Kuashify is a product operated by Cozytique ("we", "us", "our"), based in Dhaka, Bangladesh. Kuashify is a multi-tenant customer engagement and order management platform for businesses. This Privacy Policy explains what information we collect, how we use it, and the rights you have over it. By creating an account or otherwise using Kuashify, you agree to the practices described here.
1. Who this policy applies to
This policy covers (a) account holders — the individuals who register an organization on Kuashify, (b) team members they invite, and (c) the end customers of those organizations whose messages and order data flow through the platform. Where an organization is the data controller of its end-customer data, Kuashify acts as a data processor on its behalf.
2. Information we collect
Account information
- Name, email address, phone number, hashed password, and preferred language.
- Organization name, business address, tax identification numbers, industry, and logo.
Integration credentials
- Access tokens, Page IDs, Instagram Business Account IDs, WhatsApp Phone Number IDs, and webhook configuration that you provide through the Integrations setup. All credentials are stored encrypted at rest.
- WooCommerce and Shopify store credentials, encrypted at rest.
Customer messages and orders
- Inbound and outbound messages exchanged on Facebook Messenger, Instagram Direct, and WhatsApp Business through your connected accounts, including text, attachments, quick replies, and message metadata (timestamps, sender identifiers, message identifiers).
- Customer profiles your team creates: name, phone number, email address, delivery addresses, tags, notes, and order history.
- Order and product data, invoices, and courier tracking events.
Payment data
- bKash transaction identifiers, payment amounts, and status. We do not store bKash PINs, OTPs, or full bank account or card numbers — payment is completed on bKash's secure hosted checkout.
Technical data
- IP address, browser type, device type, log timestamps, and error traces.
- AI Agent usage metrics: volume of interactions and associated costs per organization.
3. How we use information
- To operate the platform: route and display messages, store orders, generate invoices, and dispatch courier requests.
- To power the AI Agent: send conversation context to our AI provider to draft suggested replies. When enabled, customer images may be analyzed for product identification.
- To bill your subscription and message-credit usage and to process payment top-ups.
- To provide customer support, investigate misuse, and improve the service.
- To send transactional communications (account, billing, and security alerts) and, with your consent, product updates and announcements.
4. Meta Platform data — required disclosures
When your organization connects a Facebook Page, Instagram Business Account, or WhatsApp Business Number, Kuashify accesses Meta Graph API data only with the access tokens you explicitly authorize during the integration setup. Specifically:
- We receive only the message events, page metadata, and account identifiers necessary to deliver inbox, AI reply, and analytics features.
- We do not sell, rent, or share Meta Platform data with advertising networks, data brokers, or any unauthorized third parties.
- End-customer messages are processed strictly to (a) display them to your team in the Unified Inbox, (b) generate AI-assisted replies if you enable the AI Agent, and (c) compute aggregate analytics for your own organization.
- You may revoke access at any time by disconnecting the integration in Kuashify, revoking the token in Meta Business Suite, or removing Kuashify's app from your Page or WhatsApp Business Account.
5. Third-party processors
We share the minimum data required with the following sub-processors:
- Meta Platforms, Inc. — Graph API for Messenger, Instagram Direct, WhatsApp Business, Meta Ads, and Pixel.
- OpenAI, L.L.C. — Conversation text and, when enabled, product images for AI Agent reply generation.
- bKash Limited — Payment tokenization and transaction processing for credit top-ups and subscription billing.
- Courier partners (Pathao, Steadfast, Redx, Carrybee, Paperfly) — Recipient name, phone number, address, and parcel details for delivery requests.
- Cloud infrastructure provider — Hosting and database services for application data in Bangladesh.
6. Data retention
- Account and organization data: retained while your organization is active and for up to 90 days after account closure for billing and legal record-keeping.
- Customer messages and orders: retained for the lifetime of your organization unless you delete them through the platform.
- Audit and activity logs: up to 2 years.
- Temporary AI conversation state: cleared automatically on a short rolling window and not persisted beyond active sessions.
- Encrypted integration credentials: deleted within 7 days of disconnecting the integration.
7. Security
- All sensitive credentials are encrypted at rest using industry-standard encryption mechanisms.
- Incoming webhook payloads from Meta, Shopify, and WooCommerce are authenticated using cryptographic signature verification.
- Strict multi-tenant data isolation is enforced at the database layer — no organization can access another organization's data.
- Access is governed by a role-based access control system with full audit logging of permission changes.
- HTTPS/TLS is enforced for all client-facing and webhook traffic.
8. Your rights
You may exercise any of the following rights by emailing kuashify@gmail.com from the address associated with your account:
- Request a copy of the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your account and associated data (subject to applicable legal retention requirements).
- Withdraw consent for non-essential processing such as marketing communications.
End customers of an organization should contact that organization directly; we will assist the organization in fulfilling such requests in our capacity as a data processor.
9. Children
Kuashify is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
10. International transfers
Primary data storage is located in Bangladesh. Certain sub-processors, including Meta and our AI provider, process data outside Bangladesh. By enabling these integrations, you consent to those transfers subject to each sub-processor's applicable data protection safeguards.
11. Cookies and local storage
We use strictly necessary cookies for authentication and session management, and first-party local storage to remember your language and theme preferences. We do not use third-party advertising cookies on the Kuashify platform.
12. Changes to this policy
We will post any material changes on this page and update the "Last updated" date. We will notify account holders by email when a change materially affects how their data is processed.
13. Contact
Email: kuashify@gmail.com
Postal: Cozytique, Dhaka, Bangladesh.