Privacy Policy

Last updated: 27 October 2026

MAT Business CRM is a software service (“the Service”) provided by MSB AI Technologies, Office # 102, RJ Mall, Rashid Minhas Road, Karachi, Pakistan (“we”, “us”). Businesses (“Clients”) use the Service to manage WhatsApp Business conversations with their own customers (“End Users”) through Meta’s WhatsApp Business Platform. This policy explains what personal data we process, why, and your choices. Contact: support@msbaitech.com.

1. Our role

For Client account data we are the controller. For End User data inside a Client’s conversations, the Client is the controller and we act as a processor / service provider, processing that data only on the Client’s instructions to provide the Service.

2. Data we collect

  • Account & sign-up data: name, company name, business address, phone number, email address (verified by a one-time code), industry, website, encrypted password, terms acceptance time and IP address.
  • Meta / WhatsApp connection data: when a Client connects WhatsApp through Facebook Login (Embedded Signup) we receive the WhatsApp Business Account ID, phone number ID and an access token from Meta that lets the Service send and receive messages for that account. We do not receive your Facebook password.
  • Messaging data: messages between a Client and its End Users received or sent through the WhatsApp Business Platform — phone numbers, WhatsApp profile names, message content and media, form (Flow) answers, orders, timestamps and delivery status. If a Client uses WhatsApp Business app coexistence, messages the Client sends from the app and, if the Client chooses, past chat history and contacts from the app are synchronised.
  • Contact & CRM data that Clients add or import: names, numbers, tags, lead stages, custom fields and notes; opt-out status.
  • Support data: tickets and messages you send us, including through the website contact form.
  • Billing data: plan, invoices and payment references. We do not store payment card numbers.
  • Technical data: logs (IP address, browser, time, errors) for security and troubleshooting. We use only essential cookies (to keep you logged in); no advertising cookies.

3. How we use data

  • To provide the Service: show conversations to the Client’s team, deliver messages, run campaigns the Client creates, store records and reports.
  • To run the Client’s AI features when enabled: conversation text, the Client’s business information and website content are sent to our AI provider to generate replies, voice notes, transcriptions and summaries.
  • To secure accounts, prevent spam and abuse, and enforce the WhatsApp Business and Commerce policies.
  • To provide support, send service emails (login codes, password resets, ticket replies, billing notices), and bill subscriptions.

We do not sell personal data, do not use Client or End User conversations for advertising, and do not use them to train AI models.

4. Sharing and sub-processors

  • Meta Platforms (WhatsApp Business Platform, Facebook Login) — message delivery and account connection.
  • OpenAI — AI replies, transcription and voice, only when the Client enables AI.
  • Hetzner Online — servers (European Union).
  • Email delivery provider (Brevo) — service emails.
  • Backup storage provider — encrypted backups.
  • Google — optional sign-in.
  • Third-party systems a Client connects itself (its webhook or API actions) receive the data the Client configures.

We may disclose data if required by law or to protect the rights and safety of users and the Service.

5. International transfers

Data may be processed in Pakistan, the European Union, the United States and other countries where our sub-processors operate, with appropriate safeguards.

6. Retention

We keep data while the Client’s account is active. After an account is closed we delete or anonymise its data within 30 days, except records we must keep by law (for example invoices). Backups are overwritten on a rolling basis within about 30 days. Clients can delete contacts and chats at any time.

7. Security

All connections use HTTPS/TLS. Passwords are hashed; WhatsApp tokens, API keys and secrets are encrypted at rest; each Client’s data is separated; access is role-based and actions are logged; optional two-step login by email code.

8. Your rights and choices

  • Clients can access, export, correct and delete data in the app, and request account deletion in Settings or by contacting us.
  • End Users (customers of a Client) can reply STOP to stop marketing messages from that business, and can ask that business — or us via our Data deletion page — to delete their data.
  • If you logged in with Facebook, you can remove our app in your Facebook settings and request deletion of the related data; see Data deletion.

9. Children

The Service is for businesses and is not directed to anyone under 18.

10. Changes

We will update the date above and, for material changes, notify Clients in the app or by email.

11. Contact

MSB AI Technologies, Office # 102, RJ Mall, Rashid Minhas Road, Karachi, Pakistan · support@msbaitech.com