Privacy Policy

Koda Chatbot (chatbot.koda.mn) is operated by Green Spring LLC, Ulaanbaatar, Mongolia (“we”, “us”). We provide businesses (“customer businesses”) with an AI assistant that answers their customers (“end users”) on Messenger, Instagram, WhatsApp, Telegram, Viber and web chat. This policy explains what information we collect, how we use and protect it, and how it is deleted.

We are responsible for the account data of customer businesses. Messages that end users send to a customer business are processed on that business’s behalf and according to its instructions.

1. Information we collect

• Business accounts: name, email, phone, password (stored only as a hash), business details, product catalog and team members.
• Connected channels: the name and ID of the Facebook Page and Instagram professional account, their access tokens, and Telegram and Viber bot tokens. Tokens are stored encrypted.
• Information from Meta (Facebook and Instagram): messages, attachments and button clicks sent to the business’s Page or Instagram account; the Page-scoped and Instagram-scoped user IDs (PSID, IGSID); the name and profile picture Meta provides; and, when the business turns on comment automation, comments on its posts together with the commenter’s name and ID.
• Information end users give in chat: name, phone number, delivery address and notes for orders and bookings.
• Payments: QPay invoice numbers and payment status. We never store card details.
• Technical data: IP address, browser information and system logs, used for sign-in security and abuse prevention.

2. How we use it

• To answer end users on behalf of the business with AI: showing products, taking orders and bookings.
• To show the business its conversations, orders and reports, and to hand a conversation to its staff when needed.
• To reply to comments and send the commenter one private message, following rules the business has set up.
• For billing, security, troubleshooting and support.

We do not sell personal information, use it for advertising, or use it to train AI models. Data received from Meta is used only to provide the service described above.

3. Who we share it with

• Anthropic (Claude API): the AI service that drafts replies. Message content is sent only to generate a reply. Under its commercial terms, Anthropic does not train its models on data sent through its API.
• Meta (Facebook, Instagram, WhatsApp), Telegram and Viber: to receive and deliver messages.
• QPay: to process payments.
• Hosting and email providers: to store data and send notifications.

We do not give information to anyone else unless the law requires it.

4. How long we keep it

• Chat history (messages, comments, notifications) is deleted automatically after 24 months.
• When a business disconnects a channel, that Page’s access token is deleted immediately and our webhook subscription is removed.
• Orders and bookings are kept while the business account is active.
• When a business account is deleted, all of its data and files are deleted within 30 days. Backups rotate out within 14 days.

5. Security

Access tokens and payment settings are encrypted with AES-256, and passwords are hashed with bcrypt. Each business’s data is isolated and visible only to its authorised team members. All connections use HTTPS. We use only the cookies needed to keep you signed in; we use no advertising or tracking cookies.

6. Your rights

You can ask to see, correct or delete your information. See Data Deletion for how to request deletion.

7. Changes

We publish changes on this page and tell customer businesses about important changes by email.

8. Contact

Green Spring LLC, Ulaanbaatar, Mongolia
contact@koda.mn · +976 9918 2561