Privacy Policy

Gosto (“Gosto”, “we”, “us”) is a service operated by Signotech LLC, 2055 Limestone Rd STE 200-C, Wilmington, DE 19808. Gosto lets businesses build AI agents that talk to their customers on a website chat, on WhatsApp and over the phone. This policy explains what personal data we handle, why, who we share it with, how long we keep it and how you can have it deleted.

1. Who this policy covers

We handle personal data about two groups of people:

• Our users – people who sign up for Gosto and the members of the businesses they create. For their account data we are the controller.
• Our users’ customers – people who write to or call a business through a Gosto agent (for example on that business’s WhatsApp number or website). For this data the business is the controller and Gosto acts as its processor: we process it only on the business’s instructions and to provide the service to it. If you are one of these customers, the business you contacted is your first point of contact, but you can also reach us directly (see section 9).

2. Data we collect

From users

• Account data: name, email address and, if you sign in with Google, your Google profile name, email and picture. We never see your Google password.
• Business data: business name, web address, team members and their roles, and invitations.
• Agent content: instructions, knowledge, files and website pages you give an agent, and conversations you have with the agent builder.
• Billing data: subscription plan and status. Payments are handled by Stripe; we do not receive or store full card numbers.
• Usage and device data: pages visited, clicks, session recordings and heatmaps of the Gosto website and app, browser type, approximate location derived from IP address, and usage counts used for limits and billing.

From our users’ customers

• Contact details: name, phone number, email address, and WhatsApp identifiers (WhatsApp ID and business-scoped user ID) when the channel provides them.
• Conversation content: messages (and any media the channel supports) sent to or by the agent or the business’s team, plus delivery and read status, and the summary, priority and outcome the agent notes for the business.
• Calls: the caller’s phone number and the audio of the call, which our voice provider processes in real time to hold the conversation. We store a transcript. Our voice provider may keep the call audio for a limited period under its own retention settings.
• Preferences: for example a request to stop receiving marketing messages.

3. Data we receive from Meta (WhatsApp)

When a business connects its WhatsApp Business Account to Gosto through Meta’s signup flow, Meta shares the following with us (“Platform Data”):

• the WhatsApp Business Account ID, phone number ID, display phone number, verified business name, quality rating and messaging limits;
• an access token that lets Gosto send and receive messages for that account;
• messages customers send to that number, their WhatsApp profile name and WhatsApp identifiers, and the delivery status of messages sent from it.

We use Platform Data only to:

• receive customers’ messages and let the business’s agent and team reply to them;
• show the conversation, its contact and its delivery status in the business’s inbox;
• give the business a copy of its own WhatsApp conversations when it asks, such as before it disconnects;
• detect when access was revoked so the business can reconnect, and keep the service secure and working.

We do not sell Platform Data, use it for advertising or to build profiles of people, share it with data brokers, combine it across different businesses, or use it for any purpose other than providing Gosto to the business that connected it. We use Platform Data in accordance with Meta’s Platform Terms and Developer Policies. Access tokens are stored encrypted. A business can disconnect WhatsApp from its agent at any time, and can also remove Gosto’s access from Meta Business Suite.

4. How we use personal data

• To provide the service: run agents, deliver messages and calls, keep the inbox, send sign-in links and team notifications.
• To generate agent replies. Conversation content is sent to AI model providers to produce the agent’s answer. We do not use your or your customers’ content to train AI models.
• To bill subscriptions and enforce usage limits.
• To keep Gosto secure: prevent abuse, fraud and spam, rate limiting, and debugging.
• To improve Gosto, using usage analytics of our own website and app.
• To comply with the law and enforce our terms.

Where the GDPR or similar laws apply, our legal bases are: performing our contract with you, our legitimate interests in running and securing the service, your consent where we ask for it, and legal obligations.

Agents sort conversations by priority and summarise them for the business’s team. Gosto does not make decisions that have legal or similarly significant effects on anyone; people at the business decide what to do.

5. Who we share it with

We do not sell or rent personal data. We share it only with the service providers that run Gosto for us, under contracts that limit their use to providing that service, and when the law requires it. These are the kinds of providers we use; a current list of them is available to our users on request at contact@gosto.ai.

Inside a business, its members can see that business’s agents, contacts and conversations. We may also disclose data if required by law, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

6. Cookies and analytics

We use a session cookie to keep you signed in. For analytics we run our own Umami instance rather than a third-party ad network; it records page views, clicks, session replays and heatmaps of the Gosto site and app, and for signed-in users links them to the account. On our public pages (not inside the app) we also use the Meta Pixel, which sets Meta’s advertising cookies so we can measure and reach people who visited from our ads. The website chat widget on a business’s site does not track visitors across sites.

7. How long we keep it

• Account and business data: while the account or business exists.
• Conversations, contacts and call transcripts: until the business deletes them, deletes the agent or the business, or asks us to.
• WhatsApp access tokens, conversations and the contacts known only from them: until WhatsApp is disconnected from the agent, or the agent or business is deleted.
• Billing records: as long as tax and accounting law requires.

When data is deleted from Gosto it is removed from our live database straight away and from backups within 30 days.

8. Security

Data is encrypted in transit (TLS). Channel access tokens are encrypted at rest with a key held separately from the database. Access to each business’s data is limited to its members, and our staff access production data only when needed to support or secure the service. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

9. How to delete your data

Users: the owner of a business can delete it from Settings → Delete this business, which deletes its agents, contacts, conversations and channel connections. To disconnect WhatsApp only, open the agent’s WhatsApp channel and choose Disconnect, which also deletes that agent’s WhatsApp conversations and the contacts known only from them; download a copy there first if you want to keep them. To delete your whole account, email contact@gosto.ai from the address you sign in with.

People who messaged or called a business: ask the business to delete your conversation, or email contact@gosto.ai with the subject “Data deletion”, the phone number or email you used, and the name of the business you contacted. We will confirm we received it and complete the deletion within 30 days, letting the business know.

Removing Gosto from Facebook or WhatsApp: removing Gosto’s access in Meta Business Suite stops us receiving Platform Data for that account. To also delete what we already hold, disconnect WhatsApp in Gosto, or email us as above.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, to withdraw consent, and to complain to a data protection authority. California residents have the right to know, delete and correct, and not to be discriminated against for using these rights; we do not sell or “share” personal information as the CCPA defines it. To use any of these rights, email contact@gosto.ai. We may need to confirm your identity first, and we answer within 30 days (45 for California requests). If your data came to us through a business, we may pass your request to that business, as it controls the data, and help it respond.

11. International transfers

Gosto is run from the United States and our providers may process data in the United States and other countries, which may have different data protection laws from yours. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.

12. Children

Gosto is for businesses and is not directed at children under 16. We do not knowingly collect their data, and businesses may not use Gosto to target children. If you believe a child’s data is in Gosto, email us and we will delete it.

13. Changes

We will post changes on this page and update the date at the top. If a change is significant, we will tell users by email or in the app before it takes effect.

14. Contact

Signotech LLC
2055 Limestone Rd STE 200-C
Wilmington, DE 19808
contact@gosto.ai
+1 (231) 442-2481

See also our Terms of Service.