Privacy Policy
Last updated: 10 October 2026
Laravel ("we", "us") is an AI customer-support platform. Businesses ("workspaces") connect their support channels, including email and Instagram, so that customer messages can be answered faster. This policy explains what we process and why.
What we collect
- Workspace account data: the name and email address of people who sign in to a workspace.
- Connected channel data: when a workspace connects an Instagram professional account, we receive its Instagram account ID and username, and an access token that we store encrypted.
- Customer messages: direct messages and comments that people send to a connected Instagram account, including the sender's Instagram ID and username and the message text. The same applies to emails received by a connected mailbox.
- Website chat: messages a visitor types into a chat a workspace has added to its own website, and the email address the visitor chooses to leave so a person can reply. We do not store the visitor's IP address or set a cookie for the chat.
How we use it
We use this data only to show messages to the workspace's support team and to draft or send replies on the workspace's behalf. Message text may be sent to an AI model provider to draft a reply. We do not sell personal data and do not use it for advertising.
We also count, for each workspace, how often customers ask about each topic and each product. The AI names the topic and the product when it writes a reply. We store only these counts and the day, never the message text and never the name or address of the sender. The workspace sees the counts on its analytics page. We do not use them to train AI models.
Who is responsible
Each workspace (business) is the data controller for its customers' messages. We act as a processor for that content, on the workspace's instructions. We are the controller for workspace account data (name, email address and sign-in method).
Processors and international transfers
We share data only with providers that help us run the service:
- Google (Gemini API): drafts replies and creates embeddings from customer message text. Structured identifiers such as card numbers, IBANs, email addresses and phone numbers are redacted first. Names and postal addresses written in free text are not redacted.
- Google (Gmail API): reads and sends email for mailboxes that a workspace has connected.
- Meta (Instagram messaging API): receives and sends Instagram messages and comments for connected accounts.
- Our hosting provider: hosts the application and its database.
Where a provider processes data outside the EEA, the transfer relies on Standard Contractual Clauses or the provider's data processing terms.
Retention and deletion
- Emails: 90 days.
- Instagram messages and drafts: 90 days.
- Raw Instagram webhook events: emptied once processed and deleted after 7 days.
- Website chat conversations: 90 days.
- Question statistics (counts only): 730 days.
- Archived workspaces: purged after 365 days.
Otherwise we keep workspace data while the workspace is active. A workspace can disconnect Instagram at any time, which removes the stored access token (access tokens are stored encrypted). To have the messages we stored about you deleted, follow the steps on our data deletion page.
Automated replies
- Email: when a workspace turns on AI auto-reply, answers and holding replies can be sent automatically through the connected mailbox without a person reviewing each one. Email replies do not include an automated-assistant notice, so workspaces are responsible for informing their own customers. A workspace can switch auto-reply off, or use dry-run mode, in which nothing is sent.
- Instagram: replies are drafted by AI, carry a notice that they were written by an automated assistant, and are sent only after a human agent approves them.
- Website chat: answers are generated automatically and shown without a person reviewing each one. The chat states that the visitor is talking to an automated assistant. When it cannot answer, it asks for an email address so that a person can reply.
Automated replies are based on the workspace's knowledge base and do not produce legal or similarly significant effects. You can ask for human review of any reply by contacting the workspace or us.
Your rights
You have the right to access your personal data, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability and the right to object. You also have the right to lodge a complaint with your supervisory authority. To exercise these rights, contact us at hello@example.com, the same address as on the data deletion page.
Contact
Laravel · hello@example.com
The rules for using the service are in our Terms of Service.