Privacy Policy

Last updated: 16 October 2026

RootChat (“RootChat”, “we”, “us”) is a software service operated by Brainroot Digital, Bangladesh. It helps businesses (“clients”) answer their customers on Facebook Messenger, Instagram, WhatsApp and website chat, take orders and manage their sales. This policy explains what data we handle, why, and the choices you have.

1. Who this policy covers

• Clients — businesses and their team members who log in to the RootChat dashboard.
• End customers — people who message a client's Facebook Page, Instagram account, WhatsApp number or website chat, or place an order on a client's shop page.

For end customers' data, the client is the data controller and RootChat processes the data on the client's behalf to provide the service.

2. Data we collect

• Account data: name, email address, password (stored only as a secure hash), role and login history of client team members.
• Business data: the client's products, prices, stock, settings, orders, coupons and campaigns.
• Messages: the content of messages, photos, voice notes and comments sent to or from the client's connected Pages, accounts and website chat, with the time they were sent.
• Customer details from Meta platforms: the page-scoped ID, public profile name and profile picture that Facebook, Instagram or WhatsApp provide for a person who messages the client.
• Order details: name, phone number, delivery address, items and payment reference (such as a bKash or Nagad transaction ID) that a customer gives when ordering.
• Connection tokens: access tokens that Meta gives when a client connects a Page or account. These are stored encrypted.
• Technical data: IP address, browser type and error logs, used to keep the service secure and working.

3. How we use data

• To receive messages and send replies on the client's behalf, written by the client's team or by RootChat's AI assistant.
• To let the AI answer questions about the client's products, take orders, book appointments and open support tickets.
• To create and track orders, book couriers, and send order updates by Messenger, WhatsApp or SMS.
• To show the client reports about their chats and sales.
• To secure accounts (for example login codes sent by email) and to prevent abuse.

We do not sell personal data, use it for advertising, or share one client's data with another client.

4. Data from Facebook, Instagram and WhatsApp

When a client connects a Facebook Page, Instagram professional account or WhatsApp Business number, RootChat uses Meta's official APIs only to read and reply to that account's messages and comments, read its posts to understand which products they show, and receive message status updates. We use this data only to provide the features the client turned on, in line with the Meta Platform Terms and Developer Policies. A client can disconnect a Page or account at any time from Channels in the dashboard, or remove RootChat from their Facebook settings under Business Integrations.

5. AI processing

To write replies, understand photos and transcribe voice messages, the relevant message content and the client's product information are sent to our AI provider (OpenAI) through its API. Under OpenAI's API terms this data is not used to train their models. Clients can see and take over any AI conversation at any time.

6. Other service providers

We share only what is needed with providers that help us run the service: our cloud server host, our email provider (for login codes and notices), SMS providers (to deliver order SMS), and the courier companies a client chooses (Steadfast, Pathao, RedX) to deliver parcels. Each receives only the data needed for its task.

7. Security

Data is sent over HTTPS. Passwords are hashed, and access tokens, API keys and secrets are encrypted at rest. Each client's data is kept separate, team access is limited by role, and new devices need an email code to log in. No system is perfectly secure, but we work to protect your data and will notify affected clients of a breach as required by law.

8. How long we keep data

We keep data while the client's account is active. When a client closes their account, we delete their data, including their customers' messages and orders, within 30 days, except where the law requires us to keep records longer. Backups are overwritten within a further 30 days.

9. Your choices and rights

• Clients can view, edit, export and delete their products, orders and customer records in the dashboard.
• End customers can ask the business they messaged, or us directly, to access or delete their data. See our data deletion instructions.
• You can ask us what data we hold about you, or to correct it.

10. Children

RootChat is a business tool and is not directed at children under 13. We do not knowingly collect data from children.

11. Changes

We may update this policy. We will change the date at the top and, for important changes, tell clients in the dashboard or by email.

12. Contact