Privacy policy

This Privacy Policy explains how the Milli SaaS service (“Milli SaaS”, “we”, “us”) collects, uses and protects personal data when you use our services: the millisaas.com website and Milli SaaS systems such as ChatCart.

1. Data we collect

• Account data: the name of the business using our service, the contact person’s name, email address and phone number.
• Data from Instagram: when a business connects its Instagram professional account, we receive through Meta’s official Instagram API the messages sent to and from that account, the sender’s public profile name, user ID and profile picture, message timestamps, comments on the account’s posts, the list of its posts, and the account ID and access tokens.
• Order and customer records: information the business enters about its own customers (for example order contents, delivery address, notes).
• Technical data: IP address, browser type, access times and server logs needed for security.

2. How we use data

• To display messages in a unified inbox and let the business reply to its customers;
• To send automatic replies when the business enables the AI assistant or automation rules;
• To manage orders and customer history;
• To keep the service secure and reliable, and to provide technical support;
• To comply with legal obligations.

We use data received from Meta platforms only to provide the service to the business that connected the account. We do not sell this data, do not use it for advertising, and do not process it for any purpose that conflicts with the Meta Platform Terms.

3. Sharing

Data may be shared with third parties only in the following cases:

• Hosting provider: data is stored on servers operated by Hetzner Online GmbH in Germany.
• Meta Platforms: Meta’s official APIs, to send and receive messages.
• OpenAI: when the AI assistant is enabled, message text and product information may be sent to the OpenAI API to answer free-form questions. By default, OpenAI does not use data sent through its API to train its models.
• Legal requirements: when required by a lawful request from a competent authority.

4. Retention

Data is kept while the business account is active. When an account is closed or a deletion request is received, data is deleted within 30 days. Copies in backups expire automatically within a further 30 days.

5. Security

All connections are encrypted with HTTPS (TLS). Server access requires cryptographic keys, the database is not reachable from the internet, access tokens are stored only on the server, and each business’s data is kept separate from others.

6. Your rights

You may request access to, correction of, deletion of, or restriction of processing of your data by emailing info@millisaas.com. Step-by-step instructions are on the Data deletion page.

7. Customers of our business users

If you messaged a business that uses our service, that business is primarily responsible for those messages and we process them on its behalf as a technical processor. You can send your request to the business directly or to us, and we will help route it.

8. Children

Our services are not intended for people under 18, and we do not knowingly collect data from them.

9. Changes

We may update this policy. The new version is published on this page with its “Last updated” date. We notify active customers of significant changes by email.

10. Contact

Questions: info@millisaas.com. Baku, Azerbaijan.