Our promise in one paragraph. A business’s customer data belongs to that business and stays with it. We do not sell personal data, we do not use it for advertising, we do not build customer profiles across businesses, and we do not use identifiable customer conversations to train shared AI models.
1. Who this policy covers
This policy applies when you visit our website, contact us, connect a business account to Maîtrise through Facebook / Meta, WhatsApp or Google, use a Maîtrise workspace, look at a preview or form we prepared for you, receive a Maîtrise report, or send or receive WhatsApp, Facebook Messenger or Instagram Direct messages that Maîtrise handles for a named business.
“Maîtrise,” “we” and “us” mean Maîtrise Business Systems, based in Lebanon. A “business client” is a business that uses Maîtrise. A “customer” is a person who writes to a business client, or whose details a business client gives us. This policy is part of our Terms & Conditions.
2. Who decides what
For its customer care, the business decides which customers are contacted, why and when, and it is responsible for having a lawful reason and any permission it needs. We handle that data for the business and on its instructions: to run the service, apply permission and opt-out rules, keep its workspace separate and report back to it.
We decide how we use our own data: our accounts, website, connections, security, billing and our search for new clients. If a signed agreement or the law sets the roles differently, that agreement or law applies.
3. The personal data we may handle
About the business and its team
- The business name, activity, locations, hours, services, prices and the customer-care rules it approved.
- Names, roles, phone numbers and email addresses of the owner and staff, including the numbers chosen to receive alerts and reports and to switch automated replies on or off.
- Workspace sign-in details, connection invitations and the record that our Terms were accepted.
- Subscription, invoices, payment status, wallet balance and usage records.
- Files, product information, daily updates and other instructions the business gives us.
About customers and conversations
- The customer’s name, WhatsApp profile name, phone number, and which business the conversation belongs to.
- What is sent in the conversation: text, voice notes, images and other files, plus internal transcripts of voice notes where the plan allows it (see section 4).
- Messages the business’s own team sends from its WhatsApp Business app on the connected number, including voice notes.
- On Facebook Messenger and Instagram Direct, where there is no phone number: the ID Meta gives the person for that business’s Page or Instagram account (a page-scoped or Instagram-scoped ID), their name if Meta provides it, the text of each message, a note that a photo or other file was sent (we do not open it), and, when the conversation started from a Facebook or Instagram ad, the ad details Meta attaches to it.
- Replies the business’s own team sends in those conversations from its Facebook Page inbox or the Instagram app, so that automated replies step aside.
- Contacts and earlier conversations, if the business chose to share them when it connected through Meta.
- Visits, services, orders and deliveries; feedback, complaints, requests, hand-overs to staff and how they ended.
- Permission and opt-out records, agreed return dates (for example 6, 12, 18 or 24 months), message times, voice-note lengths and delivery status.
Health businesses
When a clinic or rehabilitation centre uses Maîtrise, a customer may mention their health in a message. We never ask for it. We use it only to pass the message to the clinic and keep the conversation record for that clinic, and for nothing else.
Businesses we would like to work with
To find businesses that may benefit from Maîtrise, we may collect public business information, such as a name, category, address, public phone number, website and public ratings, from sources like Google Maps and search. We use it only to contact that business about Maîtrise, sometimes with one short introductory WhatsApp message from our own number. If the business answers “Stop,” or asks us in any other way, we stop for good and delete what we collected.
Website, previews and technical information
- What you send us by email, WhatsApp, phone, or through a preview, review or feedback form we shared with you.
- IP address, device and browser details, the time and page of each request, and security logs kept by our hosting providers.
Our public website has no advertising trackers and no behavioural-advertising cookies.
4. What each plan reads
How much of a conversation we read depends on the plan the business chose.
Audit plans
On an Audit plan we read the WhatsApp text messages and count everything else. We do not listen to voice notes and we do not transcribe them. To report how long they were, our system downloads each voice note once, reads its length from the file and throws the file away; nobody hears it. Images and other files are counted, not opened. The report is built with fixed counting and keyword rules: no artificial-intelligence model, transcription service or image service sees the business’s messages on an Audit plan. We never write to the business’s customers on this plan.
Free 7-day audit
The free audit reads one week of conversations in more depth. It reads text and voice notes, including voice notes the business’s own team sends from its WhatsApp Business app (the business can ask us to turn that off), and it may use the automated processing described in section 9. It sends nothing to customers. The result is a report that we review and send to the owner ourselves.
Customer Care plans
On a Customer Care plan we read the whole conversation, text and voice notes, including voice notes the business’s team sends from its app, so that we can answer customers for the business, pass requests to the right person and follow up as agreed. On Facebook Messenger and Instagram Direct, which only Customer Care plans cover, we read the written messages; for a photo, voice note or other file we only note that one was sent. Audit plans and the free audit never read Messenger or Instagram.
5. Weekly reports
Every week we send the owner a report on WhatsApp, from the Maîtrise number, to the number the business chose. On an Audit plan it comes with a PDF and a “See details” button that opens a page about the same week.
- Customer phone numbers in the report are partly hidden, and short quotes have names and numbers removed.
- The details page opens only with a long, random link made for that business and that week. It stops working after 30 days, it is hidden from search engines, and it has no tracking. Anyone holding the link can open it, so please do not forward it.
- To tell new customers from returning ones, we keep each customer number in a scrambled, one-way form that only works inside that business’s workspace and cannot be turned back into the number. We also keep a summary of each week to compare it with the next.
- If the business’s WhatsApp connection is lost, reports stop until the number is connected again.
6. Data we receive from Facebook / Meta, WhatsApp, Messenger and Instagram
When a business connects through Meta’s official Embedded Signup (Facebook Login for Business), Meta shares with us only what the person connecting approves. That can include the Facebook user ID and name of that person; the Meta business portfolio, WhatsApp Business Account and phone-number identifiers; the business display name, verification and account status; an access token that lets us use the approved permissions; and, once connected, the message events for that number described above.
When a business on a Customer Care plan connects its Facebook Page, and the Instagram professional account linked to it, through Meta’s own login window (Facebook Login for Business), Meta again shares only what the person connecting approves: that person’s Facebook user ID and name, the IDs and names of the Pages they chose and of the Instagram accounts linked to them, an access token for each Page, and, once connected, the Messenger and Instagram message events for those accounts described in section 3. A Page or Instagram account can be connected to only one business at a time.
We use this data only to connect the account, run and protect the service for that business, meet platform rules and keep the records we must keep. We do not sell it, use it for advertising, give it to data brokers or use it to profile people across businesses. Access tokens are stored encrypted and are never shown to business owners. We will never ask for a Facebook or WhatsApp password.
You can remove our access at any time in your Facebook settings (Business Integrations) or in Meta Business settings. To have the data we already hold deleted, follow our Data Deletion instructions.
A business can also disconnect a Facebook Page or Instagram account from Maîtrise at any time. Disconnecting erases the access token straight away and stops all replies on that account; the conversations already recorded stay in the business’s workspace and follow the retention rules in section 13. Each connected account also has its own switch to turn automated replies off without disconnecting it.
If a business connects its Google Business Profile, we use that access only to look after the profile, its information and its reviews for the business, under the same rules.
7. Where the data comes from
From business clients and their staff; from customers who write to or hear from a business; from Meta, WhatsApp and Google through the connections a business approves; from public sources, for businesses we would like to work with; and from the technical systems that run and protect the service.
8. Why we use personal data
- To provide the customer care, audits and other services the business asked for, in the business’s name.
- To keep every conversation in the right business’s workspace.
- To understand messages and, where the plan allows it, voice notes; to answer routine questions; and to send decisions to the right person at the business.
- To notice when someone from the business has joined a conversation, so automated replies step back, and to alert the staff the business chose when a customer needs them.
- To ask for, record and respect permission and opt-outs, and to send only the return reminders that were agreed.
- To share the business’s own review link and prepare factual reports for the business, including the weekly report.
- To count usage, apply any reply limit the business set, run the prepaid wallet, issue invoices and follow payments.
- To contact businesses that may be interested in Maîtrise.
- To keep the service secure, look into incidents, prevent misuse and keep audit records.
- To improve the service using combined or de-identified information that does not identify a business or a customer.
- To meet legal obligations and to make or defend legal claims.
For customer care we act on the business’s instructions and lawful authority. For accounts and billing we rely on our contract with the business. For security, finding new clients and compliance we rely on our legitimate interests or legal duties. Where consent is needed, the business must obtain it, or we ask for it and record it in the conversation.
9. Automated processing
On Customer Care plans, on the free audit and on our own number, we use automated tools, including artificial-intelligence language and speech-to-text services from specialist providers, to understand messages, transcribe voice notes, prepare or send routine replies, sort feedback and prepare reports. These providers process the data only to send a result back to us, under terms that do not let them train their own models on it. Audit plans do not use these tools at all (see section 4). On Facebook Messenger and Instagram Direct, automated replies are sent only within Meta’s 24-hour window after the customer’s latest message, and they step aside when someone from the business replies.
Automated replies can be wrong. The service is not allowed to make up a sale, a permission, a booking, a price, a decision or a solution, and it never makes decisions with legal or similarly serious effects on a customer. A person from the business can take over any conversation at any time.
11. Where data is stored
Our application and database servers are in the United States. Meta, WhatsApp, Google and our other providers may also process data in other countries. We choose providers with recognised security practices and contractual protections, and we send them only what the service needs. A business should not use Maîtrise for data that its own legal or contractual duties forbid it from processing outside Lebanon.
12. Security and separation
We use encrypted connections, encrypted storage for access tokens and credentials, signed-in staff access, a separate workspace for every business, audit records, permission and opt-out checks and protection against duplicate messages. Only the Maîtrise staff who need to run, support or secure the service can see a business’s data, and they are bound by confidentiality. No online service can promise perfect security, so businesses must also protect their own access and staff phones and tell us quickly if they suspect misuse.
13. How long we keep data
- Customer-care and audit data, including Messenger and Instagram conversations, is kept while the business uses Maîtrise, and as long as needed for agreed return reminders. When the service ends, the business has 30 days to ask for an export; we then delete or anonymise the data within a further 30 days.
- Weekly report links stop working after 30 days. Scrambled customer numbers and weekly summaries are deleted with the rest of the business’s data.
- Voice-note files downloaded on an Audit plan to read their length are thrown away straight after; only the length is kept.
- Access tokens, including Facebook Page tokens, are deleted or cancelled when the connection is removed or the service ends. Disconnecting a Page or Instagram account erases its token straight away.
- Research on businesses we would like to work with is kept for up to 12 months unless we start working together, or deleted sooner on request.
- Invoices and accounting records are kept for as long as Lebanese law requires.
- Opt-out records are kept in a minimal form (for example a phone number and a date) so that someone who said stop is not contacted again.
- Backups and logs expire on their normal cycle and are not restored for everyday use.
Step-by-step instructions are on our Data Deletion page.
14. Your choices and rights
Depending on your relationship with us and the law that applies to you, you can ask to see, correct, export, limit or delete your personal data, or object to some uses of it. A customer can tell us to stop at any time in the WhatsApp conversation; we record it and stop those messages. On Messenger and Instagram we only reply to messages the customer sends and never write first; to have such a conversation deleted, see our Data Deletion page.
When the data is part of a business client’s customer care, we may handle your request together with that business. We check requests in a reasonable way, and we will never ask for your password, access token or card details. You can also complain to the data-protection authority in your country.
15. Children
Maîtrise is built for businesses and is not aimed at children. Business clients must not ask us to send promotional messages to children. When a child’s information reaches us through a parent or guardian, for example to book a clinic appointment, we use it only for that business’s customer care.
16. Changes to this policy
We update this policy when the service, the law or platform rules change. The new date appears at the top of this page, and active business clients hear from us directly when a change affects them in an important way.
17. Contact Maîtrise
For a privacy question, an opt-out, an access request or a complaint, write to us below. You can also contact the business whose customer care sent you the message.
