Privacy policy
Last updated: 8 November 2026
ChatOrders (“we”, “us”) is a service that lets businesses answer their customers on WhatsApp: taking orders, bookings and requests, and answering questions. This policy explains what information we handle and why. ChatOrders is operated by Chand Rahman (chandrahman.site).
Who is responsible for what
Each business that uses ChatOrders (a “merchant”) decides how it uses its customers’ information and is responsible for it. We process that information on the merchant’s behalf, only to provide the service. For merchants’ own account details we are responsible.
What we collect
- Merchant accounts: name, email address, a securely hashed password, business details, menu or services, opening hours and settings.
- WhatsApp connection: the business phone number’s IDs and an access token from Meta, stored encrypted.
- Customers who message a business: WhatsApp phone number and profile name, the messages exchanged with the business’s bot, voice notes sent to it (converted to text), and what they order, book or request, such as items, delivery address, times and notes.
- Documents merchants upload to the knowledge base: the text is kept; the original files are not.
- Technical data: IP address and browser type for sign-ins and security logs.
How we use it
- To run the bot: reply to customers, take orders, bookings and requests, and send status updates.
- To show merchants their orders, bookings, chats and customers in their dashboard.
- To keep the service secure, prevent abuse and enforce plan limits.
We do not sell personal information and we do not use it for advertising.
Who we share it with
- Meta (WhatsApp Business Platform) — to send and receive WhatsApp messages.
- AI providers (Google Gemini, Groq, Cloudflare Workers AI, OpenRouter) — message text is sent to them to understand orders, translate replies and answer questions. We do not ask them to keep it.
- Hosting (Vercel) and database (MongoDB Atlas) providers.
- The merchant a customer is messaging.
How long we keep it
We keep information while the merchant’s account is active. Raw technical copies of WhatsApp messages are deleted after 90 days. When a merchant closes their account, or a customer asks for deletion, we delete the related information within 30 days, except where the law requires us to keep it.
Your choices and rights
You can ask to see, correct or delete your information. Customers can also ask the business they messaged. See how to delete your data.
Security
Data is encrypted in transit. WhatsApp access tokens are encrypted at rest, passwords are hashed, and admin access is restricted and logged.
Changes
If we change this policy we will update the date above.
Contact
Questions or requests: contact us through chandrahman.site.