Privacy Policy

Who we are

Agent Nimo lets a business connect an AI assistant to the channels its customers already use (its website, WhatsApp, Instagram and Facebook Messenger), so those customers get answers drawn from information the business itself provides. The data controller is Republicode. You can reach us at dgarcia@republicode.com.

Two kinds of people, two different roles

The distinction matters, because our obligations differ in each case:

• The business that subscribes to the service (our customer). We act as controller for their data.
• That business’s own end customers, who message the assistant. We handle their data on the business’s behalf, following its instructions. The business decides what happens with those conversations; we process them in order to provide the service.

What data we handle

From the business that subscribes:

• Name, email address and password (always stored hashed, never in plain text).
• Organisation name and, if provided, a contact phone number.
• The documents uploaded to train the assistant (price lists, opening hours, policies, services). Their content is converted into numerical representations so it can be searched.
• Credentials for the channels connected. Meta access tokens are stored encrypted and used only to send and receive messages on the business’s behalf.

From end customers who message the assistant:

• The content of their messages and the assistant’s replies.
• A channel identifier (for example, the user id Meta sends us), needed in order to reply in the same conversation.
• On Instagram and Messenger, the name, username and profile picture the platform shares with the business. We keep a small copy of the picture for as long as the business’s account exists.
• Details the person volunteers to the assistant (name, phone, email) when booking an appointment, leaving contact details or requesting a call back.

We do not collect the content of connected Facebook or Instagram pages, nor their posts, followers, comments or insights. From Facebook Login we read only the list of Pages the person administers and, where applicable, the Instagram account linked to each, so they can choose which to connect.

What we use it for

• Providing the service: receiving messages, generating replies and delivering them.
• Letting someone at the business step into a conversation at any time.
• Sending operational email: account verification, password reset and notifications.
• Keeping the service running and diagnosing faults.

We do not sell personal data, do not share it for advertising purposes, and do not use end customers’ conversations to train our own models.

Who we share it with

Only the providers needed to run the service, and only for that purpose:

• Language model providers (OpenAI and Anthropic): receive the message and the context needed to generate a reply. OpenAI also transcribes the voice notes customers send on WhatsApp, Instagram or Messenger into text.
• Meta Platforms: to receive and send messages on WhatsApp, Instagram and Messenger.
• Transactional email provider (Resend): for operational email.
• Infrastructure provider: where the service and databases are hosted.
• Error monitoring provider (Sentry): receives technical fault information.

How long we keep it

For as long as the account is active. If a business closes its account, we delete its data and its conversations, except anything a legal obligation requires us to retain. An end customer may request deletion at any time; see how to delete your data.

Voice notes. When a customer sends a voice note to an assistant on WhatsApp, Messenger or Instagram, we keep the audio for at most 90 days so the business can listen to it, and transcribe it with OpenAI, which acts as a processor and does not use this data to train its models. The transcript is kept as part of the conversation, like a typed message. The same applies to images: we keep them for at most 90 days and OpenAI generates a text description so the assistant can reply; they are not used to train models.

How we protect it

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored hashed, never in readable form.
• Connected channel credentials are encrypted at rest with AES-256-GCM, using different keys per environment.
• Each business is isolated: information retrieval is always scoped to that business’s own content.

Your rights

You can request access to your data, correction, deletion, or object to its processing, by writing to dgarcia@republicode.com. If you are the customer of a business that uses Agent Nimo, you may contact that business or us; in the latter case we will pass your request to whoever is responsible.

Changes to this policy

If we change it materially, we will update the date at the top and notify businesses with an active account by email.