Privacy Policy

1. Who we are and the two roles we play

Midodze (the “Service”) is operated by Benalika Consult Inc (“we”, “us”), a company incorporated in British Columbia, Canada, and is presented as “Midodze by Benalika Consult”. This policy explains how we handle personal information.

We act in two roles. For the account and billing details of the businesses that subscribe to the Service (“subscribers”), we decide why and how the information is used, so we are the organisation responsible for it. For the comments and messages that people send to a subscriber’s Facebook Page, Instagram account or WhatsApp number (“customers”), the subscriber decides why the information is used and we handle it on the subscriber’s behalf, as its processor. The subscriber’s own privacy notice to its customers governs that second role; this policy tells you what we do within it.

Our Privacy Officer can be reached at contact@midodze.com. We handle personal information in line with British Columbia’s Personal Information Protection Act (PIPA) and Canada’s PIPEDA, and with the GDPR and the California Consumer Privacy Act (CCPA) where they apply.

2. What we collect

From subscribers: your name, business name, email address and country, the details you give when you set up your agent (such as its name, your instructions and knowledge base, and your opening hours), your sign-in credentials (passwords are stored hashed), and the access you grant to your Facebook Page, Instagram account and WhatsApp number. Payments are taken by Stripe, which gives us your billing details and a record of what you paid; we do not receive or store your full card number. If you contact us we keep the correspondence. Our servers keep short-lived operational logs of requests.

From the people who message a subscriber: the name or profile name and identifier that Meta provides, the content of the comment or message, the time it was sent and anything the person chooses to share, which can include an email address or telephone number. We also create a sentiment label for each message, our own reply, and a short rolling summary (the “memory”) of each conversation so the agent’s replies stay consistent. We do not look people up elsewhere and we do not build profiles from sources outside the conversation.

From the subscriber’s connected tools: where a subscriber turns on a lead sync or a notification, we send a captured lead or an alert to that tool, and keep a record that we did.

3. How we use it

We use subscribers’ information to create and run the account, provide and support the Service, take payment, send account and security emails, keep the Service safe, meet legal and tax duties, and improve the Service using usage statistics that do not include message content.

We use customers’ messages only to provide the Service to the subscriber: to classify each message, to write and send a reply, to keep the conversation memory, to flag a message for the subscriber, and to run any tool the subscriber connected. We do not sell personal information, we do not use it for advertising and we do not use message content to train AI models.

4. How AI is used

Messages are read by an artificial-intelligence model that classifies the message and drafts the reply. By default that is Anthropic’s Claude. A subscriber may choose OpenAI or Google’s Gemini instead, using its own account key. The AI providers process the message to produce the answer under commercial terms that do not permit them to train on it by default.

Some messages are not answered. If a message is classified as abusive, offensive or a negative experience with the brand, it is flagged to the subscriber instead. Replies are not decisions with legal or similarly significant effects on a person, and subscribers must not configure the Service to make them. People are entitled to be told that they are talking to an automated assistant; subscribers agree to do that wherever the law or Meta’s rules require it.

5. Why we may process it (GDPR)

Where the GDPR applies to our own use of information, we rely on: performing our contract with the subscriber (running the account, billing); our legitimate interests in securing, operating and improving the Service, which we weigh against your rights; legal obligations (tax and accounting records); and consent where we ask for it, which you can withdraw at any time.

6. Who we share it with

We share information only with the service providers needed to run the Service, each bound to protect it and to use it only for us or for the subscriber. They are listed below. We may also disclose information where the law requires it, to protect people or the Service from fraud or harm, or to a buyer or successor if the business is sold, on terms that keep the information protected. We do not sell personal information and we do not share it for cross-context behavioural advertising.

7. Where it is processed

Our providers operate in Canada, the United States and other countries, so personal information may be processed and stored outside the country where you live, and may be accessible to the authorities of those countries under their laws. We use contracts and safeguards that give it comparable protection, and where the GDPR requires a transfer mechanism we use the European Commission’s standard contractual clauses.

8. How long we keep it

Account and billing information is kept while the account is active and afterwards for as long as the law requires us to keep tax and accounting records. Conversation history and contact memory are kept while the subscriber’s account is active, and are deleted within 30 days of a verified request from the subscriber, or when the account is closed on request. We do not currently delete conversations on an automatic schedule, so a subscriber, or a customer through the subscriber, can ask us at any time. Operational logs are kept for a short period. Backups age out in the ordinary course.

9. Security

We use encryption in transit and at rest for access tokens, keep each subscriber’s data separated, verify inbound messages from Meta, and limit who can reach production systems. Our Security & Trust page describes this in more detail. No system is perfectly secure; if a breach affects your information we will notify the people and authorities the law requires.

10. Your rights

Subject to the law that applies to you, you can ask to see the personal information we hold about you, to have it corrected, to have it deleted, to receive a copy, to object to or restrict some uses, and to withdraw consent. California residents can also ask what we collect, and we confirm that we do not sell personal information. If you are in Ghana, you have the rights given by the Data Protection Act, 2012 (Act 843), including access, correction, objecting to processing, and not being sent direct marketing without your consent.

To use these rights, email contact@midodze.com from the address on your account, or see our Data Deletion & Your Rights page. We answer within 30 days. We may need to confirm who you are first. You will not be treated worse for using a right. If we cannot resolve a concern you may complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or your local data protection authority.

11. If you are a subscriber’s customer

If you wrote to a business that uses Midodze, that business decides how your messages are used and is the first place to ask to see or delete them. You can also email us at contact@midodze.com. We will tell the business, and delete your messages from the Service when the business agrees or the law requires, within 30 days.

12. Cookies and browser storage

Our website and portal use only what is needed to work: a sign-in token stored in your browser so you stay signed in, and, on sign-in and checkout, Cloudflare’s bot-protection check, which may set its own technical cookie. We do not use advertising or third-party analytics cookies or pixels on our site. Payment pages load Stripe’s checkout, which has its own privacy policy.

13. Children

The Service is for businesses and is not directed to children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, tell us at contact@midodze.com and we will delete it. Subscribers decide which audiences they serve and must comply with the laws that protect children.

14. Changes to this policy

We may update this policy. For a material change we will notify subscribers by email or in the portal before it takes effect, and the date at the top shows when it was last updated.

15. Contact

Privacy Officer, Benalika Consult Inc, British Columbia, Canada. Email contact@midodze.com.