This Privacy Policy explains how EZ AI Automation, a service operated by Second Source MKT, Bangladesh ("EZ AI Automation", "we", "us", or "our"), collects, uses, stores and protects information when you use our website at ezaiautomation.com and our platform, which lets businesses run an AI sales and support assistant on their website chat widget, Facebook Messenger and Instagram (together, the "Services").
We do not collect payment card numbers, bank credentials or government ID numbers through the Services, and we ask Businesses and the AI assistant not to request them in chat.
We do not sell personal information. We do not use end customers' messages for advertising, and we do not use conversation content to train our own AI models.
We access data from Facebook and Instagram only after a Business connects its own Page or account and grants permission, and only to provide the Services to that Business. We use these permissions for the following purposes:
| Permission | What we use it for |
|---|---|
| pages_show_list | Show the Business the Pages it manages so it can choose which one to connect. |
| pages_messaging, instagram_manage_messages | Receive messages sent to the Page or Instagram account and send replies on the Business's behalf. |
| pages_manage_metadata | Subscribe the connected Page to our webhook so that messages and comments reach the Business's inbox. |
| pages_read_engagement, instagram_basic | Read basic Page and account information needed to identify the conversation and the customer. |
| pages_manage_engagement, pages_read_user_content, instagram_manage_comments | Read comments on the Business's posts and, if the Business enables it, reply to them. |
We do not transfer data we receive from Meta to data brokers or advertising networks, and we do not use it for any purpose other than operating the Services for the Business that connected the Page. We follow Meta's Platform Terms and Developer Policies. A Business can disconnect its Page at any time in the dashboard, which stops further data from reaching us.
When a Business connects its Google Calendar, we request access to create calendar events (calendar.events) and to read the connected account's email address (userinfo.email). We use this access only to create the calendar events that the Business's customers book through the assistant, and to show the Business which Google account is connected. We do not read existing calendar events.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use, transfer or sell Google user data to create, train or improve foundational or generalized AI or machine-learning models, and data received from Google Workspace APIs is not sent to any AI model. We do not transfer Google user data to third parties except as needed to provide the Services, to comply with law, or as part of a merger or acquisition with the user's consent. A Business can disconnect its Google Calendar at any time in the dashboard.
To write a reply, the text of the conversation (and the Business's own catalog and knowledge-base content that is relevant to the question) is sent to our AI provider, Google (Gemini API), which processes it under its API terms and returns the reply. AI replies can be wrong, so Businesses should review how their assistant behaves. Customers can ask for a human at any time.
Each workspace's data is kept in its own separate database, so one Business cannot see another's data.
We keep a workspace's data while the workspace is active. When a Business deletes its account (see Data Deletion), its workspace database, conversations, uploaded files and connection tokens are permanently deleted. Payment records held by Stripe, and records we must keep by law, are kept as the law requires.
We use encrypted connections (HTTPS), store passwords only as one-way hashes, separate each workspace's data in its own database, limit sign-in attempts, and restrict access to production systems. No system is perfectly secure; if we learn of a breach affecting your data we will notify the affected Businesses as the law requires.
The Services are for businesses and are not directed to children under 13 (or the minimum age in your country). We do not knowingly collect their information.
Second Source MKT, registered in Bangladesh, is the legal entity responsible for the Platform Data we receive from Meta (the data controller). Questions or requests about your data can be sent to the contacts below.
We may update this policy. The effective date above shows when it last changed, and we will notify Businesses of material changes by email or in the dashboard.