Privacy Policy

We collect the following types of information:

• Account information: Name, email address, and authentication credentials when you sign up or log in.
• Facebook & WhatsApp data: When you connect your Meta accounts we receive and store access tokens along with your Facebook user ID, name, and the Pages, Instagram accounts, and WhatsApp Business profiles you grant us access to.
• Lead & Messaging data: Facebook lead form submissions, Instagram DMs, and WhatsApp messages that you configure Litchoo to capture or process through your workflows.
• Usage data: Log data, workflow configurations, execution history, IP address, browser type, and device information.
• Google account & Workspace data: If you sign in with Google or connect a Google account for workflows, we receive your Google account email and basic profile (name). For Google Sheets nodes, we access tab names, header rows, cell ranges, and append rows only in spreadsheets you explicitly select. For Gmail workflow nodes, we send emails you configure via the Gmail API (gmail.send); we do not read your inbox, labels, drafts, or threads. OAuth refresh tokens are stored encrypted per workspace.

• To provide, operate, and maintain the Litchoo automation platform.
• To execute workflows and deliver data to your configured destinations.
• To authenticate your identity and manage your account.
• To send transactional emails (e.g. account verification, error alerts).
• To monitor and improve platform performance and reliability.
• To comply with legal obligations.

Litchoo integrates with the Facebook Marketing API, Facebook Lead Ads, Instagram Graph API, and the official WhatsApp Cloud API. By connecting your Meta accounts, you authorise us to act on your behalf to: retrieve Pages you manage, read lead form submissions, manage Instagram messages, and send/receive WhatsApp messages through Meta's infrastructure.

WhatsApp Data: Messages processed through the WhatsApp Cloud API are transmitted securely to Meta's infrastructure. We decrypt these messages temporarily to display them in your CRM and trigger your workflows. We do not use WhatsApp message data for any purpose other than delivering the Service to you.

Data Usage Limits: We do not sell, share, or use your Meta data (including Facebook, Instagram, and WhatsApp data) for advertising, data brokering, or any purpose other than operating the specific features you have explicitly configured. All tokens and data are stored encrypted and deleted when you disconnect your account or request deletion.

Our use of Meta data strictly complies with the Meta Platform Terms, the Meta Developer Policies, and the WhatsApp Business Terms of Service.

We do not sell your personal information. We may share data with:

• Service providers: Hosting (Vercel), database (Neon), background jobs (Trigger.dev), and error monitoring (Sentry) — each bound by data processing agreements.
• Legal authorities: When required by law or to protect our rights.

Litchoo integrates with Google APIs so you can build optional workflow automations. This section describes how we access, use, store, and share Google user data — separate from Meta/WhatsApp data above.

APIs we use: Google Sheets API, Gmail API (gmail.send scope only), and Google OAuth (OpenID Connect) for account identification when you connect Google or sign in with Google.

How we use Google data: Only to provide user-facing features you configure — reading sheet tabs/headers for field mapping, appending rows to a spreadsheet you select, and sending notification emails you define in a workflow. API calls run only when your workflow executes or when you are actively configuring a node. We do not use Google data for advertising, data brokering, creditworthiness, or to train generalized AI/ML models.

Storage & sharing: Google OAuth refresh tokens are encrypted at rest per workspace credential. We do not sell or transfer Google user data to third parties except subprocessors that host our infrastructure (e.g. Vercel, Neon) under data processing agreements, and only as needed to operate the service. We do not allow humans to read Google user data except with your permission, for security/abuse investigation, to comply with law, or in aggregated internal operations as permitted by Google policy.

Revoking access: Disconnect Google under Credentials in Litchoo, or revoke Litchoo at Google Account permissions. Tokens are deleted when you disconnect.

Litchoo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We retain your account and workflow data for as long as your account is active. Lead and messaging data captured by workflows is retained until you delete it or close your account. Meta and Google access tokens are stored encrypted and deleted immediately when you disconnect the account.

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (see our Data Deletion page).
• Withdraw consent for Meta or Google data access by disconnecting your accounts.
• Export your workflow and execution data.

To exercise any of these rights, email us at litchoofficial@gmail.com.

We use industry-standard measures including encryption at rest, HTTPS in transit, and role-based access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

Litchoo is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date. Continued use of the service after changes constitutes acceptance.