Privacy Policy

BaroChat is a WhatsApp AI and inventory management service for Korean grocery stores in Europe. This policy explains how personal data is collected and used when you use the BaroChat website, dashboard, and related APIs.

1. Information we collect

• Account data: email, name (if provided), login credentials (including Google OAuth)
• Store data: store name, contact details, business settings, inventory and order data
• Payment data: billing and tax-related information for subscriptions via Stripe (card numbers are processed by Stripe and not stored on BaroChat servers)
• WhatsApp integration data: Phone number ID, encrypted access tokens, business account identifiers, message metadata and content received via webhooks (to provide automated replies)
• Technical logs: IP address (security/abuse prevention), request time, error logs (designed not to log message bodies or secrets)

2. Purposes of processing

• Account creation, login, and store management
• AI auto-replies to WhatsApp customer inquiries and inventory/order information
• Subscription billing and customer support
• Security, incident response, and legal compliance

3. Processors and third parties

We may use the following processors to provide the service:

• Supabase — authentication and database
• Railway — server hosting
• Stripe — subscription payments
• Meta (WhatsApp Cloud API) — message send/receive
• Groq and similar AI providers — reply generation (with inventory/inquiry context)

We do not sell personal data for marketing, except where required by law or with your explicit instruction/consent.

4. WhatsApp and Meta

When a store connects WhatsApp, customer messages are delivered via Meta to BaroChat servers and automated replies may be sent. When a customer asks about inventory (or similar) on a store Business WhatsApp connected to BaroChat and BaroChat replies, Meta messaging fees are usually free under Meta’s current policy; store marketing/promotion sends may be charged by Meta. See WhatsApp fees.

5. Retention

Account and store data are kept while the service is used. After account deletion or contract end, we delete or anonymise data within a reasonable period unless a longer retention is required by law. Security logs are kept only for a short period.

6. Security

Access tokens are stored encrypted. Meta webhooks are processed after signature verification. Data in transit uses HTTPS. Absolute security of internet transmission cannot be guaranteed.

7. Your rights (including GDPR)

Depending on applicable law, you may have rights of access, rectification, erasure, restriction, portability, and objection. Contact [email protected]. You may also lodge a complaint with your local supervisory authority.

8. Cookies and local storage

We may store session tokens in browser local storage for login continuity. These are for essential functionality; we do not use advertising tracking cookies for that purpose.

9. Changes

If this policy changes, we update the date on this page and may notify you in-product or by email for material changes.

10. Contact

FIRASS SION S.R.L. · BaroChat privacy inquiries
[email protected]