AI Assistant Platform for WhatsApp, Instagram & Web
2.1 The Platform enables the Customer to connect its WhatsApp, Instagram and/or web channels and to operate an AI Assistant that automatically replies to End User messages on the Customer’s behalf, and that can take bookings, share information and route requests to the Customer.
2.2 The AI Assistant is configured for the Customer’s sector. It is designed to respond only to messages within that scope, to decline or not respond to out-of-scope questions, and where relevant to ask End Users whether they wish to make a reservation or similar request related to the Customer’s business.
2.3 The AI Assistant does not, of its own initiative, send unsolicited or marketing messages to End Users or to any third party. It operates in response to incoming messages and within the configured logic.
2.4 The Service is provided on a software-as-a-service basis. The Provider may update, modify, or improve the Platform at any time, including to maintain compatibility with third-party platforms.
3.1 Access may be offered on a free trial basis. The Provider may change, limit, suspend, or end any trial at any time without liability.
3.2 Where the Service becomes paid, fees, billing cycles and any taxes (including Portuguese IVA where applicable) will be as displayed at the point of subscription. Payments are processed by Stripe. By subscribing you also accept Stripe’s applicable terms.
3.3 Unless required by mandatory law, fees are non-refundable once the applicable billing period has started. Statutory consumer withdrawal rights, where they apply, are unaffected.
3.4 The Provider may change its list prices. Any price change: (a) will be notified to the Customer by email and in-panel notice at least 30 days before it takes effect; (b) applies only from the first renewal period following that notice and does not affect the billing period in progress; (c) entitles the Customer to cancel the subscription before the effective date without any penalty or additional charge; and (d) once in effect, continued use of the Service constitutes acceptance of the new price.
3.5 Promotional and discounted prices. Campaign, coupon and promotional prices are not a permanent price guarantee. They apply for as long as the conditions of the relevant campaign remain in place and the subscription remains continuously active. If the subscription is cancelled or otherwise ends, the discount is lost and the price in force at that time applies on any new subscription. Where a discount is defined as a fixed amount, changes to the list price apply equally to the discounted price. The Provider may revise or end a discounted price subject to the notice period and cancellation right set out in clause 3.4.
3.6 Automatic renewal. Unless cancelled, the subscription renews automatically for a further period of the same length and is charged at the price in force at the time of renewal. The Customer may cancel from the panel before the renewal date; cancellation takes effect at the end of the current period.
4.1 The Customer must provide accurate registration information and keep it up to date.
4.2 The Customer is responsible for all activity under its account and for keeping its credentials secure.
4.3 The Customer must be at least 18 years old and, where acting for a business, duly authorised to bind that business.
4.4 Acceptance of these Terms is recorded electronically at registration, including a timestamp and the version accepted. The Customer agrees this record is valid evidence of acceptance.
5.1 Instagram. Instagram accounts are connected through Meta’s authorised interfaces (Facebook / Instagram Graph API) under the permissions granted to the Provider. The Customer authorises the Provider to access and process messages and related data solely to provide the Service.
5.2 WhatsApp — official methods. Where the Customer connects via the WhatsApp Business Platform or WhatsApp coexistence functionality, the connection relies on Meta’s official mechanisms. The Customer must comply with the WhatsApp Business Terms and Meta’s policies at all times.
5.3 WhatsApp — QR code connection (important risk). The Customer understands and expressly accepts that connecting a WhatsApp number by QR code linking may rely on methods that are not officially supported by Meta and may breach the WhatsApp Terms of Service. This can result in Meta restricting, suspending, or permanently banning the WhatsApp number, without notice and outside the Provider’s control. The Customer chooses this connection method at its own risk. The Provider is not liable for any suspension, ban, loss of number, loss of message history, or business interruption arising from the QR connection method. The Provider recommends using officially supported connection methods where available.
5.4 Web channel. Where the Customer embeds the Provider’s web chat widget, conversations through that widget are processed by the Platform on the same basis as the other channels.
5.5 The Customer is solely responsible for ensuring that its use of WhatsApp, Instagram and the web channel through the Platform complies with all Meta Platforms terms and policies. The Provider does not control and is not responsible for the acts, decisions, outages, or enforcement actions of Meta Platforms.
The Customer must not, and must not allow any End User interaction to be used to:
The Provider may suspend or terminate access immediately for breach of this section.
7.1 The AI Assistant generates responses automatically using third-party AI models. Outputs may occasionally be inaccurate, incomplete, or unsuitable. The Provider does not warrant that responses are error-free.
7.2 The Customer is responsible for reviewing the AI Assistant’s configuration and for any reliance placed on its outputs by the Customer or its End Users. The AI Assistant does not provide professional, legal, medical, or financial advice.
7.3 The Customer remains responsible for its own communications with, and obligations to, its End Users, including honouring reservations or commitments arising from conversations.
8.1 The Platform, including all software, design, and documentation, remains the exclusive property of the Provider. No rights are granted except the limited right to use the Service under these Terms.
8.2 The Customer retains ownership of its own Content. The Customer grants the Provider a limited licence to host and process that Content solely to provide the Service.
9.1 The processing of personal data is governed by the Data Processing Agreement (DPA) in Part B of this document, which forms an integral part of these Terms.
9.2 In broad terms, the Customer acts as data controller for End User personal data, and the Provider acts as data processor, processing such data only on the Customer’s documented instructions.
9.3 The Customer is responsible for having a valid lawful basis and for providing all required notices to its End Users regarding the processing performed through the Platform, including the use of AI and any international transfers. Conversations and contact details processed through the Platform are made available to the Customer in its panel for this purpose.
10.1 The Provider will provide the Service with reasonable skill and care.
10.2 To the maximum extent permitted by law, and without prejudice to mandatory consumer rights, the Service is otherwise provided “as is” and “as available”. The Provider does not warrant uninterrupted or error-free operation, or that the Service will be compatible with future changes made by Meta Platforms or by AI model providers.
10.3 The Provider is not responsible for third-party services (including Meta Platforms, Stripe, and AI model providers), nor for the consequences of their acts, outages, policy changes, or enforcement decisions.
11.1 Nothing in these Terms limits liability that cannot be limited by law, including liability for fraud, intent, gross negligence, or death or personal injury caused by negligence.
11.2 Subject to clause 11.1, the Provider is not liable for: (a) loss of profit, revenue, business, or goodwill; (b) loss or corruption of data beyond the Provider’s reasonable control; (c) indirect or consequential loss; or (d) any suspension, ban, or action taken by Meta Platforms or other third parties.
11.3 Subject to clause 11.1, the Provider’s total aggregate liability arising out of or in connection with the Service in any 12-month period is limited to the total fees paid by the Customer to the Provider in that period, or EUR 100 where the Service was provided free of charge.
To the extent permitted by law and without prejudice to the Customer’s mandatory consumer rights, the Customer shall indemnify the Provider against claims, losses, and costs arising from: (a) the Customer’s breach of these Terms or of Meta Platforms’ policies; (b) the Content processed on the Customer’s behalf; (c) the Customer’s relationship with, and obligations to, its End Users; and (d) the Customer’s failure to obtain a lawful basis or provide required notices under data protection law.
13.1 Either party may terminate on 30 days’ written notice. The Provider may suspend or terminate immediately for breach, legal requirement, or risk to the Platform or third parties.
13.2 On termination, the Customer’s access ends and the Provider will delete or return personal data in accordance with the DPA.
The Provider may update these Terms. Material changes will be notified by email and in-panel notice at least 30 days before they take effect. The Provider may require the Customer to accept an updated version from the panel and records that acceptance with its date, version and IP address. Continued use after changes take effect constitutes acceptance. Each version is identified by a version number and effective date.
15.1 These Terms are governed by the laws of Portugal.
15.2 The courts of Porto, Portugal have jurisdiction, without prejudice to any mandatory consumer protection that entitles a consumer to bring proceedings in their place of residence or to mandatory EU rules.
16.1 If any provision is held invalid, the rest remains in force, and the invalid provision is replaced by an enforceable one closest to the original intent (severability).
16.2 Failure to enforce a right is not a waiver of it.
16.3 These Terms, together with the DPA, are the entire agreement between the parties regarding the Service.
This DPA forms part of the Service Agreement. The Customer is the Controller and the Provider is the Processor with respect to the personal data of End Users processed through the Platform.
B2.1 The Processor processes personal data only to provide the Service and only on the Controller’s documented instructions, including the instructions set out in this DPA and the configuration chosen by the Controller, unless required to act by EU or Member State law.
B2.2 The Processor will inform the Controller if, in its opinion, an instruction infringes data protection law.
The Processor ensures that persons authorised to process the personal data are bound by confidentiality.
The Processor implements appropriate technical and organisational measures, taking into account the state of the art and the risk, including as applicable: encryption of data in transit and, where appropriate, at rest; access controls and authentication for systems handling personal data; logical separation of customers’ data; logging and monitoring of relevant access and processing; regular review of measures and timely application of security updates; data minimisation and defined retention.
B6.1 The Controller gives general authorisation for the Processor to engage sub-processors. The Processor imposes data protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their performance.
B6.2 Current sub-processors:
| Sub-processor | Purpose | Location / transfer basis |
|---|---|---|
| Stripe | Payment processing | EU/US - DPA + SCCs |
| OpenRouter | AI model routing for assistant replies (routes to models such as DeepSeek and Anthropic Claude) | US - DPA + SCCs |
| Google (Gemini) | Message embeddings for knowledge search | US - DPA + SCCs |
| Cloudflare | CDN, DNS and security (WAF) | US/global - DPA + SCCs |
| Resend | Transactional and notification email | US - DPA + SCCs |
| Apple (APNs) | iOS push notifications | US - DPA + SCCs |
| Google (FCM) | Android push notifications | US - DPA + SCCs |
| Hetzner | Cloud hosting and infrastructure | EU/EEA region - DPA |
B6.3 The Processor will inform the Controller of intended changes to sub-processors and give the Controller the opportunity to object on reasonable data protection grounds.
B6.4 Meta Platforms (WhatsApp, Instagram) is not a sub-processor: it is an independent provider that the Customer connects to and that acts as an independent controller for its own platform. The Customer's use of it is governed by Meta's own terms (see clause 5).
Where personal data is transferred outside the EEA (for example to AI model providers), the Processor ensures an appropriate safeguard is in place, such as the European Commission’s Standard Contractual Clauses, together with any necessary supplementary measures.
B8.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures to respond to data subject requests (access, rectification, erasure, restriction, portability, objection).
B8.2 If the Processor receives a request directly from a data subject, it will forward it to the Controller and not respond itself unless legally required.
B8.3 The Processor assists the Controller with security, breach notification, and data protection impact assessments under Articles 32–36.
The Processor notifies the Controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach, providing the information the Controller reasonably needs to meet its own notification obligations.
On termination, or on the Controller’s request, the Processor deletes or returns the personal data and deletes existing copies within 30 days, unless EU or Member State law requires storage. In addition, any message older than 90 days is automatically deleted, including messages inside active conversations, so no customer conversation history older than that period is kept; the Controller may also request deletion of specific data, or of all its data, at any time.
The Processor makes available information necessary to demonstrate compliance with Article 28 and allows for and contributes to reasonable audits, on reasonable notice and subject to confidentiality, including via third-party reports where available.
Liability under this DPA is subject to the limitations in the Service Agreement, except where such limitation is not permitted by the GDPR. In case of conflict on data protection matters, this DPA prevails over the Service Agreement.
By registering for and using the Platform, the Customer accepts this Service Agreement and the DPA. Electronic acceptance is recorded with a timestamp and version number and constitutes a binding agreement.