the Business's linked Instagram profile metadata during setup (instagram_business_basic).

We never use Meta-platform data for advertising, profiling, resale, or cross-app tracking. Meta-platform data is only made available to the specific Business that owns the connected page and to staff users that Business has invited.

Third-party processors

To generate replies, project4am sends the relevant portion of a conversation (most recent messages plus retrieved knowledge snippets) to language-model providers. The Business configures which providers are used; the default deployment uses:

• OpenRouter (and the underlying LLM provider it routes to) — for reply generation.
• OpenAI — for text embeddings used in retrieval-augmented search of the Business's knowledge base.
• Resend or an SMTP provider configured by the operator — for transactional emails (password reset, team invites, lead notifications).

These providers process data only as needed to fulfill the request and under their respective privacy policies. Data is not retained for model training.

Storage, retention, and security

Data is stored in a PostgreSQL database operated by the Business or its designated operator. Each Business's data is isolated at the row level using PostgreSQL row-level security keyed on tenant ID; staff users can only access conversations belonging to the Business they are members of. Passwords are stored as salted hashes via Better Auth. Transport is encrypted with TLS.

Conversation history is retained for as long as the Business needs it to provide service continuity. Businesses can delete individual conversations or messages at any time from the admin dashboard. Account-level deletion requests result in removal of the requester's account, membership, and personally identifiable information.

Your rights

End users (customers messaging a Business) and staff users have the following rights regarding their data:

• Access — request a copy of the data we hold about you.
• Correction — ask the Business to correct inaccurate data.
• Deletion — ask the Business to delete your messages and identifiers.
• Withdrawal of consent — stop messaging the Business at any time; the platform sends no unsolicited messages.

To exercise any of these rights, contact the Business directly or email erik.kubica@gmail.com. We will respond within 30 days.

Data deletion request

To request deletion of your data, send an email to erik.kubica@gmail.com with the subject "Data Deletion Request" and include the Business page, Instagram handle, or phone number you used to message the Business. We will confirm deletion within 30 days.

For Meta-platform users: you can also revoke project4am's access at any time from your Facebook or Instagram account settings under "Apps and Websites".

Children

project4am is not directed to children under 13 (or the higher minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

International transfers

project4am may be operated on servers located outside your country of residence. By using a Business that runs project4am, you consent to your data being transferred to and processed in the countries where those servers operate.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be communicated to staff users via email; end users will be informed via the Business they message.

Contact

Questions about this policy or about how project4am handles your data: erik.kubica@gmail.com.