Privacy Policy

Last updated: June 25, 2026

This Privacy Policy describes how Aviyar("we", "us") collects, uses, and protects information when businesses use our messaging automation platform at https://aviyar.online.

Who we serve

Aviyar is a business-to-business service. Our customers are businesses that connect their own Instagram Professional Accounts, Facebook Pages, and WhatsApp Business Accounts to automate and manage customer conversations.

Information we may process

To provide messaging automation services, we may process:

• Instagram direct messages and Instagram comments
• Facebook Page messages (Messenger)
• WhatsApp Business messages
• Sender profile identifiers (such as Page-Scoped IDs, Instagram-scoped user IDs, or WhatsApp phone numbers)
• Timestamps associated with messages and events
• Conversation content required to display threads and run automations
• Webhook events delivered by Meta platforms
• Access tokens and authorization data obtained through customer-authorized OAuth connections
• Workspace and team data (user accounts, roles, and configuration)
• Automation flow configuration (triggers, replies, routing rules, and templates)

We process this data only to provide messaging automation services — including displaying conversations, executing authorized flows, routing to human agents, logging delivery status, and maintaining secure integrations.

What we do not do

• We do not scrape data or access accounts without authorization.
• We do not sell personal data.
• We do not message users without the business customer's configuration and applicable platform policies.

Data sharing

We do not sell or rent personal data. We share data only as needed to operate the service:

• With the business customer that owns the connected channel and its authorized team members.
• With infrastructure processors acting on our instructions (see below).
• With Meta and WhatsApp platforms as required to deliver and receive messages you authorize.
• When required by law, legal process, or to protect against fraud and abuse.

Infrastructure processors (sub-processors)

We rely on third-party infrastructure providers to host and operate the service, such as cloud hosting, database, logging, and email delivery providers. These processors are contractually bound to process data only on our instructions and to maintain appropriate security. A current list is available on request to privacy@aviyar.online.

International processing

Data may be processed or stored in countries other than where you or your end users are located. Where we transfer data across borders, we apply appropriate safeguards consistent with applicable data protection laws.

Your rights — access, correction, export, deletion

Depending on your jurisdiction, you may have the right to access, correct, export, or delete personal data, and to object to or restrict certain processing. To exercise these rights:

• Access or correction requests: email privacy@aviyar.online.
• Data export requests: we provide a machine-readable copy of your account data on verified request.
• Deletion requests: follow the steps on our Data Deletion page.

End users of a business customer may also contact that business directly, since the business is the controller of its customer conversations.

Token handling and encryption at rest

Access tokens obtained through customer-authorized OAuth connections are treated as sensitive credentials. They are encrypted at rest, access is restricted on a least-privilege basis, and they are never written to application logs or webhook logs.

Token revocation on disconnect

When a workspace disconnects a channel (Instagram, Facebook Page, or WhatsApp Business account), the associated access tokens are revoked and deleted from our systems, and we stop processing new events for that channel.

Webhook payload retention

Webhook events delivered by Meta platforms are processed to operate automations and conversation history. We retain webhook payloads only as long as needed for service functionality, troubleshooting, and legal obligations, after which they are deleted or anonymized.

Redaction in production logs

In production, our logging redacts sensitive content: we never log access tokens or full private message content. Webhook logs contain only sanitized metadata such as object type, entry counts, field names, and timestamps.

Data retention

We retain data for as long as needed to provide the service or as required by law. Customers may request deletion as described on our Data Deletion page.

Security

We use industry-standard safeguards including encrypted transport (HTTPS), encryption of sensitive credentials at rest, access controls, and least-privilege practices. Access tokens are stored securely and are not logged in production webhook processing.

Contact

Privacy questions or requests: privacy@aviyar.online (general contact: hello@aviyar.online)

Data deletion requests are typically completed within 30 days of verification.