Privacy Policy

Scope and Roles

This Privacy Policy applies to visitors to the LinMi website, registered users of the console and the members of their organizations and workspaces (“you”), and the people who communicate with you through the channels you connect (“end users”).

With respect to your account information, orders, and usage records, we determine the purposes and means of processing and are responsible for it under this Privacy Policy.

With respect to the customer conversations and customer profiles that you connect to and manage through the Services (“business data”), you and the organization to which you belong determine the purposes and means of processing and are the controller of such data. We act solely as a processor, processing such data on your instructions and for the purpose of providing the Services, and we do not use it for our own purposes. You must ensure that you have obtained all necessary authorizations or consents to collect and process end users’ information, and you must provide end users with your own privacy notice.

Information We Collect

Account information: the email address, mobile phone number, password (stored only as an irreversible salted hash), name, profile picture, and organization and workspace names you provide when you register for and use the Services, as well as the verification settings created when you turn on two-step verification. If you choose to sign in with your Google account, we receive your email address, name, profile picture, and account identifier from Google.

Business data: information about and authorization credentials for the channel accounts you connect to the Services, customer conversation content (including message text and attachments such as images, voice messages, videos, files, locations, and contact cards), translations, customer profiles (name or display name, profile picture, phone number, username, country, language, and similar details), tags, customer stages, notes, follow-up records, and information about your team members.

Payment and settlement information: orders, wallet top-up and spending records, and invoice information generated when you subscribe to paid services. Payments are processed by third-party payment service providers, and we do not store your full bank card details. If you join the partner program and request a withdrawal, we collect the name of the payout account holder and the payout account number.

Usage and log information: sign-in records (time, IP address, approximate location derived from the IP address, device type, browser, and operating system), online status records, and operation logs, which we use for security auditing and troubleshooting and which are visible to the administrators of your organization. Location is derived using a locally hosted IP geolocation database; we do not send IP addresses to third parties for this purpose.

Correspondence: the content and contact details you provide when you contact us by email or through the console.

Data from Meta Platforms (WhatsApp, Messenger, and Instagram)

When you connect a WhatsApp Business account (WhatsApp Business Platform / Cloud API, completed through Embedded Signup in a Facebook authorization window), a Facebook Page (Messenger), or an Instagram professional account in the console through Meta’s official authorization flow, we receive and process the following data through Meta’s official APIs, in accordance with the permissions you grant (“Meta Platform Data”):

(1) Authorization and account information: your WhatsApp Business Account (WABA) ID, business portfolio ID, phone number ID and display phone number, the review status of the number and account, messaging limits, and message templates, the ID and name of your Page or Instagram account, and the access token issued by Meta together with its scopes and expiry. Access tokens are encrypted and stored on our servers and are never sent to the browser.

(2) Conversation data: the content of messages exchanged between end users and you (text, images, voice messages, videos, files, stickers, locations, contact cards, reactions, and similar content), and the sent, delivered, and read status and timestamps of messages; end users’ identifiers (WhatsApp phone number or user ID, or the Messenger or Instagram scoped user ID), display name or username, and, where provided by the platform, profile picture, country, and language.

(3) Referral information: where an end user starts a conversation by clicking an ad or a post, the referral information that Meta provides with the message (such as the ID, headline, link, and click identifier of the ad or post), which we use to show you where the customer came from.

Authorization is completed in Meta’s official window. We never obtain your Facebook or Instagram sign-in password.

We process Meta Platform Data solely to provide you with messaging, automatic translation, team collaboration, customer management, and data reporting features, and we comply with the Meta Platform Terms, the Developer Policies, and the applicable WhatsApp Business terms and policies. We do not sell or rent Meta Platform Data, we do not use it for advertising or profiling or provide it to data brokers, we do not use it to train artificial intelligence models, and we do not use it for any purpose unrelated to providing the Services to you.

We provide Meta Platform Data only to service providers that are necessary for providing the Services (see “Data Sharing and Processing by Service Providers”), and we require them to process it solely on our instructions.

You may at any time delete the corresponding channel account in the console, or revoke authorization by removing LinMi in your Facebook or Instagram account settings. Once authorization is revoked, we no longer receive new data. You, or end users, may request deletion of existing Meta Platform Data as described on the Data Deletion page.

Data from Other Channels and Connection Methods

Other official APIs: when you connect through the official API of another platform, such as a Telegram bot, we receive message content, sender identifiers, display names, profile pictures, and similar data through that API, and we store the API credentials you provide in encrypted form.

Cloud-hosted accounts: when you choose to host an existing WhatsApp, Telegram, LINE, TikTok, Zalo, or similar account on the Services as a “linked device” by scanning a QR code or entering a linking code or verification code, we store the session credentials needed to stay signed in, receive the messages and contact details that the account sends and receives from then on, and, at the time of connection, sync part of the account’s recent conversations and messages so that you can continue serving customers in the workspace. You may delete the channel account at any time, and we will sign out of the linked devices on the corresponding platform at the same time.

Web chat: after you embed the LinMi web chat widget on your own website, when a visitor opens the chat window we collect, on your behalf, a randomly generated visitor ID (stored in the local storage of the visitor’s browser and used to recognize the same visitor and restore previous conversations), the URL of the current page, the referring page, the browser language, the IP address carried by the network request, and the messages and files the visitor sends. The widget does not use cookies and does not require visitors to provide a name, email address, or phone number.

Routing links: when an end user clicks a routing link you have created, we record the IP address and the time of the click in order to assign the same visitor to the same agent account for 30 days and to compile click statistics, and we then redirect the visitor to the destination you have set.

Chat sharing: after you create a chat sharing link, anyone who holds the link (and the access password, if one is set) can view the shared conversation in read-only mode. You can set an expiry date, an access password, and identity hiding, and you can cancel sharing at any time.

How We Use Information

To provide and maintain the Services, including messaging, automatic translation, team collaboration, customer management, and data reporting features.

To protect the security of accounts and data, to detect and prevent fraud, abuse, and unauthorized access, and to troubleshoot problems and keep the Services stable.

To perform our contractual and legal obligations, including billing, invoicing, tax compliance, and the settlement of partner commissions.

To improve our products: we use usage statistics that contain no conversation content (such as the number of times a feature is used, message counts, and response times) to improve our products. Data reports count only volumes and durations and do not include message text, translations, or the content of attachments.

To send you service notifications (such as security alerts and billing and quota reminders) and, with your consent, product updates. You may unsubscribe at any time.

We do not sell personal information, we do not use conversation content for advertising or profiling, and we do not use it to train artificial intelligence models. These restrictions apply to all business data, not only to Meta Platform Data.

Automatic Translation and AI Features

When you turn on automatic translation, pre-send translation preview, or deep translation, the message text to be translated is sent in real time to third-party service providers that supply us with machine translation and large language model capabilities. The translation is stored in your workspace alongside the original text so that your team members can view it.

We send message text solely to complete the translation, and we require the service providers to process it only for that purpose and not to use it to train their models or for any other purpose of their own. You can turn off automatic translation in the translation settings.

Legal Bases for Processing

In regions where applicable law requires us to state a legal basis for processing (such as the European Economic Area and the United Kingdom), we process personal information on the following bases: the performance of our contract with you; our legitimate interests in ensuring security, preventing abuse, and improving our products; compliance with legal obligations; and, where required, your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before the withdrawal.

Cookies and Local Storage

The LinMi website does not use analytics or advertising cookies and does not integrate any third-party analytics tools. It only remembers your theme (light or dark) and language preferences in your browser’s local storage.

The console uses your browser’s local storage to keep your sign-in credentials, any sign-in details you choose to have remembered, interface preferences, and unsent drafts, in order to keep you signed in and maintain your experience. The console does not integrate any third-party analytics or advertising tools.

When you sign in with Google on the sign-in page, or open the Facebook authorization window while connecting a WhatsApp Business account, the page loads scripts provided by Google or Meta, which may set cookies in accordance with their own privacy policies.

You can clear local storage and cookies through your browser settings. After clearing them, you will need to sign in again and your preferences will return to their defaults.

Data Sharing and Processing by Service Providers

We do not sell your information. We do not provide your information to any third party except in the following circumstances:

(1) sharing to which you have given your explicit consent or that is carried out on your instructions, including delivering the messages you send to the third-party platforms you have connected;

(2) to service providers that are necessary for providing the Services, in the following categories: cloud servers and databases, object storage and content delivery, machine translation and large language models, SMS and email delivery, and payment processing. We agree data protection obligations with these providers and require them to process data solely on our instructions and to standards no less protective than those set out in this Privacy Policy;

(3) where disclosure is required by laws or regulations, or by judicial or administrative authorities acting in accordance with the law; and

(4) where a transfer is necessary in connection with a merger, acquisition, or transfer of assets, in which case we will require the successor to remain bound by this Privacy Policy and will notify you.

Within your organization, the owner and administrators can view members’ conversations, sign-in logs, and operation logs in accordance with their permissions.

Data Storage and Cross-Border Transfers

Your data is stored primarily on third-party cloud infrastructure located in Singapore and other locations. To send verification text messages and notification emails, your mobile phone number or email address is processed by service providers located in mainland China. To deliver channel messages and provide automatic translation, the relevant data is transferred to servers of platform operators (such as Meta) and translation service providers located in other countries or regions.

This means that your information may be processed outside the country or region in which you are located. We implement contractual and technical safeguards as required by applicable law (such as agreeing data protection terms with recipients and encrypting data in transit) so that the data receives protection comparable to that set out in this Privacy Policy.

Data Security

We protect your data through technical and organizational measures, including encryption in transit (HTTPS/TLS), encrypted storage of third-party platform access tokens and channel credentials, salted password hashing, two-step verification, access controls and tiered permissions, masking of contact details, and sign-in and operation audits. Attachments are accessed through time-limited signed links.

Our personnel access business data only with authorization and only where necessary to troubleshoot problems, handle your requests, or comply with legal obligations.

In the event of a data security incident that may harm your rights and interests, we will notify you promptly and report the incident to the relevant authorities in accordance with the law.

Data Retention and Deletion

We retain your account information and business data for as long as you use the Services so that you can view past conversations at any time. We do not proactively erase business data unless you delete it or request its deletion.

When you delete a customer in the console, that customer’s profile, tags, and chat history are immediately removed from the workspace and cannot be recovered, and they are permanently deleted from our production systems and backups within 90 days.

When you delete a channel account or revoke platform authorization, we immediately stop sending and receiving messages through that account, deactivate the stored access token or session credentials, and delete them within 90 days. Customers and chat history created before that point remain in your workspace until you delete the relevant customers or request deletion.

After an organization, workspace, or account is closed, we deactivate the relevant accounts and delete or anonymize all of their business data within 90 days.

Security audit records such as sign-in logs and operation logs are retained for the life of the account and deleted when the organization is closed. Information that we are required by law to retain (such as transaction and invoicing records) is retained separately for the period prescribed by law and deleted when that period expires.

For the complete deletion procedures and how to submit a request, please see the Data Deletion page.

Your Rights

Subject to applicable law, you have the right to access, correct, and delete your personal information, to obtain a copy of it, to restrict or object to certain processing, to withdraw your consent, and to request that your account be closed.

You can view and correct your personal profile under Personal settings in the console, or exercise the rights above by emailing [email protected]. We will respond within 30 days after verifying your identity.

If you are an end user, your information is controlled by the business you communicate with, so please contact that business first. You may also contact us as described on the Data Deletion page, and we will assist with your request.

If you believe that our processing infringes your rights and interests, you may lodge a complaint with us, and you also have the right to lodge a complaint with the data protection authority in your place of residence.

Minors

The Services are intended for business users and are not directed to minors under the age of 18. If we discover that we have collected information from a minor without the consent of a parent or guardian, we will delete such information as soon as possible.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in advance through an in-service notice or by email. The updated Privacy Policy takes effect on the date shown on this page.

Contact Us

Operator: Linmi (Shenzhen) Network Technology Co., Ltd.; Registered address: Room 1802, Building 2, Xunmei Technology Plaza, 8 Keyuan Road, Nanshan District, Shenzhen, China.

If you have any questions, comments, or complaints regarding this Privacy Policy or the processing of your personal information, please email [email protected] or contact us through the contact option in the console.