Privacy Policy

Lemonize ("we", "us", or "our") provides a WhatsApp-based Conversational Engagement Platform (CEP) that enables businesses to build and deploy AI-powered chatbot flows using our visual flow builder. This Privacy Policy outlines how we collect, use, disclose, and protect personal information obtained via our platform—including data processed through the WhatsApp Business Platform (API).

When using WhatsApp, the following data may be collected and processed on behalf of our business clients:

• Phone Numbers of end-users and business clients
• WhatsApp Business Account (WABA) IDs tied to each client
• Message content exchanged through the chatbot flows (including text, responses, and structured form data)

All interactions via WhatsApp are processed using the official Meta WhatsApp Business API. We do not store or access end-user WhatsApp credentials.

We may store message metadata and responses strictly to support the functionality of the chatbot flows, improve platform performance, and enable clients to manage their interactions.

We process data to:

• Facilitate WhatsApp message exchange via the WhatsApp API
• Allow businesses to build, test, and analyze customer interactions
• Monitor service reliability and security
• Comply with legal and platform (Meta) requirements

We do not use end-user data for advertising, marketing, resale, or any other purpose outside of our internal application.

In accordance with GDPR and other laws, our processing is based on:

• Contractual necessity: to provide chatbot and messaging services
• Legitimate interest: to improve the platform and ensure security
• Consent: where required, for optional features or sensitive data
• Legal obligation: when required to disclose data to authorities

We may share data with:

• WhatsApp/Meta: as part of message delivery and verification
• Infrastructure providers: (e.g., cloud hosting, analytics tools)
• Legal authorities: when compelled by law
• Clients (Data Controllers): who own the conversation data
• Successors: in the event of a merger or acquisition

We never sell or monetize personal data.

End-users may request deletion of their personal data (e.g., WhatsApp messages or phone number) by contacting us directly.

We will verify and process such requests in coordination with the respective business client (data controller), in compliance with GDPR, CCPA, and Meta policies.

Business clients can also manage end-user data retention via their flow builder settings or by contacting our support team.

• Business account data: retained for the duration of the subscription and as legally required
• End-user messages and metadata: retained according to client-specific settings or legal requirements
• Deleted data: securely removed from all systems and backups within 30 days of confirmed deletion. To delete any data please contact us.

We implement strong security practices, including:

• Access controls and authentication mechanisms
• Secure API communication with WhatsApp (Meta)

No transmission method is 100% secure, but we take all reasonable steps to protect your data.

We may process data in countries including the US, Canada, or the EU. Where required, we use Standard Contractual Clauses (SCCs) or other lawful mechanisms to ensure adequate data protection.

We may update this policy periodically. Changes will be communicated via email or visible notices on the platform. Continued use after changes constitutes acceptance.

For any questions or data-related requests, contact: