⚠ Draft — pending legal review by Indonesian counsel. Not effective until reviewed. See Company Setup Checklist Phase 6.

Privacy Policy

Data we collect

Envomate processes the communication content that tenants and end-customers exchange through the Service, along with contact identifiers (phone number, name), order references shared by the tenant, and standard technical logs required to operate the Service.

When you request a demo, we collect your company name, contact name, work email, WhatsApp number, plan interest, and any message you add, and use them only to contact you about the demo and, if you sign up, to set up your company’s account.

When a tenant connects the email channel, we also process the sender and recipient email addresses, subject lines, message text and threading headers of the mail customers send to the tenant’s Envomate address, and of the replies sent back. Attachments are not downloaded or read; only their names, types and sizes are noted. Automatic replies, bounces and mailing-list mail are recognised and not answered.

A tenant on a plan that includes broadcast may send WhatsApp campaigns through Envomate, using only templates approved by WhatsApp and only to people with a recorded opt-in for that kind of message, and only through WhatsApp’s official Business Platform. We keep, for each person, their number, an optional name and tags, and a record of when and how they agreed or opted out. Replying STOP or BERHENTI opts a person out immediately, and the opt-out lasts until that person agrees again; it is not undone by importing the contact again. Fees charged by Meta for these messages are passed through to the tenant and are not absorbed or marked up by Envomate.

Purpose

We use this data to deliver the Service on the tenant’s behalf, including generating AI responses, routing conversations, billing for usage, and producing aggregate analytics.

Data location

Primary storage is located in Indonesia (AWS Jakarta region). Backups are replicated to Singapore for durability.

Retention

Raw messages are retained for 90 days. Aggregate analytics (counts, latency, quality metrics without message content) may be retained indefinitely.

Demo requests are deleted after 12 months, or earlier on request.

Contacts who never gave consent are blanked after 90 days. When a contact is deleted, their number, name and tags are erased, and a one-way fingerprint of the number and the record of their opt-out are kept so the number cannot be messaged again by mistake.

Email delivery records (message identifiers and status, no message text) are deleted after 30 days. The conversation itself follows the message retention above and stays in the tenant’s inbox when the email channel is disconnected.

When a customer sends a WhatsApp voice message and the company has voice messages enabled, the audio is sent to Groq to be transcribed into text and answered like any typed message. The audio itself is not stored by Envomate; only the transcript is kept, with the rest of the conversation.

Sub-processors

  • OpenAI
  • Groq
  • Anthropic
  • Meta (WhatsApp Business API)
  • Meta (Messenger and Instagram messaging)
  • Telegram (Bot API)
  • Mailgun (email delivery and receiving)
  • Midtrans
  • Xendit

End-customer rights

End-customers may request access, correction, deletion, and portability of their personal data. Requests should be routed through the tenant merchant, who acts as the data controller.

Contact for privacy

Privacy questions or requests can be sent to privacy@example.com.

Last updated: 2026-10-08