Legal

Privacy Policyv1.1

Last updated 4 November 2026 (v1.1)

• Our role
• Data we process
• WhatsApp data
• How we use it
• Legal bases
• Sharing
• Retention
• Your rights
• Security
• Contact

1. Our role (controller vs. processor)

We act as a data controller for data about our direct business customers (the businesses that subscribe to the Service) and visitors to concierge.bentokit.ai. When a business customer uses the Service to talk with their end customers — for example through a website chat widget or a connected WhatsApp Business number — that business is the controller of those conversations and we act as their data processor, handling the data on their behalf and under their instructions.

2. Data we process

• Account data — name, work email, business name, and login credentials of the people who administer a workspace.
• Billing data — subscription plan and payment status. Card payments are processed by our payment provider; we do not store full card numbers.
• Knowledge-base content — the product, policy, and support material a business customer provides so the assistant can answer questions.
• Conversation data — messages exchanged between an end customer and the assistant (website widget or connected messaging channels), including message text, timestamps, and any images or voice notes the user sends.
• Contact / lead data — contact details a visitor chooses to share to be connected with a human (e.g. name, email, phone).
• Technical data — IP address, device/browser information, and basic usage logs used to operate the Service, prevent abuse, and apply rate limits.

3. WhatsApp Business Platform data

When a business customer connects a WhatsApp Business number, we use the WhatsApp Business Platform (the WhatsApp Cloud API provided by Meta) to send and receive messages on that business's behalf. In that flow we process the end customer's WhatsApp phone number, WhatsApp profile name, and message content (text, images, and voice notes) solely to deliver the business's support conversation and any human-handoff the user requests.

Meta Platforms processes this data as part of operating WhatsApp; its handling is governed by Meta's and WhatsApp's own terms and privacy policies. We do not use WhatsApp message content for advertising, and we do not sell it. Use of information received from the WhatsApp Business Platform follows Meta's Platform requirements.

4. How we use data

• To operate the assistant and generate answers from the business customer's approved knowledge base.
• To route conversations, capture human-handoff requests, and notify the business.
• To provide, secure, and improve the Service, prevent abuse, and enforce usage limits.
• To manage subscriptions and billing.
• To comply with legal obligations.

To generate answers we send the relevant conversation text and knowledge-base context to large-language-model providers acting as our processors. We do not permit those providers to use this data to train their general models.

5. Legal bases

Where the LGPD (Brazil) or GDPR (EU/UK) applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (where required, e.g. for certain messaging), and compliance with legal obligations.

6. Who we share data with

We share data only with service providers ("sub-processors") that help us run the Service, under contract and only as needed:

• Meta Platforms — WhatsApp Business Platform message delivery.
• Large-language-model providers — to generate assistant responses.
• Payment processor — subscription billing.
• Hosting / infrastructure providers — to run the Service.

We do not sell personal data. We may disclose data if required by law or to protect rights, safety, and the integrity of the Service. Some providers may process data outside your country; where required we use appropriate safeguards for international transfers.

7. Data retention

We keep personal data only as long as needed for the purposes above or as required by law. Conversation and contact data are retained for the duration of the business customer's subscription and then deleted or anonymised within a reasonable period, unless a longer period is legally required. A business customer or end user can request earlier deletion (see Data deletion).

Your account data is kept while the account exists; deleting it yourself in the product takes effect immediately (Section 8). The sign-in record (date, time, IP address and browser of each sign-in) is kept for 12 months, as Brazil's Marco Civil da Internet (art. 15) requires, even after the account is deleted. Data export files you request stay available for 7 days. Backups are erased in their rotation cycle, within 30 days.

8. Your rights

Subject to applicable law, you may request confirmation of processing, access to, correction of, deletion of, portability of, or a copy of your personal data, and you may object to or restrict certain processing or withdraw consent (LGPD, art. 18).

In the console: under Settings › Privacy and data, anyone with console access can:

• see a summary of what we keep about their account right away;
• ask for a full copy of their data: a file with a readable version (what each item is, where it came from, why we keep it and on which legal basis) and an open-format version. The link arrives by email, works for 7 days and only opens while signed in;
• delete their account. Deletion is immediate and cannot be undone. What you did in workspaces (customer conversations, notes, bookings) belongs to the company that owns each workspace and stays with it, under your name; the company is notified.

By email: write to dpo@rioblocks.io. We answer confirmation and simplified access immediately and send the full statement within 15 days (LGPD art. 19). If you are an end customer of one of our business customers, we forward your request to that business as the controller and assist as needed. You also have the right to lodge a complaint with your data-protection authority (in Brazil, the ANPD).

9. Security

We use technical and organisational measures — including encryption in transit, access controls, and secret management — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated version number and date. Continued use after a material change may require re-acceptance in the product.

10. Contact

BentoKit Concierge is operated by RioBlocks. Data protection officer (DPO): DataGuide Consultoria e Soluções em Proteção de Dados Ltda.. For privacy questions or to exercise your rights, contact dpo@rioblocks.io.

See also our Terms of Service (v2.3) and Data deletion instructions.