01Who we are
Macrosbit ("Macrosbit", "we", "us") is a business software company based in Kuwait. We build HR and payroll software, Macrosbit Chatbit (a shared inbox for WhatsApp, Instagram, email and SMS), document management software, websites and apps.
MacrosbitLulu Complex, Salem Al-Mubarak Street, Salmiya, Hawalli, Kuwait
Email: info@macrosbit.com
Phone: +965 6767 0216
02What this policy covers
This policy applies to:
- our website, macrosbit.com;
- the Macrosbit HR mobile app for Android and iOS (package
com.macrosbit.hr), which employees use to reach their employer's Macrosbit HR system; - our software and apps, including Macrosbit Chatbit and our Meta app that connects to the WhatsApp Business Platform (Cloud API), the Facebook Graph API and the Instagram API;
- support, sales and demo conversations with us.
Our two roles. When businesses ("customers") use Chatbit to talk to their own clients ("end users") on WhatsApp or Instagram, the business decides what messages are sent and why. For that message data, the business is the controller and Macrosbit acts as a service provider (processor) working on the business's instructions. For our own website visitors, customers' account details and our own marketing, Macrosbit is the controller.
The same applies to the HR software and the HR mobile app: the employer that uses Macrosbit is the controller of its employees' records, and Macrosbit processes them on the employer's instructions.
If you are an end user who messaged a business that uses Chatbit, that business's own privacy policy also applies to you, and you can contact it directly about your data.
03Information we collect
Information you give us
- Contact and demo requests: name, company, email address, phone number, the product you are interested in and your message.
- Account information: names, business email addresses, phone numbers, job roles and login details of the people a customer adds to Chatbit or to its HR system.
- Billing information: company name, billing contact and invoice details.
- Support requests: what you tell us when you ask for help.
Information collected automatically
- Technical data: IP address, browser and device type, and pages visited, recorded in standard server logs.
- App usage data: sign-in times, actions taken in the app and error logs, used to run and secure the service.
04Data we receive from WhatsApp and Meta
When a business connects its WhatsApp Business Account, Facebook Page or Instagram professional account to Chatbit, it authorises our Meta app to access data through Meta's APIs. We only request the permissions needed to provide the features the business uses.
| Data | What it includes |
|---|---|
| Business account data | WhatsApp Business Account ID, phone number ID, display name and verification status, message templates, Facebook Page or Instagram account ID and name, and the access tokens that let us connect on the business's behalf. |
| Contact data | The WhatsApp phone number and profile name of end users who message the business, or the Instagram user ID and username where Instagram is connected. |
| Message content | Text, images, documents, audio, video, locations and other content that end users send to the business, and the replies the business sends. |
| Message metadata | Timestamps, message IDs, and delivery and read statuses. |
Our commitments on Meta Platform Data
- We use data from Meta only to provide Chatbit to the business that connected its account, as described in this policy.
- We do not sell, license or rent Meta Platform Data, and we do not use it for advertising, profiling or data brokering.
- We do not combine it with other data to identify or target individuals outside the business's own conversations.
- We do not message end users on our own behalf. Only the business sends messages, and it is responsible for getting end users' opt-in as WhatsApp's Business Messaging Policy requires.
- We follow the Meta Platform Terms, the Developer Policies and the WhatsApp Business Policy.
05Data we receive from Google
A person can connect their own Google account to Macrosbit with Google sign-in. Each feature asks only for the access it needs, the person sees Google's consent screen before anything is shared, and they can disconnect at any time. We access a Google account only for the person who connected it, and only to provide the features they use in Macrosbit.
| Google data | What we do with it |
|---|---|
| Basic profile | Your Google account's email address, used to show which account is connected and to match it to your Macrosbit user. |
| Gmail | Reading, labelling and sending the messages of the connected mailbox, so you can read and answer your email in Macrosbit Chatbit, so the emails you choose to send from Macrosbit go out from your own address and, if you turn it on, so the Macrosbit AI assistant can tell you about new email that needs you. |
| Google Calendar | Showing your primary calendar in Macrosbit, creating and updating the events you schedule there (for example a meeting booked from a conversation), reading free/busy times so the times offered do not clash with your calendar and, if you turn it on, letting the Macrosbit AI assistant remind you of what is coming up. Events are read live from Google; we keep only the IDs of the events Macrosbit created. |
| Google Search Console | Read-only search performance data (queries, pages, clicks, impressions, positions) for the websites you choose, shown in Macrosbit Growth reports. |
| Google Analytics | Read-only traffic and conversion reports for the properties you choose, shown in Macrosbit Growth reports. |
| Google Business Profile | Your business locations' reviews, insights and posts, so you can read and reply to reviews and publish posts from Macrosbit. Replies and posts are sent only when you or your team press send or approve them. |
| Google Ads | Campaign, ad group, budget and performance data for the ad accounts you connect, and the changes you make in Macrosbit Ads Manager. New campaigns are created paused, and nothing is changed without a person's action. |
Our commitments on Google user data
- Macrosbit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data only to provide and improve the user-facing features of Macrosbit that the person connected their account for. We do not use it for advertising, including retargeting or interest-based ads, and we do not sell it or give it to data brokers or information resellers.
- We do not transfer Google user data to others except as needed to provide or improve those features, to comply with the law, for security, or as part of a merger or acquisition with the same protections, and then only with the person's consent where it is required.
- We do not use Google user data, including Google Workspace data, to develop, improve or train generalised artificial intelligence or machine learning models. Where a person or their organisation turns on Macrosbit AI features (for example a suggested reply to an email), the content is processed only to give that result to that person, and our AI providers do not use it to train their models.
- People do not read your Google data unless you ask us to (for example to help with a support request), it is needed for security or to investigate abuse, the law requires it, or it has been aggregated and anonymised for internal operations.
How Google data is stored and protected
Google sign-in for every Macrosbit server goes through Macrosbit's own connector service. The long-lived access Google issues (the refresh token) is encrypted with AES-256-GCM, and the copy kept on your organisation's Macrosbit server is sealed so it cannot be used outside that service. Data read from Google is stored on your organisation's Macrosbit server, sent only over encrypted connections (HTTPS/TLS), and is visible only to the people your organisation authorises.
Disconnecting and deleting Google data
- Disconnect the Google account in Macrosbit, in your profile or where the feature connected it. We delete the stored access straight away and stop reading from Google.
- You can also remove Macrosbit's access at any time on your Google Account permissions page.
- Reports already built from Google data (for example Growth search reports) stay in your organisation's Macrosbit records until your organisation deletes them. To have Google data deleted, ask as described in Data deletion; we complete it within 30 days, unless your organisation must keep a record by law.
06Macrosbit HR mobile app
The Macrosbit HR app lets employees use their employer's Macrosbit HR system on their phone: attendance, requests and approvals, leave, payslips, documents, notifications, team chat and the employer's connected WhatsApp and Instagram inboxes. You sign in with the account your employer gives you. The app has no advertising and does not sell or share your data for advertising.
| Data | What it includes and why |
|---|---|
| Profile and employment data | Your name, employee ID, email address, phone number, job, department, profile photo and the HR records your employer keeps (attendance, leave, requests, payslips and documents). Shown to you and to the people your employer allows. |
| Precise location | Taken when you punch in or out, to record where you did it. If your employer turns on live attendance tracking, the app also sends your location in the background only while you are clocked in, so you appear on your employer's live attendance map. Android shows a notification the whole time this is running, and it stops as soon as your shift ends (when you punch out, sign out, or the server sees no open shift). Your location is never collected when you are not clocked in. You can also choose to share a location in a chat. |
| Photos, files and camera | Photos you take or pick and files you attach to requests, chats or your profile. The app only reads the items you choose. |
| Microphone and audio | Used only while you record a voice note or are on a call you make or answer. Voice notes are stored with the conversation; calls are not recorded. |
| Messages | Team chat messages and the WhatsApp and Instagram conversations of your employer's inbox, if your employer gives you access. Team chats are visible only to their members. |
| Fingerprint or face unlock | Handled entirely by your phone. We only receive a yes or no result; your biometric data never leaves your device. |
| Device and notification data | A push notification token, device model, operating system and app version, used to deliver work notifications and incoming call alerts and to keep your sessions secure. |
| Crash reports | Error details and the device type when the app crashes, without your name or other personal details, used only to fix problems. |
| AI assistant | If your employer turns on Macrosbit AI and you use it, your questions and the records needed to answer them are processed by our AI providers on our instructions. They are not used to train public models. |
Your choices in the app
- The app asks before using your location, camera, photos, microphone or notifications, and you can withdraw any permission in your phone's settings at any time. Some features, such as punching in with location, will not work without it.
- All data travels over encrypted connections (HTTPS/TLS) and is stored on your employer's Macrosbit server. Sign-in tokens are kept in your phone's secure storage.
- Your data is shared only with your employer's authorised staff and with the service providers listed below that run the service, never sold.
- To delete your account and its data, see Data deletion.
07How we use information
- To provide the service: receiving, storing and showing messages in the Chatbit inbox, sending the business's replies and templates through the WhatsApp Cloud API, assigning conversations to team members and showing delivery status.
- AI-assisted features: where a business turns them on, Macrosbit AI processes message content to suggest replies, summarise conversations or route messages. These results are shown only to that business. We do not use one business's message content to serve another business.
- To support and secure the service: answering support requests, fixing problems, preventing abuse and spam, and keeping accounts secure.
- To run our business: answering demo requests, billing, and meeting legal and tax obligations.
- To communicate with customers: service notices and, with permission where the law requires it, product news. You can unsubscribe at any time.
We process information because it is needed to perform our contract with the business, because of our legitimate interest in running and securing the service, because the law requires it, or with consent where consent is required.
09How long we keep information
- Messages and contacts are kept for as long as the business's Chatbit account is active, or for a shorter period the business chooses.
- When a business disconnects its WhatsApp, Facebook or Instagram account, or a person disconnects their Google account, we stop receiving new data from it and delete the stored access tokens straight away.
- When an account is closed or deletion is requested, we delete or anonymise the related data within 30 days, except where the law requires us to keep certain records, such as invoices.
- HR records, including attendance locations, are kept for as long as your employer's retention settings and employment law require, then deleted by your employer.
- Server logs are kept for up to 90 days.
- Backups are overwritten on a rolling basis, and deleted data is cleared from them within a further 30 days.
10Data deletion instructions
You can ask us to delete your data at any time.
If you are a business using Chatbit
- Disconnect your WhatsApp, Facebook or Instagram account in Chatbit settings, or remove the Macrosbit app in Meta Business Settings under Integrations › Business integrations. This stops our access straight away.
- To delete all data we hold for your business, email info@macrosbit.com from an account admin's address with the subject "Data deletion request" and your business name.
If you use the Macrosbit HR app
- Your account is created by your employer. To have it and its data deleted, ask your employer's HR team, or email info@macrosbit.com with the subject "HR app account deletion", your name, your work email and your employer's name. We will pass the request to your employer and help it carry out the deletion.
- When the account is deleted, your sign-in, profile photo, chat messages, device tokens and location history are deleted. Your employer may have to keep some employment records, such as payroll and attendance, for as long as the law requires.
- Signing out of the app removes your sign-in and stops notifications on that phone straight away.
If you messaged a business that uses Chatbit
- Contact that business first, since it controls your conversation with it.
- You can also email info@macrosbit.com with the subject "Data deletion request", the phone number or Instagram username you used, and the name of the business. We will pass your request to that business and help it carry out the deletion.
We confirm receipt within 5 business days and complete deletion within 30 days. To protect your data, we may ask you to confirm that you own the account before we delete anything.
11Security
We protect information with measures that include encryption in transit (HTTPS/TLS), encrypted storage of access tokens, access limited to authorised staff by role, regular updates and monitoring. No system is completely secure. If a breach affects your data, we will inform the affected business and, where the law requires it, the people affected and the authorities, and we will tell Meta where its terms require it.
12Your rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you;
- correct it if it is wrong;
- have it deleted;
- object to or limit how we use it;
- receive a copy in a portable format;
- withdraw consent where we rely on consent.
To use any of these rights, email info@macrosbit.com. We reply within 30 days. If we hold your data on behalf of a business, we will pass your request to that business and help it respond.
13International transfers
We and our service providers, including Meta, may process information outside your country. Where we transfer it, we take steps to keep it protected as this policy describes and as the law requires.
14Children
Our products are business tools and are not meant for children. The HR app is for employees of working age. We do not knowingly collect information from children under 13, or under the minimum age set by local law. If you think a child has given us information, contact us and we will delete it.
15Changes to this policy
We may update this policy as our products or the law change. We will change the "Last updated" date at the top and, for important changes, tell customers by email or in the app before the change takes effect.
16Contact us
For privacy questions, requests or complaints:
Macrosbit, PrivacyLulu Complex, Salem Al-Mubarak Street, Salmiya, Hawalli, Kuwait
Email: info@macrosbit.com
Phone: +965 6767 0216 or +965 6991 4556