Privacy Policy

What we collect

• Your Instagram professional account ID, username, name and profile picture, obtained through Instagram login when you connect your account. If you also connect a Facebook Page, its Page ID and name.
• An access token issued by Meta, used only to send and receive messages and to reply to comments on your own connected account.
• Incoming and outgoing Instagram Direct Message content, replies to your stories, and comments left on your own posts that match a keyword you set, processed to generate and send automated replies. If you connect a Facebook Page, the same applies to its Messenger chats. We also store the sender's Instagram ID and username so you can see who wrote.
• Contact details a customer chooses to give in a chat (for example an email address or phone number), when you turn on lead collection.
• Basic account metadata you provide us directly (e.g. login email) to operate your dashboard account.

How we use it

Message content is used solely to generate and send replies on your behalf, and to maintain conversation context so replies stay coherent, and to show you your conversations. Comments are used only to detect your keywords and to send the reply you configured. Access tokens are used only to call Meta's APIs for your own connected account, never to act on any account you have not explicitly connected.

Storage and security

Data is stored in an access-controlled Postgres database. Access tokens and message content are never sold, shared with advertisers, or used for any purpose outside operating the service for the connected account's owner.

How we protect sensitive data, including Google user data and the access tokens that connect your accounts:

• Encryption in transit. All traffic between your browser, Tawlki, our database host and Google or Meta is sent over HTTPS (TLS). Tawlki is not reachable over plain HTTP.
• Encryption at rest. Our database host (Supabase) encrypts stored data on disk. In addition, Google Calendar access tokens and email connection passwords or tokens are encrypted by Tawlki with AES-256-GCM before they are saved. The encryption key is kept in the server environment, separate from the database, so a copy of the database alone does not reveal them.
• Tokens stay on the server. Google and Meta tokens are used only on Tawlki's servers, to call Google or Meta for your own account. Encrypted tokens are decrypted in server memory at the moment they are needed. Tokens are never sent to your browser, never shown in the dashboard and never sent to an AI provider.
• Access control. Database tables that hold account data and tokens cannot be read with the public key; they are reachable only from Tawlki's servers. Each signed-in user can only see their own account. Administrative access to the database and servers is limited to the Tawlki operator, and the server keys are stored as secrets that are never published in our code or website.
• Least privilege. We request the narrowest Google permissions that do the job (free/busy, calendar events and your email address for Calendar; send-only for follow-up email) and we cannot read your mail.
• Removal. Disconnecting Google Calendar revokes the token at Google and deletes it from our database. Account deletion removes the connection data too (see Data deletion below).
• Incidents. If we ever find that your data was accessed without authorization, we will revoke the affected tokens and tell you without undue delay.

Google Calendar data

If you choose to connect Google Calendar, Tawlki requests these permissions:

• calendar.freebusy: to check whether a time a customer asks for is free or busy. We receive only busy time ranges, never event details.
• calendar.events: to create a calendar event when a customer books a meeting, to remove it if the meeting is rescheduled, and to show your events on your Tawlki Calendar page.
• email: to show which Google account is connected.

We store the OAuth tokens needed to keep the connection working. Event titles and details are shown only to you inside your dashboard; they are not stored beyond what is needed to display them and are not sent to any AI service. The only calendar-derived information our AI assistant sees is whether a requested time is busy or free and the time of a booking it confirms, which appear in the chat text it handles. That text goes only to OpenAI, listed in this policy, with data sharing turned off so it is not used to train OpenAI's models.

Who receives Google user data. We do not sell, share, transfer or disclose Google user data (calendar events, free/busy times, your Google email address or the connection tokens) to any other third party. It is processed only on Tawlki's own servers and stored with two service providers acting on our behalf: Supabase (database, holds the connection tokens) and Vercel (hosts the dashboard). Raw Google user data (events, event details, your Google email address and the connection tokens) is never sent to an AI provider.

You can disconnect Google Calendar at any time with the Disconnect button on the Calendar page of your dashboard. This revokes Tawlki's access at Google and deletes the stored tokens. You can also remove access in your Google Account permissions (myaccount.google.com/permissions).

Follow-up emails

If you turn on follow-up emails, Tawlki sends emails to your leads from your own mailbox, in the sequence you set up.

• You connect the mailbox with its SMTP login (host, username and password or app password) or, where offered, with Google. The password or Google refresh token is stored encrypted and used only to send your follow-ups. Google access is limited to sending (gmail.send); Tawlki cannot read your mail.
• To write an email, our AI provider (OpenAI) receives the lead's name, the email text you set, your offer details and a summary of that lead's earlier chat with you. Mailbox passwords and tokens are never sent to it.
• Every email carries an unsubscribe link and a List-Unsubscribe header. A person who unsubscribes is not emailed again by Tawlki.
• Disconnecting the mailbox on the Follow-ups page deletes the stored password or token and switches follow-ups off. You can also revoke Tawlki in your Google Account permissions.

Affiliate referral cookie

If you arrive through an affiliate's link, we set one cookie, tk_ref, that holds the affiliate's code for 30 days. If you create an account within that time, we record which affiliate referred you so they can be paid a commission on your payments. The cookie is used for nothing else, is not used for advertising, and is not shared with third parties. The affiliate sees only an anonymous number for you, never your name or email. You can delete the cookie in your browser at any time.

Who we share data with

We do not sell data or share it with advertisers. We use these service providers to operate Tawlki, and they process data only on our behalf:

• Supabase: database and sign-in. Stores account data, Instagram messages and Google Calendar connection tokens.
• Vercel: hosts the website and dashboard.
• OpenAI (API): receives Instagram message text to write replies, turn knowledge base and style text into numeric search vectors, and write short chat summaries. Raw Google user data (calendar events, event details, email address, tokens) is never sent to OpenAI. We have turned off data sharing, and under OpenAI's API terms, API data is not used to train its models.
• Meta: Instagram messages are sent and received through Meta's official API.

We may disclose data if required by law.

Google API Services User Data Policy

Tawlki's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar features described above. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train any AI or machine learning model. Humans do not read this data except with your consent, for security, or to comply with law.

Your controls

You can disconnect your Instagram account or Facebook Page at any time from the Channels section of your dashboard. This deletes the stored access token, so Tawlki can no longer read or send anything for that account. You can also remove Tawlki in Instagram under Settings, Apps and websites.

How long we keep data

We keep your data while your Tawlki account is active so the service keeps working. Access tokens are deleted when you disconnect the channel or mailbox. Your account data and conversations are deleted when you ask us to (see Data deletion below), within 30 days.

Data deletion

To have your Tawlki account data deleted (connected account details, conversations, contacts, leads, knowledge base and settings), email imainulhaq@gmail.com from the address you signed up with, or from the Instagram handle's owner, with the subject "Tawlki data deletion". We delete it within 30 days and confirm by email. A customer who messaged a Tawlki business and wants their messages removed can use the same address and name the Instagram account they wrote to.

Contact

Questions about this policy: imainulhaq@gmail.com