Bits & Gears
Bits & Gears ("we", "us", "our") provides conversational assistant (chatbot) and business-automation services to small and medium-sized businesses ("Business Clients"). Our platform connects to messaging channels operated by Meta Platforms, Inc. ("Meta") — Facebook Messenger, Instagram Direct Messages, and the WhatsApp Business Platform — so that our Business Clients can respond to their customers automatically and with human agents.
This Privacy Policy explains what information we collect when you interact with a business through our platform, how we use it, who we share it with, and the choices you have. It applies to:
For End User conversations, the Business Client you are messaging is the data controller of your conversation data, and Bits & Gears acts as a service provider (data processor) on their behalf. For our website and for Business Client account information, Bits & Gears is the data controller.
Contact: privacy@bitsandgears.com · Bits & Gears, México.
When you message a business connected to our platform, we receive the following information from Meta's APIs, strictly limited to what is needed to operate the conversation:
| Channel | Data received |
|---|---|
| Facebook Messenger | Your Page-Scoped ID (PSID), your public name and profile picture, the content of the messages you send to the Page, message timestamps, and interaction events (button taps, quick replies). |
| Instagram Direct | Your Instagram-Scoped ID (IGSID), your username, the content of the messages you send to the professional account, message timestamps, and interaction events. |
| WhatsApp Business Platform | Your phone number, your WhatsApp profile name, the content of the messages you send to the business number, message timestamps, and delivery/read status metadata. |
We do not collect your Meta account password, your friends list, your contacts, your location, or any data beyond the messaging scope described above. We do not use Meta data to build advertising profiles.
bitsandgears.com uses Google Analytics 4 to understand aggregate site usage, and a contact form that collects the name, email, and message you choose to send us.
We do not sell personal data, and we do not use conversation data for third-party advertising, credit eligibility decisions, surveillance, or any purpose prohibited by Meta's Platform Terms.
Automated replies are generated with the help of artificial-intelligence language models operated by vetted service providers acting under contract as our processors. Message content is processed only to generate a response for the conversation in which it was sent. We do not permit our AI providers to use End User conversation data to train their general-purpose models.
Where the GDPR or similar laws apply, we process data on the basis of: performance of a contract (delivering the conversation you initiated), legitimate interests (service security and improvement), consent (where required), and legal obligations. In Mexico we comply with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP); this policy also serves as our aviso de privacidad for those purposes.
If a Business Client disconnects their Meta assets from our platform, we delete the associated Meta Platform Data within 30 days.
We use encryption in transit (TLS), access controls, isolated per-client environments, and least-privilege credentials granted through Meta's official OAuth flows. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.
Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent (rights ARCO under Mexican law).
To request deletion of your data:
We confirm and complete deletion requests within 30 days. If you interacted with a business through our platform, we will also notify that business of your request. You can additionally manage app permissions from your Facebook or Instagram settings under "Apps and Websites".
Our services are directed to businesses and their adult customers. We do not knowingly collect data from children under 13 (or the higher minimum age required in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.
Our infrastructure may process data in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses.
Our use of data received from Meta's APIs complies with Meta's Platform Terms and Developer Policies, the Messenger Platform policies, the Instagram Platform policies, and the WhatsApp Business Terms of Service, including limitations on the use, sharing, and retention of Platform Data.
We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date, and notify Business Clients of material changes.
Questions or requests: privacy@bitsandgears.com