DPDutyPilot
Last updated: October 29, 2026

Privacy Policy

How DutyPilot (Echo Bot) collects, uses, and protects information when you use our dashboard, widget, and connected Meta messaging channels.

DutyPilot ("Echo Bot", "we", "us" or "our") provides an AI-powered customer support platform that helps businesses manage conversations across their website widget, WhatsApp, Facebook Messenger, and Instagram Direct. This policy explains what we collect, why we collect it, and the choices you have.

Summary: We only collect what we need to run the service. We do not sell your data or your end-customers’ messages. Tokens for Meta channels are encrypted at rest (AES-256-GCM) and used only to send/receive messages you authorize.

1. Information we collect

1.1 Account information

When you create an account we collect your name, email address, organization name and authentication data from our identity provider (Clerk). We also store billing and organization metadata needed to operate the service.

1.2 Customer conversation data

If you install our widget or connect WhatsApp, Messenger or Instagram, we process messages, contact identifiers and conversation metadata your end-customers send to you on those channels. We act as a data processor for this content on your behalf — you are the data controller.

1.3 Connected platform data

When you connect a Meta integration (Facebook Page, Instagram Professional Account, WhatsApp Business Account) via Facebook Login / Embedded Signup, we receive access tokens and IDs (Page ID, phone number ID, Instagram ID) needed to call the Meta Graph API. Tokens are encrypted at rest and only used to deliver the features you enable.

1.4 Usage and technical data

We collect standard technical and product analytics data — device and browser information, pages viewed, and app interactions — to secure the service, prevent abuse, improve performance, and understand where users get stuck. We use PostHog for product analytics and session replay. Signed-in activity is linked using a pseudonymous account ID. In session replays, text and input values are masked in the browser and images are blocked before recording data is sent. Our analytics events do not include passwords, email addresses, or conversation content.

2. How we use information

  • Provide, operate and maintain DutyPilot and the AI support agent
  • Send and receive messages on your behalf on channels you connect
  • Provide a unified inbox, conversation history and analytics
  • Secure the service, detect fraud and comply with legal obligations
  • Communicate updates, security alerts and support

We do not sell personal information and we do not use end-customer messages for advertising.

3. Facebook / Meta permissions

If you connect Facebook Login, we request only the permissions needed for the channels you enable:

  • pages_show_list / pages_read_engagement — list Pages you manage
  • pages_messaging / instagram_manage_messages — send/receive Messenger & Instagram DMs
  • whatsapp_business_messaging / whatsapp_business_management — send/receive WhatsApp and manage numbers/templates
  • business_management — discover WABA, numbers and webhook subscriptions

We only use these permissions for actions you explicitly trigger (connecting, replying, subscribing to webhooks). You can revoke access anytime in Meta Business Settings or by disconnecting the integration in DutyPilot.

4. Data sharing

We share information only as needed to run the service:

  • Sub-processors: Convex (database), Clerk (auth), OpenAI (AI agent), and PostHog (product analytics and masked session replay) — each bound by confidentiality and data processing terms.
  • Meta Platforms, Inc. — when you use Meta channels, messages transit Meta’s Graph API.
  • Legal & safety — when required by law or to protect rights, safety and integrity.

5. Data retention

Account data is kept while your organization is active. Conversation and message data is retained while the account is active and for a reasonable period afterwards for audit/recovery, unless you request deletion. Encrypted Meta tokens are deleted immediately when you disconnect an integration.

6. Security

We use TLS in transit, AES-256-GCM encryption at rest for sensitive tokens, role-based access controls and audit logging. No system is 100% secure, but we continuously improve our safeguards and monitor for vulnerabilities.

7. Your rights

Depending on your jurisdiction (including GDPR and CCPA) you may have rights to access, correct, delete, export or object to processing of your personal data. Organization owners can delete conversations and request full account deletion by contacting us. See our Data Deletion Instructions.

8. International transfers

Your information may be processed outside your country. Where required we use appropriate safeguards such as Standard Contractual Clauses.

9. Children’s privacy

The service is not intended for children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy periodically. The new version will be posted here and the “Last updated” date revised. Material changes will be notified by email or an in-dashboard notice.

11. Contact

Questions or requests? Email duty.com.bd@gmail.com. For deletion requests see /data-deletion.

This policy is provided for transparency and does not constitute legal advice. Consider review by counsel for your jurisdiction.

Need help with a deletion or privacy request?

Contact us