Privacy policy

Who we are

PlutonAi is provided by ThePluton Studio L.L.C., NUI 812461052, Tirana 2, Prishtinë 10000, Kosovo. Email: hello@pluton.studio · Phone: +383 49 200 124.

Two roles

• For the businesses that use PlutonAi (their administrators and staff) we are the controller of their account data.
• For those businesses' customers, who message them on WhatsApp, Facebook (Messenger) or Instagram, the controller is the business you write to. We process that data on its behalf, as a processor, only on its instructions and only for it.

If you wrote to a business, you can send questions about your data to that business or to us; we help the business answer you.

The businesses' customers

When you message a business that uses PlutonAi, we process:

• your messages and the replies, with the photos, videos, voice messages and files you send;
• the name, username and ID Meta gives us, and on WhatsApp also your phone number;
• your Facebook or Instagram profile picture: only shown to the business's staff, never stored;
• order details when you order: name, phone, address, city and notes;
• technical delivery data: when messages were sent, delivered and read.

We never ask for card numbers, passwords or codes. Please don't send them in the chat.

The businesses

• panel accounts: name, email, role and language; passwords are stored only as a hash, never as text;
• sign-in and change records: time, IP address and what changed, to keep accounts secure;
• the connection with Meta through Facebook Login for Business: the ID of the person who connected (an ID Facebook gives only to PlutonAi), the names and IDs of the Facebook Page, Instagram account and WhatsApp number, and the business's access tokens, stored encrypted;
• the catalogue, information and settings the business writes for the assistant;
• usage (how many messages and assistant replies), for the plan and billing.

The panel uses one cookie, needed to stay signed in. There are no advertising or analytics cookies, on these pages either.

Why we use it

• so the virtual assistant can answer customers on the business's behalf: products, prices, sizes, stock and delivery;
• to take orders and pass them to the business;
• so the business's staff can see the chats and take them over when needed;
• so businesses can sign in, connect their channels and keep the service secure;
• for technical support and billing.

No ads, no sale. We don't use the data for advertising or profiling, we never sell it, and we don't use the chats to train artificial intelligence models.

The virtual assistant

The first replies are written by an artificial intelligence assistant, using OpenAI models, only from the business's catalogue and information. The assistant can make mistakes: the business's staff see the chats and can take over at any time, and you can ask to talk to a person at any time.

Who receives the data

• Meta Platforms (WhatsApp, Facebook, Instagram) delivers the messages between you and the business, under its own terms and privacy policy.
• OpenAI (USA): parts of the conversation, including photos the assistant needs to look at, are sent through its API so the assistant can write the reply. OpenAI doesn't use them to train its models and may keep them for up to 30 days to prevent abuse, then deletes them.
• The servers where the data is stored, in the European Union.
• The business you write to, and its staff.

Nobody else receives the data unless the law requires it. OpenAI is in the USA, so the parts of the conversation sent there leave Kosovo and the EU, under their data processing terms.

How long we keep it

• Chats (messages, photos and files) and the customer's profile details are deleted automatically 12 months after the last message.
• When you unsend a message on Instagram, PlutonAi deletes it automatically too.
• Full copies of the notifications Meta sends us are kept for 14 days to solve technical problems, then deleted.
• Error records are kept for 3 months; the record of changes in the panel (who changed what) for 12 months. The server's technical logs are deleted within 14 days.
• Backups are deleted within 12 days.
• Orders are kept until the business deletes them or closes its account, because it needs them for delivery, exchanges and its accounts.
• When a business stops using PlutonAi, its data (chats, orders, catalogue and accounts) is deleted within 30 days; the business can ask for a copy first.
• Copies inside Meta's apps (the business's inboxes on WhatsApp, Facebook or Instagram) are managed by the business; the copy on your phone is yours to manage.

Your rights

Under Law No. 06/L-082 on the Protection of Personal Data you have the right to:

• access your data and get a copy of it;
• have it corrected;
• have it deleted;
• restrict or object to its processing;
• complain to the Information and Privacy Agency (AIP).

Customers of a business: write “delete my data” (or «fshini të dhënat e mia») in the same chat, or write to the business or to us at hello@pluton.studio. Businesses and their staff: write to us at hello@pluton.studio. We answer within 30 days. Step by step: data deletion.

Security

Connections are encrypted only (HTTPS). Businesses' access tokens are stored encrypted (AES-256-GCM), passwords only as a hash, and each business sees only its own data. Panel access is split by role and important changes are recorded. The servers are in the European Union, behind a firewall with automatic security updates; backups are made every night.

If you find a security problem, write to hello@pluton.studio.

Changes

When we change this policy, we publish it here and update the date above. We tell the businesses by email about important changes.