Privacy Policy.

Cortexis Solution Hub Pvt Ltd (“Cortexis”, “we”, “us”, “our”) operates Cortexis Your Bot, a platform that allows businesses to connect their WhatsApp Business Account and/or their Instagram professional account and deploy an AI-powered assistant that responds to their customers’ messages automatically across those channels. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have — whether you’re a business using Cortexis Your Bot (“Business User”) or a customer messaging a business that uses Cortexis Your Bot (“End User”).

This policy applies to our website, our dashboard application, our backend API, and our integrations with the WhatsApp Business Platform and with Instagram Messaging, both operated by Meta Platforms, Inc. (“Meta”).

We collect different categories of information depending on how you interact with Cortexis Your Bot.

From Business Users (accounts on our platform)

From End Users (customers messaging a business that uses the assistant)

We do not require End Users to create an account, and we do not collect information from End Users beyond what is exchanged in their conversation with a Business User’s assistant.

A Business User connects each messaging channel themselves, and each connection gives us an access token scoped specifically to the account they authorized. We use those tokens only for the purposes below — never to browse, post, advertise, or read anything outside the connected messaging inbox.

WhatsApp Business Platform

When a Business User connects their WhatsApp Business Account through Meta’s Embedded Signup flow, we use the resulting token only to:

• Register the business’s phone number for use with the WhatsApp Cloud API
• Receive incoming messages sent to the connected number
• Send AI-generated responses back to the business’s customers on their behalf
• Display conversation history within the Business User’s own Cortexis Your Bot dashboard
• Subscribe to webhook notifications for that specific WhatsApp Business Account

Instagram Messaging

When a Business User connects their Instagram professional account, we use the resulting token only to:

• Identify the connected Instagram professional account and confirm the Business User controls it
• Receive direct messages sent to that account’s inbox via Meta’s messaging webhooks
• Send AI-generated replies back to those conversations on the business’s behalf
• Display conversation history within the Business User’s own Cortexis Your Bot dashboard

We do not read, collect, or store Instagram content outside the direct-message inbox of a connected account. We do not access follower lists, media, insights, or advertising data, and we do not publish content to any connected account.

Messages sent to a connected WhatsApp number or Instagram professional account are processed by an AI language model to generate a contextually relevant response. This processing happens automatically and in near real time, using:

• The instructions and personality the Business User has configured for their assistant
• Any documents the Business User has uploaded as reference material
• Recent conversation history, to maintain context across a conversation

Message content is used solely to generate the assistant’s reply. It is not used to train third-party foundation AI models, and it is not sold, rented, or shared with advertisers or data brokers.

We do not sell personal information. We share data only in the following limited circumstances:

• With Meta: to deliver and receive messages via the WhatsApp Business Platform and Instagram Messaging, as required for the service to function.
• With infrastructure providers: cloud hosting, database, and AI processing providers who process data on our behalf under contractual confidentiality obligations, solely to operate the platform.
• For legal reasons: if required to comply with a subpoena, court order, or other legal process, or to protect the rights, property, or safety of Cortexis, our users, or the public.
• Business transfers: if Cortexis is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to this policy.

• Encryption in transit: All connections to our platform use TLS/HTTPS encryption.
• Encryption at rest: Sensitive credentials — including WhatsApp and Instagram access tokens, two-step verification PINs, and API keys — are encrypted before being stored in our database.
• Access control: Each Business User account can only access its own connected WhatsApp and Instagram accounts, conversations, and configuration data. Ownership is verified on every request.
• Webhook verification: Incoming messages from Meta are cryptographically verified to prevent spoofed or forged data from being processed.
• Rate limiting: Authentication and verification endpoints are rate-limited to reduce the risk of automated abuse.

No method of transmission or storage is 100% secure. While we work to protect your information using industry-standard practices, we cannot guarantee absolute security.

We retain account and conversation data for as long as an account remains active, so Business Users can review past customer interactions and maintain continuity of their assistant’s context. If an account is deleted, associated WhatsApp and Instagram credentials, configuration data, and conversation history are deleted or irreversibly anonymized within 30 days, except where retention is required to comply with legal obligations, resolve disputes, or enforce our agreements.

We rely on the following categories of third-party infrastructure to operate Cortexis Your Bot:

• Meta platforms — the WhatsApp Business Platform and Instagram Messaging, for sending and receiving messages on connected accounts, governed additionally by the WhatsApp Business Messaging Policy, the Instagram Platform Policy, and Meta’s Privacy Policy.
• AI language model providers — to generate assistant responses to customer messages in real time.
• Cloud hosting and database providers — to store account, configuration, and conversation data securely.
• SMS/OTP delivery providers — to deliver one-time passcodes used for account verification.

Each of these providers is contractually bound to use data only as necessary to provide their service to us, and not for their own independent purposes.

If you are located in the European Economic Area, United Kingdom, or a jurisdiction with similar data protection laws, you may also have the right to restrict or object to certain processing, and to lodge a complaint with your local data protection authority.

To request deletion of your account, connected WhatsApp or Instagram data, or conversation history, email us at [email protected] with the phone number or account associated with your Cortexis Your Bot account. We will verify the request and process it within 30 days. See our dedicated Data Deletion page for full instructions.

Our website and dashboard may use essential cookies required for authentication and session management (for example, to keep you logged in). We do not use third-party advertising cookies or cross-site tracking.

Your information may be processed and stored on servers located outside your country of residence. Where this occurs, we take steps to ensure an adequate level of protection consistent with this Privacy Policy and applicable law.

Cortexis Your Bot is intended for use by business owners and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be reflected by updating the “Last updated” date at the top of this page, and where appropriate, we will provide additional notice.

Questions about this Privacy Policy or how your data is handled can be sent to:

• Email: [email protected]
• Company: Cortexis Solution Hub Pvt Ltd, Pakistan