Last updated: 27 October 2026
Privacy Policy
This policy describes how NeoAI (the “Platform”) processes personal data when you visit our websites, register an account, use tenant chat assistants, or connect WhatsApp Business through Meta. For tenant chats, the tenant business is usually the controller of visitor/customer data; NeoAI acts as a processor (GDPR Art. 28) under the service agreement.
1. Data controller
The Platform is operated by NeoAI. For Platform privacy requests, use the contact details at the end of this page or the form on our homepage. For data collected in a business chat (leads, messages, tickets), contact that business’s controller; NeoAI provides session export/forget tools in the owner panel.
If you register a business, you are the controller of that data and NeoAI is the processor. The contract is the DPA at /dpa. Registration records acceptance of these texts together, with a date and a version.
2. Data we process
Account and profile data (name, email, business details) when you register or sign in.
Conversation content you send to tenant assistants (chat, voice transcripts where enabled, and channel messages such as WhatsApp).
Technical logs (IP address, browser type, timestamps, security events) needed to run and protect the service.
When you use “Connect with Meta” for WhatsApp, we receive OAuth tokens and WhatsApp Business identifiers (WABA ID, phone number ID) from Meta to send and receive messages on your behalf. Message content is processed to provide the assistant and inbox features.
3. Purposes and legal bases
We process data to provide the service, authenticate users, deliver messages on connected channels, improve reliability, and comply with law. Where required, processing is based on contract performance, legitimate interest in operating a secure SaaS product, or your consent (for example when connecting third-party accounts).
Chat and voice show a fixed label: the person is talking to an artificial intelligence. The business controller cannot turn that label off.
4. Meta / WhatsApp
WhatsApp Business connection uses Meta’s Embedded Signup and Graph API (WhatsApp Cloud API). Meta processes data under its own terms, privacy policy, and WhatsApp Business Data Processing Terms, which apply to NeoAI’s use of the platform when a tenant connects WhatsApp—without a separate NeoAI signature. We store connection tokens in encrypted form and use them only to operate WhatsApp messaging for your tenant. You can disconnect WhatsApp from the owner admin panel.
The first WhatsApp message is not checkbox consent. It only records that the person wrote on that channel. We do not send marketing campaigns via WhatsApp yet; if we add that later, separate opt-in will apply.
5. Sub-processor list
We use the following providers only to deliver the Platform. We do not sell personal data. We may disclose data if required by law or to protect rights and security.
The Platform server is a Cloud VPS from Contabo GmbH (Welfenstraße 22, 81541 Munich, HRB 180722). Processing of data on that machine is described in the Art. 28 GDPR agreement prepared for that VPS. The only sub-processor named there, for data-center operation, is Contabo France SAS, 2 rue Taunus, 67630 Lauterbourg, France. Contabo covers physical data-center security and anti-DDoS protection. The operating system, backups, data separation and encryption of traffic on the VPS remain NeoAI’s responsibility. AI model providers are not covered by that agreement. The current list is on /sub-processors.
LLM / voice models (only when the tenant enables them): OpenAI, Anthropic, Google, DeepSeek (BYOK only), ElevenLabs, OpenRouter, and similar APIs. Conversation text is sent to the provider the business controller chose. NeoAI has not signed a separate DPA with those model vendors; the provider’s API terms apply between the tenant and that provider when the integration is active. Transfers outside the European Union, and any standard contractual clauses, are governed only by that provider’s contract—not by NeoAI.
Meta Platforms Ireland Ltd. / WhatsApp Business Platform: if the tenant connects WhatsApp, messages and routing metadata transit Meta under Meta’s published business and data-processing terms (see /sub-processors).
Object storage: Backblaze B2 (tenant knowledge media and attachments, when configured). Files are stored under Backblaze’s Terms of Service and published data-processing addendum for the NeoAI B2 account—not under a separate NeoAI-signed DPA on the public list.
Transactional email: OVHcloud SMTP on the NeoAI instance (lead, ticket, account, and compliance notifications), under OVH contractual terms.
6. Retention
We keep account data while the tenant is active and for a limited period afterward for backups, billing, and legal obligations. Each tenant can set automatic chat conversation retention days in the panel (0 = disabled). Leads and tickets remain until manually deleted or requested by the controller.
7. Your rights
Depending on your location, you may have rights to access, rectify, erase, restrict, or port your data, and to object to certain processing. Contact us to exercise these rights. You may also lodge a complaint with your supervisory authority. Tenant controllers can export or forget a chat session from the panel (DSAR helpers).
8. Account and data deletion
To request deletion of your account or personal data, email the privacy contact below with the email address tied to your account and, if applicable, your tenant slug. We will verify ownership and respond within a reasonable time. Disconnecting WhatsApp in the admin panel revokes our use of Meta tokens for your tenant.
10. Changes
We may update this policy. The “Last updated” date at the top will change when we do. Continued use of the Platform after changes means you accept the updated policy.