Last updated: 28 September 2026

Noybo Privacy Notice

Noybo is an AI-assisted business receptionist designed to answer business questions and handle appointment requests through WhatsApp. Our demonstrations use fictional businesses; demonstration bookings are not appointments with real shops. Development, cloud staging and production are separate. Production infrastructure is currently dormant and does not process real-client WhatsApp traffic. The service processing described below applies when an environment’s messaging and AI functions are enabled.

Noybo is operated by Noybo Company, a one-person limited liability company registered in Saudi Arabia, under the Noybo brand. For privacy questions or requests, contact ixbproductionsllc@gmail.com.

Information and use

We process WhatsApp numbers and channel identifiers, message text and replies, timestamps, provider message identifiers and delivery information. Appointment records include the business, service, employee, date/time, price, status and cancellation/rescheduling history. Conversation and handoff records support AI reception and authorized human assistance. Durable inbound/outbound records, duplicate-detection, retries and uncertain-delivery evidence support reliable processing. We also maintain usage, security, operator authentication and audit records. Messages may contain other personal information you choose to include.

We use relevant information to answer business questions, check availability, manage confirmed appointment actions, provide support, prevent duplicate actions, protect access, investigate failures and handle privacy requests. Authorized operators may review relevant records and send business-related replies within their assigned access. The receptionist handles text; unsupported media are not used to fulfil appointment requests, although WhatsApp and technical ingress may receive media or associated metadata. Do not send passwords, payment-card details, identity documents or sensitive health information.

Providers and locations

Meta’s WhatsApp Business Platform carries enabled messages and delivery information. When AI is enabled, relevant conversation, business and booking/tool context is sent to OpenAI. Our application requests that Responses are not stored, but this is not a guarantee of zero provider retention or no abuse-monitoring processing. Mock tests do not call live AI/messaging services.

Cloud services run on Render with private PostgreSQL in Frankfurt, Germany, recovery/backups and operational logs. Local development remains separate. Encrypted production database exports are stored in private Cloudflare R2 EU storage. Cloudflare also supplies configured domain/network services and the development tunnel. Resend carries operational emails/status events. Better Stack and the existing UptimeRobot readiness monitor observe availability and aggregate health, sending incident/recovery notifications. These operational flows are designed to use codes, timing, references and operator contacts rather than customer conversation bodies. Privacy correspondence is received through the contact mailbox.

Known hosting locations do not establish all providers’ processing locations. Providers and their support/control-plane operations may process information outside Saudi Arabia and outside the configured hosting regions. See the provider disclosure below for purposes and links. We do not claim Saudi-only processing or a zero-retention arrangement.

Retention, requests and safeguards

Retention varies by record category and configured business policy. Operator-run tools support scoped export, redaction, anonymization and offboarding. Cancelling an appointment or starting a new chat does not erase history. Structural appointment, duplicate-detection, audit and security records may remain after identifying content is removed.

Backups can retain information removed from active records until expiry. Daily production R2 exports currently use a 30-day lifecycle; this is not a universal 30-day deletion deadline. Managed recovery and provider/email records have separate retention. Restored data must be checked against later deletion decisions before service resumes; universal automatic reconciliation is not implemented. We cannot promise immediate removal from every backup or provider copy.

To request access, correction or deletion, contact the address above with the relevant business, WhatsApp number and request scope. We may need proportionate verification. Do not send passwords, one-time codes or recovery keys. Requests are handled by a person, not automatically fulfilled by the chatbot. Requests involving a business may require coordination with that business. We explain the action taken and relevant limitations; cancelling a booking is not a deletion request.

Access restrictions, operator MFA, controlled booking tools and signature checks in enabled messaging paths reduce risk. Logs are designed to exclude credentials and customer message bodies; stored records are not necessarily anonymous. No system is completely secure. We will update the notice’s date when approved changes are published.

Providers used by Noybo

Noybo is operated by Noybo Company, a one-person limited liability company registered in Saudi Arabia, under the Noybo brand.

This factual disclosure does not assign every provider the same legal role or determine transfer legality. Actual enabled flows govern which information is processed.

Backend production is dormant; enabled test environments and internal operations differ from future client service. Hosting region alone does not establish every processing location.