Privacy policy

Abu Basil's Automated Assistant · Last updated: September 2026

What this is

A private personal application run by one person for their own use, working through a dedicated WhatsApp Business number. It is not a public service, creates no user accounts and shows no ads.

Data we process

• WhatsApp messages (text and voice notes) sent by the owner, and messages from external parties whose conversation the owner has authorised, plus sender numbers.
• The owner's Google data only: contacts (read), calendar (read) and sending e-mail (only after the owner confirms). We do not read the mailbox or received messages.
• Technical records: message ids to prevent duplicate processing, and error logs without message text.

For messages from numbers that are not authorised, only the technical message id is stored and no reply is sent.

How we use it

Only to carry out the owner's requests. We do not sell or rent data and do not use it for advertising.

Google user data (Limited Use)

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above, is not used to train general AI models, and is not used for advertising.

Service providers

Meta (WhatsApp) delivers messages; Google provides contacts, calendar and e-mail sending; Anthropic receives the conversation text and tool results needed to produce a reply; OpenAI receives voice recordings only to transcribe them; Make receives an event's title and time to create it; the hosting provider runs the server and database. Each is subject to its own policies.

Storage and retention

Data is stored in a database on the application's own server: recent conversation messages, authorisation records of external conversations, pending confirmations, and project and task status. It is kept until the owner deletes it. Backups are kept for a limited time (14 days). Only the server owner can access the database.

Security

Encrypted connections (HTTPS), verification of Meta's signature on every incoming message, service keys kept in a configuration file outside the code, and explicit owner confirmation before any send or event creation.

Your rights

The owner can revoke Google access at any time at myaccount.google.com/permissions and delete their data from the server. An external party who wrote to the assistant within an authorised conversation can ask for their messages to be deleted by writing to the address below.

Children

The application is not directed at children.

Contact

The contact address is added at deployment.