Privacy Policy

Google User Data and Limited Use

Sapt offers optional integrations with Google services. You are never required to connect a Google account to use Sapt. When you choose to connect one, Sapt requests access through Google OAuth and you can review and approve the requested permissions before any access is granted.

Google API Scopes We Request

• https://www.googleapis.com/auth/calendar.readonly — Read-only access to your Google Calendar, used to check your existing booked meetings and availability so Sapt can show your schedule and avoid double-booking.
• https://www.googleapis.com/auth/calendar.events — Used to create, update, and manage calendar events on your calendar at your direction (for example, booking a meeting you have asked Sapt to schedule).

We request the minimum scopes required to deliver these user-facing features. Google Calendar data is accessed only to check your booked meetings and to create or manage events on your calendar, at your direction.

Google API Services User Data Policy — Limited Use

How Google User Data Is Handled in Our AI Integration

• Relevant connected-calendar information, such as availability and appointment details, may be included in AI context when needed to answer a scheduling request. Cloudflare and Google Gemini process this context as described below.
• We do not use Google user data to train or fine-tune AI models, sell it, or use it for advertising or ad targeting. Transfers are limited to providing the connected user-facing service, security, and compliance with law, subject to Limited Use.
• Human access to Google user data is restricted to what is necessary to support the service, investigate a security incident, or comply with law, with consent where required by Google's Limited Use requirements.

Retention, Deletion, and Revoking Access

We retain Google user data only for as long as needed to provide the connected feature. You may disconnect your Google account from within Sapt at any time, or revoke Sapt's access directly from your Google Account permissions page. When you revoke access or delete your Sapt account, we delete the Google user data we hold, other than data we are required to retain by law. You can also request deletion at any time by emailing privacy@sapt.ai.

WhatsApp and Meta Data

Businesses can optionally connect a WhatsApp number to Sapt through the WhatsApp Business Platform, using Meta's Embedded Signup. Connecting is never required. The business keeps ownership of its WhatsApp Business Account and phone number, and it pays Meta directly for any WhatsApp charges.

Meta Permissions We Request

• whatsapp_business_management: used to see the WhatsApp Business Account and phone numbers the business chose to connect, register those numbers for messaging, and subscribe Sapt to their message notifications.
• whatsapp_business_messaging: used to receive the messages customers send to the business's WhatsApp number and to send the business's replies.

What We Receive

• Messages and media that customers send to the connected number, and the replies the business sends, including replies sent from the WhatsApp Business app on the same number.
• Customers' WhatsApp phone numbers and profile names, and message delivery and read statuses.
• For a number that stays on the WhatsApp Business app: the names of its saved contacts and, at connection, its recent chat history, so earlier conversations appear in the business's inbox.

How We Use It

• To show each conversation in the business's Sapt inbox, to let the business and the AI assistant it configures reply, and to run the automations the business sets up. AI processing follows Artificial Intelligence and Third-Party AI Providers.
• Sapt sends WhatsApp messages only on behalf of the connected business, at its direction or through its configured assistant, and in line with the WhatsApp Business Messaging Policy.
• We do not sell WhatsApp data, use it for advertising, or use it to train AI models.

Disconnecting and Deleting WhatsApp Data

A business can disconnect WhatsApp in Sapt at any time. So that no customer message is lost, messages sent to a disconnected number still appear in the business's Sapt inbox until the business also removes Sapt's access in its Meta Business settings; after that, Sapt receives nothing for that number. To delete WhatsApp data Sapt holds, email privacy@sapt.ai from the account owner's email address; we delete it within 30 days, other than data we are required to keep by law. When a business's Sapt workspace is deleted, its WhatsApp data is deleted with it. Customers who messaged a business can ask that business, or privacy@sapt.ai, to delete their messages.

Artificial Intelligence and Third-Party AI Providers

Sapt uses third-party AI to draft and improve replies, transcribe audio, summarize conversations, and operate the AI assistants and automations configured by your business. Sapt does not train or fine-tune its own AI models using your data.

Who Receives Data

• Cloudflare processes requests through Workers AI, including hosted language and transcription models, and routes requests through AI Gateway. Cloudflare's hosted models do not require sending your prompts to the model author merely because its model is used.
• Google processes requests using Gemini through Cloudflare AI Gateway's paid Unified Billing service, including assistant reasoning, summaries, and other configured AI tasks.

What Data Is Shared and Why

Depending on the feature, requests include relevant customer names and contact details; conversation history, message subjects and draft text; notes and business information; appointment and availability details; attachments; and call or voice recordings and transcripts. These may contain personal information supplied by you, your business, or your customers. We assemble this context from the information you enter or upload, your business's stored records, and integrations your business connects, to perform the requested or configured AI task.

Permission and Withdrawal in iOS

After sign-in, the iOS app explains these recipients, data categories, and purposes and asks you to select "Allow AI data sharing" before enabling the connected business workspace. If you decline, the app signs you out without enabling business-data requests or background replies from that device. Permission is tied to the session and disclosure version on that device; sign-in alone is not consent.

You can withdraw permission and sign out at Shop → Account → AI data sharing (Settings → AI data sharing in version 1.0). Withdrawal stops new requests from that device; it does not undo completed processing, delete previously shared data, or change existing business automations or other team members' access. Your business controls its connected channels and automations. Contact privacy@sapt.ai to request access, deletion, or restriction of stored data.

Protection and Retention

We require third parties receiving personal data to provide the same or equal protection described in this policy, including limited-purpose processing, confidentiality, security safeguards, and applicable deletion obligations. AI processing is subject to the providers' applicable service and data-protection terms. Cloudflare does not use customer content to train generative AI unless separately agreed, and Google's paid Gemini terms exclude using prompts and responses to improve its products. Sapt does not authorize model training on your content.

AI inputs and outputs may be retained in business records and access-controlled operational logs as needed to provide, troubleshoot, and secure the service. Providers may retain data for abuse prevention or legal obligations under their applicable terms; we do not promise zero retention. See Cloudflare's AI terms and Google's Gemini API terms.