Privacy Policy

We collect information needed to provide the Mesha service:

• Business account information — business name, contact person, email address, phone number, services, staff members and working hours.
• Customer conversation data — messages exchanged between a customer and the business through the connected messaging channel, and the phone number associated with those messages.
• Appointment data — requested, confirmed, rescheduled and cancelled appointments, including date, time, service and assigned staff member.
• Technical data — basic logs such as timestamps and error information generated while the service operates.

We do not intentionally collect special categories of personal data. Customers should not be asked to send sensitive information through the messaging channel.

Information is used to:

• understand customer messages and generate replies on behalf of the business;
• check availability and create, reschedule or cancel appointments;
• send booking requests to the business owner for approval;
• operate, maintain, debug and improve the reliability of the service;
• communicate with the business about its account and the pilot program.

We do not sell personal information, and we do not use it for third-party advertising.

Mesha operates through messaging platforms, including WhatsApp, which are provided by third parties. When a customer messages a business that uses Mesha, the message content and sender phone number are processed so that Mesha can respond and manage appointments.

The messaging platform itself is operated by its own provider and is governed by that provider's terms and privacy policy. Mesha is an independent service and is not affiliated with, endorsed by, or operated by Meta Platforms, Inc.

Conversation data is processed on behalf of the business using Mesha. That business is responsible for its own relationship with its customers and for informing them that an automated assistant may respond.

Appointment records, service definitions, staff schedules and availability are stored so Mesha can answer accurately and keep bookings consistent. This data belongs to the business using Mesha. We access it only to operate the service, provide support, or when required by law.

Where a business chooses to connect a Google account, Mesha requests only the permissions required to read availability and create or update calendar events related to appointments.

• Google user data is used solely to provide calendar-related features to that business.
• Google user data is not sold, and is not used for advertising.
• Google user data is not transferred to others except as needed to provide the service, to comply with applicable law, or with the business's consent.
• A business can disconnect its Google account at any time, which stops further calendar access.

Mesha's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use third-party providers to operate Mesha, such as cloud hosting, messaging platform providers, calendar providers and AI model providers used to generate responses. These providers process data on our behalf, under their own terms, and only to the extent needed to deliver the service.

We retain information for as long as a business uses Mesha, and afterwards only as long as needed for legitimate operational, legal or accounting purposes. A business may request deletion of its account data by contacting us, and we will delete or anonymise it unless we are required to retain it.

We take reasonable technical and organisational measures to protect information, including encrypted connections and access controls limited to those who need it. No online service can guarantee absolute security, and we do not claim to.

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, to object to or restrict certain processing, and to request a copy of your data.

If you are a customer of a business that uses Mesha, please contact that business first, as it controls the conversation and appointment data. You may also contact us and we will assist where we are able to.

We may update this policy as the service develops. Material changes will be reflected by updating the "last updated" date on this page, and where appropriate we will notify businesses using the service.

Questions about this policy or about your data can be sent to shadi.ai.dev@gmail.com.