AsistentiAIAsistentiAI
ShqipEnglishItaliano
← Back

Privacy policy

Last updated 10 November 2026

1. Who we are

AsistentiAI (https://asistentiai.com, NIPT (tax ID) M61329506A, based in Durrës, Albania) is an Albanian platform that gives businesses an artificial-intelligence agent to answer their customers on the website, Facebook Messenger, Instagram and WhatsApp. For any privacy question, write to us at kontakt@asistentiai.com.

For customers' conversations with a business, the data controller is the business you are talking to; AsistentiAI processes that data on its behalf. For business accounts on the platform, we are the controller.

2. What data we process

  • Business account data. Name and email of dashboard users, hashed password, business name and its settings.
  • Business knowledge. Content the business uploads or that is read from its public website: products, services, prices, hours, contacts, policies.
  • Channel connection data. When a business connects a Facebook Page, Instagram account or WhatsApp number, we store their identifiers and the access tokens Meta issues. Tokens are stored encrypted and used only to receive and send that business's customer messages.
  • Conversation data. Messages the customer sends to the business and the replies sent back, the customer's identifier on the channel (e.g. WhatsApp number or Instagram ID), the display name where the platform provides it, and an optional 1–5 rating. Photos a customer sends are analysed to answer and kept in private storage, visible only to the business in the conversation.
  • Public comments. When a business turns on comment replies, we receive the comments people write on the posts of the business's own Facebook Page or Instagram account: the text, the commenter's ID and display name, and the text of the post. The agent or the business's team replies to the comment publicly and with a single private message, as Meta allows; the comment and the conversation that follows appear in the business's panel. Comments are kept for up to 120 days; a conversation that continues privately is kept like other conversations.
  • TikTok (when a business connects its own TikTok Business Account). With the business's authorization we receive the account name and photo, the list of the business's videos, comments on its videos and the messages customers send to the account. We use them only to show them in the business's panel, for replies by the business's team or assistant and, when the business asks, to publish its own videos. When the business connects TikTok from Channels, we regularly read new comments on its videos (the text and the commenter's display name and username) and the video caption, only to show them in the business's panel and to reply to them publicly under the video. We do not sell them and do not use them for advertising. When the business disconnects the account or removes the authorization, the tokens are deleted immediately and the TikTok data within 30 days.
  • Posts (when a business uses Posts in the panel). We store the text, photos and videos the business prepares and the time it chooses. We publish them only when the business presses “Publish now” or at the time it scheduled, to the Facebook Page, Instagram account and YouTube channel it connected for posts. Files are deleted from our storage after publishing; a small preview image and the links to the published posts stay in the panel until the business removes them.
  • YouTube (when a business connects its own channel for posts). With the authorization the business gives on Google (the youtube.upload and youtube.readonly scopes), we read the channel's name, handle and ID, to show which channel is connected, and upload only the videos the business chooses, with the title, description, visibility and made-for-kids setting it sets. We store an encrypted refresh token. We do not read the channel's other videos, comments, analytics or subscribers.
  • Data the customer provides for a booking, order or contact: name, phone, email and the requested service.
  • Technical data. IP address and request counters, only to prevent abuse.

We do not ask for, nor encourage customers to provide, sensitive data (health, financial, identity documents) through the conversation.

3. Why we process it

Only to provide the service: answering customer messages on the business's behalf, showing the business its conversations in its dashboard, handing a conversation to a person when needed, and improving the agent's answers for that business. We do not sell data, we do not use it for advertising, and we do not use it to train general-purpose AI models.

4. Data from Meta, Google and YouTube

Data we receive through Meta's APIs (Messenger, Instagram, WhatsApp) is used only for the messaging features described here, in accordance with Meta's Platform Terms and Developer Policies. The agent only replies to customers who wrote to the business first or commented on its posts; we never send unsolicited messages. We never sell it, never transfer it to data brokers and never use it for profiling or advertising. When a business disconnects a channel, the access tokens are deleted immediately.

AsistentiAI uses YouTube API Services. By connecting a YouTube channel, you agree to the YouTube Terms of Service; Google processes data under the Google Privacy Policy. AsistentiAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not share it with third parties and do not use it to train artificial-intelligence models. A business can disconnect the channel at any time in Posts, or revoke access in its Google security settings. Disconnecting in the panel deletes the token immediately; when access is revoked on Google, we delete the channel data within 30 days.

5. Who we share it with

We use these service providers (sub-processors), each receiving only what its function requires:

  • The artificial-intelligence provider that generates replies: Anthropic by default; if the platform assigns another provider to a business (e.g. OpenAI or Google), that business's messages are processed by that provider.
  • Voyage AI — indexing knowledge for semantic search.
  • Supabase — the database, in the European Union (Frankfurt).
  • Vercel — application hosting.
  • Meta Platforms — message delivery and post publishing on connected channels.
  • Google (YouTube) — uploading videos to the connected YouTube channel, when the business uses it.
  • Email provider — system emails (sign-in codes, notifications).

Some of these providers may process data outside Albania (in the EU or the US), under the contractual safeguards they offer. Every business has its own isolated space: one business's knowledge and conversations are never shown to other businesses.

6. Retention and deletion

Data is kept while the business's account is active, or until the business deletes it. A business can disconnect any channel at any time, and the tokens are deleted immediately. When a business is removed from the platform, we delete its account, knowledge, tokens, conversations and messages. Anyone can request deletion of their own data on the Data deletion page.

7. Your rights

Under Albanian personal-data protection law and the GDPR, you have the right to request access to, correction or deletion of your data, and to object to processing. If you chatted with a business's agent, you may contact that business or us directly at kontakt@asistentiai.com or through the deletion form; we help the business fulfil the request. You also have the right to complain to Albania's Commissioner for the Right to Information and Personal Data Protection.

8. Children

The service is aimed at businesses and their adult customers. We do not knowingly collect data from children under 16.

9. Cookies

The public website uses only a technical cookie for your chosen language, with no tracking or advertising. The dashboard uses one strictly necessary technical cookie to keep you signed in.

10. Security

Passwords are stored hashed (scrypt), channel tokens are stored encrypted, connections go over HTTPS, and dashboard access is controlled by roles and two-step verification. No system is completely invulnerable, so we work continuously to improve protection. To protect businesses and their customers, the system records unusual use of the dashboard (for example opening many conversations in a short time) and repeated requests for the agent's instructions, and alerts our team and the business's administrator.

11. Changes

If we change this policy, we update the date above and, for significant changes, notify our business customers.