1. Who we are
Kockatoos Nova is an AI customer-conversation platform operated by Kockatoos SARL ("Kockatoos", "we", "us"), a web and mobile development studio. Kockatoos Nova lets businesses ("our customers") answer their own visitors and customers ("end users") through an AI assistant available as a website chat widget, in mobile apps, on WhatsApp (directly or through Wati), and on Instagram.
This policy covers the Kockatoos Nova platform at nova.kockatoos.co, including its contact form, the embeddable chat widget and mobile SDK our customers install, the business portal, billing, and our WhatsApp, Wati and Instagram integrations. It should be read with our Terms of Service. For our company website, see kockatoos.co.
For conversations between a business and its end users, that business decides why and how the data is used, and we process it on the business's behalf. For account, billing and contact form data, Kockatoos decides how it is used.
2. Data we collect
From end users of the chat widget and mobile SDK:
- The messages you type to the assistant and the assistant's replies.
- A random visitor identifier stored in your browser or app so your conversation can continue across visits. It contains no personal details.
- Your IP address and browser user agent, recorded with the conversation for security and abuse prevention.
- Your email address or phone number, only if the business asks for it in the chat and you choose to share it.
- If you are signed in on the business's website and the business has turned on signed-in customers: the customer id that business uses for you, proven with a signature from its server, and any name, email address or extra details (such as a membership tier) the business chooses to pass. We keep these with your conversations, so your chat history follows you on every device where you are signed in to that website.
- If the business also passes an access token for its own systems, it is used only to make requests to those systems during your conversation. We never store it, write it to our logs, or show it to the AI model.
From end users on WhatsApp (directly or through Wati):
- Your WhatsApp phone number and profile name, as delivered by the WhatsApp Business Platform or by the business's Wati inbox.
- The messages you send to a business's WhatsApp number, including photos, voice notes, videos, documents and stickers, and the assistant's replies. The assistant is told that a file arrived but is not shown its contents. Locations, contact cards and other message types are not processed.
- If the business sets up a tool that looks up your account by phone number, your WhatsApp number is passed to that business's own systems when the assistant uses the tool.
From end users on Instagram:
- Your Instagram-scoped user ID, username and the direct messages you send to a business's professional account, including photos, videos, audio and files, as delivered by Meta's Instagram API, and the assistant's replies. The assistant is told that a file arrived but is not shown its contents.
From our business customers and their team members:
- Account details: name, email address, password (stored hashed), whether the email address has been confirmed, and when you accepted our Terms of Service.
- Team details: the workspaces you own or belong to, your role, and the email addresses the owner invites. An invited person's email address is used only to send and check their invitation.
- Workspace configuration: assistant instructions, branding, connected WhatsApp Business, Wati and Instagram account identifiers, and the access tokens issued for those connections (stored encrypted).
- Optional connections to the customer's own systems (MCP servers), including server URLs, access tokens and custom request headers (stored encrypted).
- Optional workspace variables used by those connections, such as a store id or an API key. Values marked secret are stored encrypted and never shown again.
- An optional identity secret that the business's website uses to sign its customers' ids (stored encrypted).
- Usage records: for each AI request, the model used, the number of tokens and its cost, so usage can be shown in the portal and billed.
Billing details (workspace owners):
- Billing name, billing email, address, country and tax number, which appear on invoices.
- Card details: we keep only the card brand, the last four digits and the expiry date. The full card number and security code are handled by our payment provider, which gives us a token to charge the saved card; that token is stored encrypted.
- Invoices and payment attempts, including amounts, dates and whether each payment succeeded.
From people who use our contact form or sign up:
- The name, email address, plan, channel and message you enter in the contact form.
- A bot-protection check by Cloudflare Turnstile on the contact and sign-up forms, which looks at technical signals from your browser, such as your IP address, to tell people from automated traffic.
3. How we use data
- To generate assistant replies: end-user messages, recent conversation history and, for a signed-in customer, the customer id, name, email address and extra details the business passed are processed by large-language-model providers acting as our processors. They are contractually restricted to processing the data to provide the service and do not use it to train their models.
- To let a business and its team review their own conversations and contacts in the portal.
- To recognise a signed-in customer across devices, and to pass that customer's id, contact details or access token to the business's own systems when the business sets up a tool that needs them, so the assistant can answer from that customer's own records.
- To run accounts and teams: confirming email addresses, sending invitations, and checking that each person only reaches the workspaces they belong to.
- To bill for the service: charging the saved card, issuing invoices with the right tax, enforcing plan and usage limits, and sending trial, payment and usage-limit notices.
- To answer contact form requests and send you a confirmation that we received yours.
- To operate, secure, and rate-limit the service and to block automated abuse (IP address, user agent and bot-protection checks).
- To keep the accounting and tax records the law requires.
We do not sell personal data, use it for advertising, or use end-user conversations to train AI models.
4. Meta platform data
Our WhatsApp and Instagram integrations use Meta's APIs. Data received through those APIs ("Platform Data") is used only to receive end-user messages addressed to a connected business and to send that business's assistant replies back, in accordance with the Meta Platform Terms and applicable Developer Policies. We do not share Platform Data with third parties except the processors needed to run the service, and we delete it when it is no longer required for these purposes or when the business disconnects the channel.
5. Sharing and processors
We share data only with service providers who process it on our instructions:
- Cloud hosting and database infrastructure.
- Large-language-model API providers, for generating assistant replies.
- Meta Platforms, when delivering messages over WhatsApp or Instagram, and Wati, when a business connects its Wati inbox.
- Our payment provider, for saving cards and taking payments.
- Cloudflare, for bot protection on our forms.
- Email delivery providers, for account, invitation, billing and contact form emails.
When a business connects its own systems (MCP servers), the assistant sends those systems the requests the conversation needs, together with the customer details the business set them up to receive. Those systems are run by the business or its own providers, not by Kockatoos, and the business is responsible for how they handle that data.
When a business connects its own Slack workspace to receive conversations, the conversations its team handles (after the assistant hands one over, or on a channel where the business answers every message itself) are copied into a Slack channel the business chooses, together with the customer's name, phone number, username or email address and any files they sent. Replies the team writes in that channel, including files, are sent back to the customer. That Slack workspace is run by the business, not by Kockatoos, and the business is responsible for who can read it and how long it is kept.
Each business customer controls its own workspace: the owner and the team members they invite can read the conversations and contacts its assistant has collected. We may also disclose data where the law requires it.
6. Retention
- Conversations and contacts are kept while the related workspace is active, so the assistant can keep context and the business can review its history.
- When a workspace is paused (for example after a trial ends unpaid or a payment fails) or its subscription is cancelled, its data is kept for 90 days and then permanently deleted, including conversations, contacts, channel connections, saved cards and settings. The owner is emailed 30 and 7 days before.
- Photos, voice notes and other files sent in a conversation, by the customer or by the team, are deleted 90 days after they were received. The conversation keeps a note that a file was there.
- Channel access tokens are deleted when a channel is disconnected.
- Invoices and the billing details printed on them are kept for as long as accounting and tax law requires, even after a workspace is deleted.
- Usage records are kept with the invoices they were billed on.
- Invitations stop working after 7 days or once used.
- Contact form requests are kept in our email for as long as needed to handle the request and any follow-up.
7. Security
Data is transmitted over HTTPS. Passwords are stored hashed. Access tokens, connection credentials and payment tokens are stored encrypted at rest. We never store full card numbers or security codes. Files sent in conversations are kept in private storage and are opened only through links that expire within minutes. A signed-in customer is recognised only when the business's signature matches, so nobody can claim to be another customer by typing their id, and secret values are removed from error messages before they are recorded. Webhook traffic from Meta is verified with signed payloads before it is processed. Every request in the business portal is checked against the workspaces the signed-in person belongs to. Access to production systems is restricted to authorized Kockatoos personnel.
8. Your rights and data deletion
You may request access to, correction of, or deletion of your personal data. End users can also ask the business they were talking to, as that business controls the conversation; we will assist with any such request. Business customers can export their contacts and conversation transcripts from the portal at any time.
To request deletion: email privacy@kockatoos.co from the address you want removed, or include the phone number (WhatsApp) or Instagram username the conversation was held with. If you chatted while signed in on a business's website, include that business's name and, if you know it, the customer id it uses for you. We will confirm completion within 30 days. Business customers can additionally disconnect a channel at any time from their portal, which stops all processing for that channel and deletes its access tokens. Records we must keep by law, such as invoices, are kept for the required period and then deleted.
9. Children
Kockatoos Nova is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect their data. Business accounts are for people aged 18 or over. If you believe a child has provided us personal data, contact us and we will delete it.
10. Changes and contact
We may update this policy as the service evolves; the date above reflects the latest revision, and material changes will be announced to business customers.
Questions or requests: privacy@kockatoos.co
Kockatoos SARL, kockatoos.co