Last updated: August 15, 2026
1. Introduction
Welcome to AI Super Private Limited ("we," "us," or "our"). We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services, including when you interact with us through messaging and social media platforms like WhatsApp, Facebook, and Instagram.
2. Information We Collect
We may collect the following types of information:
- Personal Information: Name, email address, and other information you provide when registering or contacting us.
- Usage Data: Information about how you interact with our app, such as IP address, browser type, pages visited, and timestamps.
- Social Media Data: When you connect through social media platforms like Facebook, we may receive information you've made publicly available or that you authorize us to access.
- Messaging Data: When you interact with us or our customers through messaging channels such as WhatsApp or Instagram Direct Messages, we may process message content, sender and recipient identifiers, profile information made available by the platform, timestamps, attachments, and conversation metadata needed to deliver automated replies, handoffs, support, analytics, and related service features.
- Cookies: We use cookies to enhance your experience. You can manage cookie preferences through your browser settings.
3. How We Use Your Information
We use your information to:
- Provide, operate, and improve our services.
- Communicate with you, including sending updates or responding to inquiries.
- Deliver messaging automation, including Instagram DM automation, chatbot replies, lead capture, routing, and human handoff workflows.
- Analyze usage trends to enhance user experience.
- Comply with legal obligations.
- We explicitly affirm that Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.
4. Panda and Google User Data
Panda is AI Super's private WhatsApp operations assistant. It allows an authorized user to manage work through natural-language WhatsApp messages and scheduled automations.
When connected to a user's Google account, Panda can perform user-requested actions such as:
- Viewing, creating, updating, rescheduling, and cancelling Google Calendar events.
- Creating Google Meet links.
- Searching and reading authorized Google Drive files.
- Creating and updating Google Docs, Google Slides, files, and folders.
- Running user-configured scheduled workflows and returning their results through WhatsApp.
Panda acts only using permissions granted by the user. Sensitive changes may require confirmation before they are applied. Users can disconnect Google access from the Panda module or revoke access through their Google Account permissions.
- Access and control: Panda accesses Google Drive and Google Calendar data only when the user connects a Google account. It reads, creates, updates, reschedules, or cancels files and events only as necessary to carry out a user request or a workflow the user has configured.
- OAuth tokens and storage: We store the OAuth access and refresh tokens needed to maintain your connection in encrypted or otherwise access-controlled systems. Google data retrieved through the connection may be processed and temporarily cached on our secured systems only as needed to complete your request, maintain the service, prevent abuse, and meet legal obligations. We do not store your Google password.
- Sharing: We do not sell Google user data or share it with third parties for advertising, marketing, or data-broker purposes. Google user data may be processed by service providers acting on our behalf only where necessary to operate, secure, or support Panda; when you direct us to share it; or when disclosure is required by law. These providers are required to protect the data and may use it only to provide services to us.
- Retention and deletion: We retain Google user data and OAuth tokens only for as long as needed to provide the connected features, until you disconnect the integration or request deletion, or as required by law. When you disconnect Google or ask us to delete the data, we delete stored OAuth tokens and Google user data from our active systems within 30 days, except where retention is legally required. Residual copies in encrypted backups are removed through our normal backup-expiration cycle and are not used for any other purpose.
- Disconnection and revocation: You may disconnect Google from Panda through your Panda account settings, revoke Panda's access through your Google Account permissions, or contact us at hello@asi.sg. Revocation prevents future access to your Google account but does not automatically delete data already stored by Panda; you may request deletion using the same email address.
Panda's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models. For more information, see the Google API Services User Data Policy.
5. Sharing Your Information
We do not sell your personal information. We may share your information with:
- Service providers who assist in operating our app (e.g., hosting or analytics providers).
- Messaging and social media platforms, including Meta platforms such as Instagram, Facebook, and WhatsApp, where required to send, receive, or manage messages through those services.
- Legal authorities when required by law or to protect our rights.
6. Data Security
We implement reasonable security measures to protect your information. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
7. Your Rights
Depending on your location, you may have rights to:
- Access, correct, or delete your personal information.
- Opt out of certain data collection or sharing.
- Request a copy of your data.
To exercise these rights, contact us at hello@asi.sg.
8. Third-Party Links
Our app may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their policies.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Please review periodically.
10. Contact Us
If you have questions about this Privacy Policy, please contact us at:
Email: hello@asi.sg
Phone: +65 8085 8100
Address: AI Super Private Limited, 60 Paya Lebar Road, #11-22, Paya Lebar Square, Singapore 409051
AI Super Inbox: connected inbox data
Last updated: October 2, 2026
AI Super Inbox is operated by AI Super Private Limited, 60 Paya Lebar Road, #11-22, Paya Lebar Square, Singapore 409051. Contact hello@asi.sg or +65 8085 8100 for privacy requests. This section supplements our service privacy policy and describes this read-only integration specifically. For AI Super Inbox data, the specific disclosures and retention periods in this section apply. AI Super Inbox is independent and is not affiliated with or endorsed by OpenAI or Meta.
Information processed and purposes
- Connection records: your AI Super user, team and selected messaging-account identifiers, client registration information, approved scope, authorization records, hashed access tokens, expiration and revocation status. We use these to authenticate requests, enforce your current membership and inbox permissions, and manage disconnection. Your AI Super password is entered on our login page, not supplied as a tool input.
- Tool inputs: list_messages accepts optional start/end timestamps, an exact contact identifier, a text search query, a pagination cursor and a result limit. get_message and get_message_image each accept a message identifier. We use these inputs to retrieve the requested records. These tools do not request your full ChatGPT conversation history.
- Message results: stored incoming and outgoing message text, captions and other supported textual message content; sender and recipient identifiers (which may be phone numbers); message identifiers, type, time and delivery status; image availability; and inbox or protected image links. Pagination results include a continuation cursor and scan count. We return these to the connected client to support your requested searches, summaries and review of customer payment claims.
- Image results: available PNG, JPEG or WebP attachment bytes up to 8 MB, MIME type, the message identifier, and an authenticated image link when available. Images may contain names, contact details, payment amounts, references or other personal information placed in them by correspondents. Production media is fetched from Meta using the selected account's credentials, processed in memory and returned to the connected client. The image tool does not persist an additional image file.
- Security and service operation: IP addresses are used for request rate limiting. Website and infrastructure logs may contain request paths, timestamps, browser details, status codes and diagnostic information. These are used to operate and secure the service.
Recipients
When you use the integration in ChatGPT, requested message and image results, including sender and recipient phone numbers or identifiers, message IDs, timestamps and delivery status, are sent to OpenAI for use in that conversation. OpenAI's retention and use of those results are governed by your applicable OpenAI service terms and data controls; revoking this connection does not erase copies already returned there. Meta operates the WhatsApp infrastructure through which the connected business sends and receives messages and media. For this read-only integration, Meta receives authenticated media retrieval requests to provide existing attachments. Our hosting and infrastructure providers process data needed to run the service. Authorized support personnel may process information you provide in a support or privacy request. Disclosures required by law are described in our main policy. We do not sell personal information, as stated in that policy.
Retention
- Access authorization lasts up to 30 days and can be revoked earlier. Expiration prevents new access; it does not itself delete stored connection records.
- Stored inbox records: we retain customer data while the account is active as needed to provide the service. Following account termination or a verified deletion request, user data is deleted from active systems within 30 days unless retention is required by law. Connecting or disconnecting this integration does not automatically delete the underlying AI Super inbox.
- OAuth client, grant and connection records: connection records needed to provide and secure the service are retained while the account is active. User data in these records is deleted from active systems within 30 days of account termination or a verified deletion request, unless retention is required by law. Token expiry is distinct from database deletion.
- System and application logs are retained for up to 90 days for security, troubleshooting and operations. The active-system deletion deadline above applies to user data following account termination or a verified deletion request, unless retention is required by law.
- Backups: backups are performed daily and retained for up to 30 days, then automatically overwritten or deleted. Deleted information may remain in existing backups until their expiration, for up to 30 days after removal from active systems. Backup copies are not used for normal business operations.
- Media returned by the tool is processed in request memory; availability at Meta is governed by that service. Any existing media stored in AI Super is subject to the active-system deletion and backup periods above.
Your controls
You choose one active messaging account in your current team when authorizing. The integration checks your current access on every request and restricts message and image lookups to that team and account. Use the connection management page at ChatGPT inbox access to revoke access. Reconnect to authorize a different account. Revocation stops subsequent tool access but does not delete inbox records or copies in previous conversations. Contact hello@asi.sg to request access, correction or deletion of data, including connection records. Use the connected client's own controls for data already returned to it.
The integration cannot send messages, change payment records or verify bank receipt. Payment claims and screenshots are unverified customer content. Only connect accounts and retrieve correspondence you are authorized to share. Messages and images may contain personal or sensitive information supplied by correspondents. The tools do not automatically redact that content before returning it to the connected client. Select requests carefully and ensure you have permission to share the requested information.
