Privacy Policy

Who We Are

Sotuvchi.ai is a service of Nahl Group Inc., a Delaware corporation located at 16192 Coastal Hwy, Lewes, DE 19958, USA. Nahl Group Inc. is the company responsible for the personal data of the businesses that use Sotuvchi.ai (the data controller). For the personal data of a shop's own customers, the shop decides how it is used and we process it on the shop's behalf. If you have any question about this policy or your data, write to support@nahl-group.com.

Data We Collect

We handle the following kinds of data:

• Account data: the email address you use to sign in, the workspace created for you, and the email addresses of teammates you invite.
• Instagram connection data: the ID, username, and display name of the Instagram Business or Creator account you connect, and an access token that lets us act for that account. Tokens are encrypted at rest.
• Store data: the store name and description, your products with their pictures, prices, sizes, and stock, the card number and card holder name you enter so customers can pay you, your pickup address, and the instructions you give the AI seller. If you connect MoySklad, the login or token you enter (encrypted) and the products and stock we read from it. If you set up Telegram alerts, the bot token (encrypted) and chat you choose.
• Customer messages: when a person sends a direct message to an account that has a store, we store the messages, their Instagram ID and name, and the pictures, videos, voice messages, and files they send, so the AI seller can continue the conversation and you can read it in the app.
• Order data: the products a customer orders, and the name, phone number, and delivery address the customer gives in the chat. If the customer sends a payment receipt, we store the picture or file and the amount read from it. Customers pay the shop directly. We do not process payments between a shop and its customers.
• Campaign data: the keywords, replies, messages, links, and settings you configure. When someone comments on a post or reel of a connected account, or sends it a message that matches a campaign, we receive the comment or message text together with the Instagram username and ID of the person who wrote it, and record whether our reply was delivered.
• Instagram insights: views, reach, saves, shares, and interaction totals for the connected account's own posts and reels, and a daily total of its followers, used for the reports you see in the app. These are totals, not data about individual people.
• Link statistics: when someone opens a tracked link, we record the time, the referring page, the browser user agent, and a one-way hash of the IP address. We do not store the IP address itself.
• Payment data: the plan, amount, date, and status of payments you make for Sotuvchi.ai. Card details are entered on the payment provider's page, and we never see or store full card numbers.
• Operational logs: technical records of errors and background jobs, used to keep the service running.

Other Instagram conversations shown in the in-app inbox are read from Instagram when you open them and are not kept in our database.

How We Use Data

We use this data only to run the service for you: to sign you in, connect your Instagram account, answer your customers' messages with the AI seller, create orders and hold stock while a customer pays, show you receipts to approve, match comments and messages to your keywords and send the replies you configured through the official Instagram API, alert you about new orders and chats, write approved orders to MoySklad if you connected it, show you reports, process payments for your plan, fix problems, and protect the service from abuse.

We do not sell personal data. We do not use Instagram data for advertising, we do not use it to build profiles of the people who message or comment on your account, and we do not use it to train AI models.

Instagram And Meta

Sotuvchi.ai connects to Instagram through Instagram business login and uses only the permissions you approve on the consent screen: reading basic account information, managing comments, managing messages, and reading account insights. We never ask for your Instagram password, we do not scrape Instagram, and we do not use browser automation.

We only act on comments and messages that belong to accounts you connected. A private reply is sent only to a person who commented on your post or reel, and messages are sent only to people who wrote to your account first, within the time window Instagram allows. Our use of Meta data follows the Meta Platform Terms and Instagram policies.

The AI Seller

The AI seller answers customer messages only for accounts where the owner has created a store. To write a reply, we send OpenAI the customer's message, the recent messages in that conversation, pictures the customer sent (for example a payment receipt, so the amount can be read), and the store information the AI needs: products, prices, stock, and the owner's instructions. We also send OpenAI campaign keywords to suggest other spellings of them. OpenAI uses this data only to return the answer to us and does not use it to train its models.

The owner sees every conversation and order in the app, can answer a customer personally at any time, which pauses the AI in that conversation, and can turn the AI seller off for the whole store. Orders are only confirmed when the owner approves the payment.

Who We Share Data With

We share data only with the providers needed to operate the service:

• Meta Platforms (Instagram), to receive comments and messages for connected accounts and to send replies.
• MVPS LTD, our server hosting provider, which stores the data described above on our servers.
• Amazon Web Services, which stores product pictures, files customers send, and payment receipts in a private storage bucket.
• OpenAI, which runs the AI seller as described above.
• Resend, which delivers sign-in emails and email alerts about new orders and chats.
• Telegram, only if the owner sets up Telegram alerts, to deliver those alerts, which can include an order number, customer name, and amount.
• MoySklad, only if the owner connects it, to read products and stock and to record approved orders with the customer's name and phone number.
• Payme and Stripe, which process payments for Sotuvchi.ai plans.

These providers may use the data only to provide their service to us. We may also disclose data when the law requires it or to protect the rights and safety of users and the service.

Security

Access tokens and connection secrets are encrypted at rest. Files are kept in a private bucket and shown only through short-lived links to members of the shop's workspace. Traffic to the service is sent over HTTPS. Webhook requests from Meta are verified by signature before they are processed. No system is perfectly secure, but we take reasonable steps to protect your data.

How Long We Keep Data

• Instagram access tokens: until you disconnect the account or remove Sotuvchi.ai from your Instagram settings.
• Store, products, campaigns, and settings: until you delete them or disconnect the account they belong to.
• Customer messages and the files customers send: 365 days after they were sent. A whole conversation is deleted once the customer has not written for 365 days.
• Customer name, phone number, and address on orders, and payment receipts: 365 days after the order. After that we keep only the products and totals for your sales reports.
• Commenter usernames, IDs, and comment text in delivery logs: 90 days. After that we keep only anonymous counts for your reports.
• Alerts in the app: 90 days.
• Raw webhook data received from Meta: 30 days.
• Link click statistics: 365 days.
• Technical logs: 90 days.
• Account email and workspace: until you ask us to delete your account.
• Payment records for your plan: as long as tax and accounting law requires.

Disconnecting an Instagram account deletes its token, campaigns, delivery logs, tracked links, follower counts, and its store with all products, conversations, orders, and files right away. When you ask us to delete your data, we do it within 30 days. See the Data Deletion page for every way to do this.

Your Rights

Depending on where you live, including under some United States state privacy laws, you may have the right to ask what data we hold about you, to correct it, or to have it deleted. To use these rights, email support@nahl-group.com. We may need to confirm your identity first.

Customers Of Shops

If you messaged, ordered from, or commented on an Instagram account that uses Sotuvchi.ai, the shop decides how your order is handled. You can ask the shop directly, or email support@nahl-group.comwith your Instagram username and the shop's name, and we will delete your messages, files, and contact details.

Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes

We may update this policy. The date at the top shows when it last changed. If a change is significant, we will tell signed-in users.

Contact

Nahl Group Inc.
16192 Coastal Hwy, Lewes, DE 19958, USA
support@nahl-group.com