Privacy Policy

1. Who is responsible

When we decide how data is used. For visitors to negorate.ai, people who contact us, and the staff accounts of businesses that subscribe to Negorate, CodeGen International (Pvt) Ltd. is the controller (or “data fiduciary”) of the personal information. Our address is Bay No 1-5, TRACE Expert City, Tripoli Market Square, Maradana, Colombo 10, Sri Lanka, and you can reach us, including our data protection contact, at [email protected].

When we act for a business. Hotels, airlines and other businesses (our “customers”) use Negorate to talk to their own customers. When you message or call such a business, that business is the controller of your information and decides why it is processed; we process it as its processor, only on its instructions and under a contract with it. The business’s own privacy notice applies, and you can contact the business directly about your information. If you contact us instead, we will pass your request to the business and help it respond.

2. Information we collect

From you on negorate.ai

• What you send through the Contact us form: your name, email address, company and message.
• What you type or say to the assistant on this website, including voice if you choose to speak to it.
• Technical data our servers record when you visit: IP address, browser and device type, the pages requested and the time.

From business account holders

• Staff names, work email addresses and sign-in details (email, or your name, email and profile picture if you sign in with Google).
• Business details, settings, content and the rules a business sets for its AI agents.
• Billing contacts and payment records. Card payments are handled by our payment processor; we never see or store full card numbers.

When you talk to a business that uses Negorate

• The messages, photos and documents you send, and the replies you receive.
• On phone and voice calls: the audio and transcript of what is said.
• Identifiers from the channel you use: your name or profile name, phone number (WhatsApp and phone calls), or account or user ID (Instagram, Messenger, Telegram), received from that messaging platform.
• Details you give to make or manage a booking or request: dates, names of travellers or guests, contact details and, where the business needs them to complete a booking (for example an airline), date of birth, nationality and passport or identity document details.

Giving information is up to you, but without the details a business needs for a booking, it cannot complete it; and a business account needs a name and email address to work.

3. WhatsApp, Instagram and Messenger

When a business connects its WhatsApp Business account, Instagram professional account or Facebook Page to Negorate, we receive through Meta’s official APIs only what is needed to hold the conversation: the messages and media sent to that business, the sender’s platform ID, profile name and (for WhatsApp) phone number, and message delivery status. We use this data only to reply on the business’s behalf, to hand the conversation to its staff when needed, and to keep a record of the conversation for that business.

We do not sell this data, use it for advertising or to build marketing profiles, share it with data brokers, or access anything beyond the conversations with the connected business account. We handle it in line with Meta’s Platform Terms and the WhatsApp Business policies.

4. Why we use information, and our legal bases

Where we are the controller, we use personal information for these purposes, each on the legal basis shown:

• Providing the platform to business customers, including accounts, support and billing: to perform our contract with them, and our legitimate interest in serving the people who work for them.
• Answering your enquiries through the Contact us form or the website assistant: our legitimate interest in responding, or steps you ask for before a contract.
• Keeping the service secure, preventing fraud and abuse, and fixing problems, including reviewing conversation records when something has gone wrong: our legitimate interest in a safe, working service, and our legal obligations.
• Improving the quality and accuracy of the service, using the least data needed and de-identified data where possible: our legitimate interest in a better service.
• Accounting, tax and legal requirements: our legal obligations.
• Product news to business contacts: your consent, or our legitimate interest where the law allows. Every email lets you unsubscribe.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. Where we rely on consent, you can withdraw it at any time without affecting what was done before. When we process information for a business (section 1), the business decides the purpose and legal basis.

5. AI and automated decisions

Negorate’s assistants use AI models to understand messages and write replies. Messages are sent to the AI model providers we use only to produce those replies, under contracts that limit their use of the data to providing the service to us. Businesses that use Negorate must make it clear that you are talking to an AI assistant.

A business can let its assistant make some decisions automatically within rules the business sets: for example which rooms, flights or fares to offer, or whether to accept a price you propose. To do this the assistant uses what you have told it in the conversation (such as dates, number of guests or travellers, and the price you asked for) together with the business’s prices, availability and rules. These decisions are made for the business, not by us. You can ask the business for a person to deal with you, and to review any outcome. We do not ourselves make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Who we share information with

• The business you are talking to, which sees its own conversations and bookings.
• Service providers acting for us under contracts that require them to protect the data and use it only for us: cloud hosting, AI model providers, payment processors, email and telephony providers, and the messaging platforms that carry the conversation (Meta for WhatsApp, Instagram and Messenger; Telegram).
• Authorities, when the law requires it or to protect the rights, property or safety of people or of the service.
• A buyer or successor, if all or part of our business is sold or reorganised, under the same protections.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. International transfers

Negorate runs on cloud infrastructure, and our service providers operate, in several countries, mainly the United States and the United Arab Emirates, and also Sri Lanka, where our team works. Your information may therefore be processed outside the country where you live. When we move personal information out of the European Economic Area, the United Kingdom or another country that restricts such transfers, we use the safeguards the law requires, such as the European Commission’s Standard Contractual Clauses and the UK addendum to them. You can ask us for a copy of the relevant safeguards at [email protected].

8. How long we keep it

Conversation records are kept for as long as the business that uses Negorate needs them to provide its service and meet its legal obligations, and are deleted when that business asks or closes its account. Business account data is kept while the account is open and then for as long as the law requires (for example, for tax records). Contact form messages, website chats and server logs are kept only for as long as needed for the purpose they were collected for, and then deleted or anonymised.

9. Security

We protect information with encryption in transit, access controls that keep each business’s data separate, and access limited to staff who need it. No system is perfectly secure. If a breach affects personal information, we will notify the affected businesses, the authorities and the people concerned as the law requires.

10. Your rights

Depending on where you live, you have some or all of these rights over your personal information:

• to know what we hold and get a copy of it (access), including in a portable format;
• to have it corrected or completed;
• to have it deleted;
• to object to or restrict how we use it, and to withdraw consent;
• not to be subject to a decision based solely on automated processing that significantly affects you, and to have a person review it;
• to nominate someone to exercise your rights if you die or cannot act (India);
• to complain to us and to a data protection authority.

To use any of these rights, email [email protected]. We may ask you to confirm your identity first. We reply within one month (30 days in Australia), and sooner where the law requires; there is normally no charge. You can also act through someone you authorise. We will not treat you differently for using your rights.

Where to complain

• European Economic Area: the data protection authority in your country (listed by the European Data Protection Board). United Kingdom: the Information Commissioner’s Office.
• Australia: contact us first; if you are not satisfied with our response within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC).
• Sri Lanka: the Data Protection Authority of Sri Lanka.
• India: our grievance contact at [email protected], and then the Data Protection Board of India.
• Elsewhere: the data protection or privacy authority where you live.

11. Notice to United States residents

Residents of California and other US states with consumer privacy laws have the rights to know, access, correct and delete their personal information, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell personal information or share it for targeted advertising, and we honour Global Privacy Control signals.

In the last 12 months we collected these categories: identifiers (name, email, phone number, account IDs, IP address); commercial information (bookings and requests); internet activity (pages visited on negorate.ai); audio (voice conversations); professional information (business account details); and, only where a business needs it to complete a booking, government identification (passport details), which is sensitive personal information used only for that booking. The sources, purposes, recipients and retention for each are described in sections 2 to 8.

12. How to delete your data

To ask us to delete the personal information we hold about you, including conversations held over WhatsApp, Instagram or Messenger:

1. Email [email protected] with the subject “Delete my data”.
2. Tell us the business you talked to, the channel you used, and the phone number, username or email address you used with it, so we can find your records.
3. We will confirm your request, delete the information within one month, and tell you when it is done. If we must keep something by law (for example, records of completed bookings or payments), we will tell you what and why.

You can also stop a conversation at any time by blocking the business on the messaging app, and you can remove any app connected to your Facebook or Instagram account in that account’s settings.

13. Children

Negorate is not directed at children: under 18 in India, and under 16 elsewhere (or the age of digital consent where you live). We do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

14. Cookies

negorate.ai does not use advertising or analytics cookies, and does not track you across other websites. It stores only what it needs to work, such as the state of the chat window, which is strictly necessary and does not need consent.

15. Changes to this policy

We may update this policy. We will change the date at the top when we do, and for significant changes we will give notice on this website or to business account holders before they apply.

16. Contact

CodeGen International (Pvt) Ltd.
Bay No 1-5, TRACE Expert City, Tripoli Market Square, Maradana, Colombo 10, Sri Lanka
Privacy questions, rights requests and grievances: [email protected]