1. Who is responsible
BZ MODE LLC ("BZ Agentic", "we") is the company responsible for processing the personal data described in this policy.
- Controller: BZ MODE LLC, Ocala, Florida, USA (dba BZ Agentic)
- Contact and privacy email: soporte@bzmode.com
Two different roles. When we process data about our own customers (the businesses that hire us) we act as the controller. When an assistant handles conversations with that business's end customers, we act as the processor: the business decides what that data is used for and we only carry out its instructions.
2. What data we process
From the business that hires us
- Contact name, email address, phone number and company name.
- Billing information and payment records.
- Technical identifiers of the accounts it connects: WhatsApp Business (WABA ID and phone number ID), Facebook Page, Instagram professional account and Meta ad account; the identifier of the person who connected them and an access token that we store encrypted.
- If it connects them, access to its Google calendar and email, only to book appointments and send its reports.
- The knowledge base it uploads: prices, services, hours and policies.
From end customers who write on WhatsApp
- Phone number and profile name as WhatsApp delivers them.
- The content of the messages exchanged with the assistant, including images and audio if they send them.
- Conversation metadata: date, time, channel, delivery status and whether the conversation was handed to a person.
- Data the person provides in the conversation: appointment date, service address, reason for the inquiry.
From people who message on Messenger or Instagram, or comment
- The identifier Meta assigns to the person in our app (not their phone number or email) and, if Meta provides it, their public name or username.
- The text of their messages, the type of any attachment (never its content) and the date and time.
- The text, identifier and public name or username of anyone who comments on the business's posts or ads.
We do not read the posts, photos, followers or insights of the Page or account.
From the business's ads
- Aggregated performance metrics (spend, reach, impressions, clicks, conversations started), which we read in read-only mode if the business shares its ad account with our Business Manager. They contain no personal data about any person, and we never create or modify ads or budgets.
- Meta lead ad forms: the data the person types into the form (for example name, email and phone number) and the ad identifier, so the business can contact them.
We do not knowingly ask for or store card numbers, passwords or identity documents. If a person types them into a conversation on their own, they are deleted when detected or when requested.
3. What we use it for and the legal basis
| Purpose | Legal basis |
|---|---|
| Operate the assistant: read the message, write the reply and carry out the action (book, update the CRM, hand the conversation to a person) | Performance of the contract with the hiring business |
| Let the business see its conversations, its contacts and how its ads perform | Performance of the contract with the hiring business |
| Contact someone who left their details in an ad form, on the business's behalf | The person's consent when submitting the form |
| Send appointment reminders and confirmations | Performance of the contract · the end customer's consent when starting the conversation |
| Marketing or re-engagement messages using templates | Prior, verifiable consent (opt-in), required by Meta's policies |
| Technical support, error diagnosis and security | Legitimate interest in keeping the service running and secure |
| Billing, accounting obligations and the record of consents and opt-outs | Legal obligation |
On Messenger and Instagram we only reply to people who wrote first and within the 24-hour window Meta allows; we send no promotional messages outside it. Replies to comments are only sent if the business turned them on, come from a list the business configures, contain no links and are rate limited per hour.
4. AI assistants
The businesses that hire us use AI assistants that reply on their behalf on WhatsApp, Messenger and Instagram. The assistant says it is an AI assistant at the start of the conversation, and the person can ask to talk to a person at the business at any time: the assistant hands the conversation over and stops replying.
To write the reply, the text of the conversation is sent to a language-model provider (currently Anthropic), contracted with the no-retention-for-training option. The data we receive from Meta is not used to train AI models and is never sold, by us or by our providers.
5. Who we share it with
We work with providers that act as sub-processors and may only process the data following our instructions:
- Meta Platforms, Inc.: transport of WhatsApp, Messenger and Instagram messages, comments and ad data. Meta's processing is governed by its own terms.
- Anthropic: language models that write the assistant's reply.
- Supabase: database and service functions, with data encrypted at rest.
- n8n: automation of the service's workflows.
- Vercel: hosting for the websites and the dashboard, and routing of AI models.
- Google: the business's calendar and email when it connects them, and the infrastructure of the Google accounts we use.
- Tools you connect: calendar, CRM or whatever system you choose. There, where the data goes is your decision.
Meta data is never sold or passed to third parties for advertising. One business's data is never shared with another. We may also disclose data when a competent authority legally requires it.
6. International transfers
Most of our providers are in the United States. When data is transferred from the European Economic Area or from other territories with equivalent rules, the transfer relies on the standard contractual clauses approved by the European Commission or on the applicable adequacy mechanism.
7. How long we keep it
- Conversations and metadata (WhatsApp, Messenger and Instagram): 24 months from the last message; then they are deleted. The hiring business may set a shorter period.
- Ad metrics: 25 months.
- Raw data from ad forms: 90 days.
- Record of consents and opt-outs: 5 years, as a legal obligation, so we can show that we honored the opt-out.
- Contact data and the end customer's profile: for as long as the hiring business keeps the service active.
- Billing: the period required by the applicable tax rules.
- Technical logs: 90 days.
When a person deletes a message on Messenger or Instagram, we delete it from our copy when Meta notifies us. The access token is deleted when the business disconnects the account, when the person who connected it removes our app from their Facebook or Instagram account, or when they request the deletion of their data. When the contract ends, data is deleted or returned within 30 days at most, unless the law requires us to keep it.
8. Your rights and how to request deletion
You can request access, correction, deletion, restriction, objection and portability of your data, and withdraw your consent at any time. There are two ways to request deletion:
- From Facebook or Instagram. Remove our app under Settings → Business integrations (Facebook) or Apps and websites (Instagram) and request the deletion of your data. Meta notifies us automatically and you receive a confirmation code with a link where you can see the status of your request:
https://app.bzagenticsolutions.com/datos/estado/<code>. - By email. Write to soporte@bzmode.com saying what you are asking for and which number, Page or account you talked to. We reply and complete the request within 30 calendar days at most.
If you are an end customer of a business that uses our assistants, you can also ask that business, which decides about that data; if you write to us, we will pass your request to it and tell you. The detailed procedure is at Data deletion. If you believe we have not handled your request properly, you can complain to the data protection authority in your country.
9. How to stop receiving messages
Reply STOP in the same conversation (WhatsApp, Messenger or Instagram). The assistant stops writing to you right away and the contact is marked so it receives no promotional messages.
10. Security
Data is encrypted in transit (TLS) and stored encrypted at rest; access tokens are stored encrypted. Access is limited to the staff who need it to run the service, with two-factor authentication. Every action the assistant takes is logged. If a security breach affecting personal data occurs, we will notify the hiring business and the competent authority within 72 hours of learning about it.
11. Children
The service is not directed to anyone under 18 and we do not knowingly collect data from children. If we find that we processed a child's data without the authorization of the person who has custody, we will delete it.
12. Cookies
This website does not use tracking or advertising cookies. Fonts are loaded from Google Fonts, which may record the IP address of the request under its own privacy policy.
13. Changes to this policy
If we change this policy, we will update the date at the top. When a change significantly affects how we process data, we will email the hiring businesses at least 15 days in advance.
14. Contact
BZ MODE LLC, Ocala, Florida, USA (dba BZ Agentic) · soporte@bzmode.com