Privacy Policy

Costoma provides AI agents that answer calls, WhatsApp messages, SMS, email and website chat on behalf of businesses. This policy explains what we do with personal data, whether you are a business that uses Costoma or a customer who spoke to an agent we run.

Costoma is the data controller for its own website, accounts and support channels. When an agent handles conversations for a business that uses Costoma, that business is the controller and we are its processor, acting on its instructions under our agreement with it.

We collect only what is needed to answer a conversation and complete the work it asks for.

• Contact details — the phone number, WhatsApp profile name or email address a conversation arrives from, and any name a person gives us.
• Conversation content — the messages sent and received, and for calls a recording where the business has enabled it and the law of the caller's location allows it, together with the transcript.
• What the conversation produced — appointments booked, orders looked up, invoices and payment links sent, and notes written to the business's CRM.
• Account data — for businesses using Costoma: the name, email address and role of each user, plus billing details handled by our payment providers.
• Technical data — IP address, browser type and timestamps, used to keep the service available and to investigate abuse.

To answer messages and calls, to carry out what was asked (booking, order tracking, invoicing, payment follow-up, updating records), to pass a conversation to a human when the agent cannot help, to keep an audit trail of actions taken on a business's behalf, to bill businesses for their use of the service, and to detect and prevent abuse.

We do not sell personal data. We do not use conversation content to train publicly available AI models.

When you message a Costoma number on WhatsApp, the message reaches us through the WhatsApp Business Platform, so Meta processes it as well. Meta's own privacy terms apply to that part of the journey.

WhatsApp allows a business to reply freely for 24 hours after your last message. Outside that window we may only send a message you have agreed to receive, using a template approved by Meta in advance.

Reply STOP at any time and we will not message you again. Reply START to resume.

Whether a call is recorded is set by the business whose number you called, according to the rules of the place you are calling from. Where consent is required, you will be told at the start of the call and may decline.

A business using Costoma can connect its own calendar so the agent books into it. Connecting is optional, and nothing in this section applies until someone does it.

When you connect Google Calendar we ask Google for one permission, https://www.googleapis.com/auth/calendar.events, which allows reading and writing events on the calendar you choose. We use it for two things. We read the events already on it, so the agent never offers a customer a time you are not free for, and so your own meetings can be shown to you inside Costoma rather than in a second tab. We write the appointments Costoma books, move them when a customer reschedules, and remove them when a customer cancels, so your calendar and Costoma never disagree.

From each event we read its title, start and end, location, organiser, guests and their replies, and how to join it. That is shown only to the business whose calendar it is. We do not ask for access to Gmail, Drive or your contacts, and we do not ask for permission to create or delete calendars themselves.

We store the access and refresh tokens for the connected account, encrypted, and the identifier of each event Costoma created so that a later change can find it. We do not keep a copy of your calendar: events are fetched when a screen or an agent asks for them.

Disconnecting the calendar in Costoma deletes those tokens and ends our access immediately. You can also revoke it yourself at myaccount.google.com/permissions.

Costoma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising and we do not sell it. We transfer it to others only where it is needed to provide a feature you are using, where the law requires it, or as part of a merger or acquisition, with notice to you. No person at Costoma reads it except with your permission, to resolve a security problem, or where the law requires it.

Connecting Microsoft Outlook works the same way, with the equivalent Microsoft permission and the same limits.

We use a small number of providers to run the service. Each one receives only what its job needs.

• Meta Platforms — delivery of WhatsApp messages.
• Telnyx — phone numbers, calls, SMS and the voice runtime.
• Anthropic — the language model that reads a conversation and drafts a reply.
• Voyage AI and OpenAI — turning a business's documents into a searchable form so the agent can answer from them.
• ElevenLabs — transcribing and speaking voice notes, where that feature is in use.
• Stripe, Paystack and Hubtel — payment links and card or mobile-money collection. Card details go directly to them and are never stored by us.
• Postmark and SendGrid — sending and receiving email.
• Supabase and DigitalOcean — database and server hosting.
• Google and Microsoft — calendar access, where a business has connected its calendar so the agent can book appointments.

Our servers are in Europe and the United States, and some of the providers above operate globally. Where data leaves the country it was collected in, we rely on the standard contractual clauses or an equivalent safeguard.

Conversations and their transcripts are kept for as long as the business that owns them chooses, within the retention window set in its account, and are deleted when that window passes or the account closes. Records of actions taken on a business's behalf are kept for seven years where accounting or regulatory rules require it. Technical logs are kept for 30 days.

You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict its use. Where we act as a processor for a business, we will pass your request to that business and help it respond.

Write to info@costoma.io and we will reply within 30 days. If you are in the EU or the UK and are unhappy with our answer, you may complain to your national data protection authority.

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it. Credentials a business gives us for its calendar, CRM or payment provider are held encrypted and are loaded only for the moment a single action needs them.

Costoma is for businesses. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, write to info@costoma.io and we will delete it.

We will update this page when the service changes, and we will change the date at the top. If a change materially affects how we handle personal data, we will tell account holders by email before it takes effect.