Privacy Policy

Agent24 is operated by Craftdesk, Calicut (Kozhikode), Kerala, India (“we”, “us”). This policy covers the Agent24 website at https://agent24.in and the Agent24 Android app (in.craftdesk.agent).

You can reach us about privacy at craftdeskdev@gmail.com.

For your account (the people who sign up and the businesses they set up) we decide how the data is used, so we are responsible for it (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, or a “controller” in other laws).

For your customers (the people who message your business on WhatsApp) we act only on the business’s behalf and on its instructions (a “data processor”). The business decides to use Agent24, and the business is responsible for having a lawful basis and any consent it needs from its own customers, for telling them it uses an automated assistant where the law or WhatsApp requires it, and for following the WhatsApp Business Messaging Policy. If you are a customer of a business that uses Agent24, please contact that business first about your data; we will help it respond.

Account and team

• Your name, email address and whether it is verified.
• Your password, stored only as a one-way hash. If you sign in with a magic link, we create a short-lived one-time link (valid 10 minutes).
• If you choose “Continue with Google”: your Google account id, name, email and profile picture, and the sign-in tokens Google returns.
• Sessions: a session token, its expiry, the IP address and browser or device description (user agent) it was created from, and which business is active.
• Businesses you create or join, your role (owner, admin or agent), and invitations you send or receive (invitee email, role, status).
• Your notification settings in each business: what you want to hear about (all messages, important only or off) and how (email, push).
• If you turn on notifications: a push identifier for each browser or phone (a Web Push subscription address and its encryption keys, or a Firebase Cloud Messaging token), a device name such as “Chrome on Windows” or “Android phone”, and when it was added and last used. It is deleted when you remove the device, log out on it, leave the business or delete your account, and when the push service reports it no longer works.

Business profile and agent setup

• Business name, description, category, the services it also offers, logo URL, opening hours, languages, currency and time zone.
• Your AI agent’s name, tone, instructions (prompt, with its version history) and rules.

WhatsApp connection

• If you connect with your own Kapso account: your Kapso API key, which we store encrypted and never show again or write to logs.
• If you use “Continue with Kapso”: we create a customer record for your business at Kapso (using your business name and our internal business id) and a setup link you complete with Kapso and Meta.
• The WhatsApp phone number id, display number, display name and its review status, the webhook id and an encrypted webhook signing secret, and the connection status.

Your customers’ conversations (processed for the business)

• Each customer’s WhatsApp number (wa_id) and the profile name they use on WhatsApp.
• The text of messages they send and of replies from the agent or your team, the WhatsApp message id, timestamps, who handled the reply, how long the reply took, and how the message was classified (for example lead, order or complaint, and whether it is important).
• What the agent did while replying: which rules applied, which tools ran and what changed in the CRM. We keep this so you can see why the agent answered as it did.
• CRM data the agent or your team adds: stage, priority, deal value, assignee, tags, internal notes, an activity history and an AI-written summary of the conversation.
• Messages are stored and classified even while the agent is switched off or a team member has taken over, so your team sees the whole chat.

Products module (only if you turn it on)

• Your product catalogue: names, brands, categories, SKUs, prices, specifications, notes for the agent, image URLs, variants and stock with a change history.
• Holds and restock requests the agent creates, linked to the customer who asked.
• Counts of what customers asked for and whether it was in stock (this week’s demand), by product or search phrase.
• If you sync from Google Sheets: the published CSV URL you give us and the result of each sync.

Technical data

• Our hosting provider records request logs (time, URL, status, errors) to keep the service running. We do not use advertising or analytics trackers.

• To create and secure your account, sign you in and send verification, sign-in, password-reset and invitation emails.
• To receive your customers’ WhatsApp messages, generate the agent’s replies and send them through WhatsApp.
• To build the CRM, the inbox and the statistics on your Home screen.
• To notify the members who asked for it, by email (when a chat is handed to a human) and by push notification (handoffs, important messages, bookings and, if they chose all messages, every new message). A notification shows the customer’s name and the start of their message.
• For the Products module: to answer stock questions, hold units and send restock alerts to customers who asked to be told.
• To keep the service working and safe: debugging, preventing abuse, and enforcing our Terms.
• To meet legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not use your or your customers’ messages to train AI models.

When a customer writes, we send the recent conversation, your business profile, your agent’s instructions and rules, and (if enabled) matching product data to an AI model that runs on Cloudflare Workers AI. The model returns a reply, a classification and a short summary. We send it to Cloudflare only to get that answer.

AI replies can be wrong. Each business is responsible for its agent’s instructions and for checking what it says. Your team can take over any chat at any time.

We use these service providers (sub-processors) only to run Agent24:

• Cloudflare — hosting (Workers), the database (D1), the AI model (Workers AI) and request logs.
• Kapso — the connection to the WhatsApp Business Platform: it delivers incoming messages to us and sends replies.
• Meta (WhatsApp Business Platform) — carries WhatsApp messages between your business and its customers. Meta’s own terms and privacy policy apply to WhatsApp.
• Resend — sends our transactional emails (verification, sign-in links, password resets, invitations, handoff alerts).
• Google (Firebase Cloud Messaging) — delivers push notifications to the Android app. It receives the app’s push token and the notification (title, text and a link inside the app).
• Your browser’s push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari) — delivers browser notifications if you turn them on. The notification content is encrypted for your browser; the push service sees only the subscription address and delivery details.
• Google — only if you sign in with Google, and when you give us a Google Sheets link to import products.

Inside a business, members see that business’s data according to their role. We may also disclose data if the law requires it, or to protect our users or the service, or to a buyer if Craftdesk is sold (with this policy still applying).

These providers may process data outside India. Where they do, we rely on their contractual and security commitments.

We use only cookies we need to run the service:

• Session cookie (better-auth.session_token, with a secure prefix online) keeps you signed in. Unless you untick “Keep me logged in”, it lasts until you log out or the session expires.
• Intro cookie (relay_intro, 1 year) remembers that this browser has seen the welcome screens.

The Android app keeps its sign-in token in the device’s secure storage, and clears it when you log out. If you turn on browser notifications, the browser installs a small service worker for this site that only shows our notifications. We do not use advertising, analytics or tracking cookies.

Data travels over HTTPS. Passwords are hashed. Kapso API keys and webhook secrets are encrypted at rest and bound to their business. Every business’s data is kept separate and is only reachable by its signed-in members. Incoming WhatsApp webhooks are checked with a signature. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

• Account, business, CRM, conversation and product data: while the account or business is active.
• After you delete your account (or an owner deletes a business), we delete or anonymise its data within 30 days, unless the law requires us to keep something longer (for example billing or tax records).
• Database backups are kept for the backup window of our database (Cloudflare D1 Time Travel) and then expire, so deleted data disappears from backups at the end of that window.
• Sign-in links, verification links and invitations expire automatically; expired sessions stop working.

A business owner or admin can delete a contact, with its chat history, at any time. See Delete your account for how account deletion works.

Depending on where you live (including under India’s Digital Personal Data Protection Act, 2023), you may have the right to:

• get a summary of the personal data we hold about you and how we use it;
• have it corrected, completed or updated;
• have it erased;
• withdraw consent where we rely on it (this does not affect what was done before);
• nominate someone to act for you if you die or become unable to;
• complain to us, and then to the relevant authority (in India, the Data Protection Board of India).

Most account and business data can be viewed and changed in Settings. For anything else, email craftdeskdev@gmail.com from your account’s email address. We answer within 30 days. End customers of a business should contact that business; we will help it respond.

Agent24 is a business tool for people aged 18 or older. We do not knowingly create accounts for children. Businesses must not use Agent24 to collect children’s data without the consent the law requires.

If we change this policy we will update the date at the top, and for significant changes we will tell account owners by email or in the app before the change takes effect.

Craftdesk, Calicut (Kozhikode), Kerala, India. Email: craftdeskdev@gmail.com.