Última actualización: 21 de octubre de 2026
Este documento está disponible en italiano y en inglés. En caso de discrepancia, prevalece la versión italiana.
HelloBusiness AI is a service of Meta Experiences S.r.l., which is the controller of the personal data collected through this site and for account management.
For any privacy request you can write to the email address below.
For your account data (name, email, company, billing data) and for site browsing data, we are the controller.
For the data your company enters or receives in the workspace (contacts, conversations, notes, files, call recordings and transcripts), your company is the controller and Meta Experiences S.r.l. acts as processor under Article 28 GDPR, as set out in the Terms of service.
Account data: name, work email, company name, password stored only as a cryptographic hash, workspace role, preferred language.
Usage and security data: IP address, date and time of requests, sign-in events and the workspace activity log.
Payment data, when you activate a plan: handled by the payment provider; we do not store card numbers.
WhatsApp connection data, when the owner connects the business number through Meta: identifiers of the WhatsApp Business account and of the number, the verified business name and an access code issued by Meta, stored encrypted and never shown in the browser.
Browsing statistics, only if you consent to statistics cookies.
Providing the service, creating and managing the account, sending service emails (verification, security, usage alerts and notices about conversations the assistant hands over to the team): performance of the contract.
Protecting the service against abuse, unauthorised access and fraud: legitimate interest.
Complying with legal obligations, such as tax and accounting: legal obligation.
Measuring in aggregate how the site is used: consent, which can be withdrawn at any time.
We use providers that process data on our behalf under GDPR-compliant contracts: DigitalOcean (servers in Frankfurt, Germany), Amazon Web Services (file storage and email, Frankfurt region), MongoDB Atlas (database, Frankfurt), Google (statistics, only with consent).
When your company activates the channels and the AI assistant, the following are also involved: OpenAI (processing of conversations by the assistant), Twilio, Telnyx and other carriers (calls and SMS), Meta (WhatsApp Business), Stripe (payments).
With automatic WhatsApp replies we send OpenAI the assistant’s instructions and information and the latest messages of the conversation (at most 20, from the last 48 hours); we do not send the contact’s phone number or name. Under OpenAI’s terms for the API service, this data is not used to train models; we ask for responses not to be stored, and OpenAI may keep the data for up to 30 days only to detect abuse.
WhatsApp is connected in a Meta window: Meta’s code (Facebook SDK) is loaded only when the owner chooses to connect WhatsApp, and Meta’s privacy policy and cookies apply in that window.
If a provider processes data outside the European Economic Area, the transfer relies on appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
We do not sell personal data and do not use it for third-party advertising.
Account data for the whole duration of the relationship. After the account is closed they are deleted, except for data we must keep by law, such as accounting records (10 years).
Contacts, conversations and files in the workspace are kept as long as your business keeps them or until the account is closed. The WhatsApp access code is deleted when you disconnect the number; the number’s registration PIN stays encrypted until the account is closed, because it is needed to reconnect the same number.
Database backups are kept for 14 days and then overwritten.
Statistics data according to the analytics service settings, for a maximum of 14 months.
You can request access, rectification, erasure, restriction and portability of your data and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting processing already carried out.
To exercise them, write to the controller’s email. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
If your data is in a customer company’s workspace, contact that company first: we will help it respond.
Encrypted HTTPS connection, data separated by company, role-based access control, hashed passwords, private file storage and daily backups. No system is one hundred percent secure: in the event of a breach affecting you, we will inform you as required by law.
