Toong ("Toong", "we", "us") provides an AI customer-assistant platform that lets a business connect its messaging channels (Facebook Messenger, Instagram, WhatsApp, Telegram, Viber, email and a website chat widget) so that an AI assistant can automatically reply to that business's customers. The business follows and takes over conversations in the Toong web dashboard and in the Toong mobile app for iOS and Android. This policy covers the website, the dashboard and the mobile app, and explains what we collect and how we use it.
Toong is operated by Ideal Dev SH.P.K., a company registered in Kosovo (business number 812388933), with its registered office at 2 Nëntori, Prishtinë, Kosovo.
Who is responsible for your data
When you message a business that uses Toong, that business is the controller of your personal data; Toong processes it on the business's behalf to generate replies.
Information we process
- Messages & conversation content exchanged between a customer and the connected business page/number, plus the channel and the channel-specific user id (e.g. a Page-scoped ID, phone number, or Viber id) needed to deliver the reply.
- Channel connection data a business provides to connect a channel, e.g. Facebook/Instagram Page access tokens, WhatsApp tokens, or Viber tokens. These are stored encrypted and used only to receive and send messages on that channel.
- Knowledge base contenta business adds (offers, FAQs, uploaded documents, or text imported from the business's own website) used to ground the assistant's answers.
- Account datafor business users of the dashboard and the mobile app: name, email, password (hashed), an optional phone number for alerts, and, if you sign in with Google or Apple, the name and email those providers share with us (with Sign in with Apple you may hide your email; we then receive Apple's private relay address).
- Mobile app data: a push-notification token for your device so the app can alert you when a chat needs you, and the device model and app version for support. Face ID / fingerprint unlock, when you enable it, is verified by your phone's operating system; no biometric data ever reaches Toong. If you pick a workspace logo from your photo library, only the image you choose is uploaded.
- Usage metrics such as message counts and token/cost totals.
We do not collect precise location, contacts, health or financial account data, and we do not use advertising or tracking SDKs in the mobile app.
How we use information
- To receive inbound messages and generate and send automated replies.
- To retrieve the relevant knowledge-base entries that inform each reply.
- To operate, secure, and support the service and enforce per-business usage limits.
Meta platform data we access
When a business connects its Facebook Page or Instagram account, Toong accesses the following through the Meta permissions it has been granted, solely to power that business's assistant:
- The list of Pages you manage (
pages_show_list), so you can choose which Facebook Page to connect. - Messages and conversations on the connected Page (
pages_messaging), to read the customer's message and send the assistant's reply, within Meta's messaging policies (including the 24-hour window). - Page settings & message webhooks (
pages_manage_metadata), to subscribe the Page to message notifications so new messages reach the assistant. - Business assets you grant (
business_management), to connect the Pages and assets you authorise on your behalf. - Instagram professional account basic profile (
instagram_business_basic): the connected Instagram account's id, username and profile picture, to identify and display the account you connected, and to show the name and profile picture of a customer who messages you so the business can recognise them in its inbox. - Instagram direct messages (
instagram_business_manage_messages), to receive messages customers send to the connected Instagram account and send the assistant's reply back, within Instagram's messaging policies (including the 24-hour window). - WhatsApp messages (
whatsapp_business_messaging) and WhatsApp account setup (whatsapp_business_management), to receive and reply to messages on a connected WhatsApp Business number, and to subscribe that number's account to message notifications.
We request only the permissions needed to receive and answer messages. We do not request or use permissions for advertising, publishing content, or reading anything beyond the conversations a customer sends to the connected business.
We use this data only to receive and answer messages for that business. We do not use it for advertising, do not sell it, and do not share it except with the sub-processors listed below.
Sub-processors & sharing
To generate replies we send the conversation context and the relevant knowledge-base text to OpenAI(our AI model provider). Under OpenAI's API data-usage policy, data submitted through the API is not used to train or improve its models and is retained for at most 30 days for abuse monitoring before deletion. We exchange messages with the platforms a business connects (Meta, that is Messenger, Instagram and WhatsApp, Telegram and Viber). Our infrastructure runs on Amazon Web Services, and transactional email (verification codes, alerts) is sent through Amazon SES. Push notifications to the mobile app are delivered through Firebase Cloud Messaging (Google) on Android and the Apple Push Notification service on iOS; they receive the device token and the notification text only. Subscription payments are processed by Paysera or Stripe on their own pages; card details never reach Toong. The full list is on our sub-processors page. We do not sell personal data, and data obtained through Meta permissions is used only to receive and answer that business's messages.
How we protect data
Channel access tokens and other credentials are encrypted at rest using AES-256; dashboard passwords are hashed (bcrypt). All data is transmitted over encrypted connections (TLS / HTTPS). Our systems run on Amazon Web Services in the EU region eu-central-1 (Frankfurt), with administrative access restricted to authorised personnel.
Legal basis & international transfers
For personal data Toong processes on behalf of a connected business, that business is the data controller and Toong is its processor; the lawful basis is the controller's, typically its legitimate interest in answering its own customers, or performance of a contract (GDPR Art. 6(1)(b)/(f)). Personal data is stored within the EU (AWS eu-central-1, Frankfurt). Where a sub-processor processes data outside the EU (e.g. OpenAI in the United States), the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses.
Retention
Messages and knowledge-base content are retained while the business's account is active and deleted on request or when the account/channel is removed. When a business deletes its account (Settings → Delete account & data, in the dashboard or the mobile app), all of its data (conversations, contacts, knowledge, uploaded files, team logins and push tokens) is erased within 30 days; encrypted backups age out within a further 30 days. Encrypted channel credentials are deleted when a channel is disconnected, and a device's push token is removed when you sign out or turn alerts off. Data created by Meta App Review test users is deleted within 48 hours of the review's completion.
Your rights & data deletion
You can request access to or deletion of your data at any time. A business owner can delete the whole workspace inside the product (Settings → Delete account & data, on the web and in the mobile app). Otherwise visit https://toong.ai/data-deletion and follow the instructions, or email us at the address below.
Deletion requests submitted through Facebook are handled by our data deletion callback at https://api.clientora.tech/api/data-deletion-callback and processed promptly (within 30 days at the latest).
Contact
For any privacy request, email [email protected].