Privacy Policy
Last updated 11 October 2026
Hariken is an AI sales assistant for businesses. It connects to a business’s Facebook Page, Instagram professional account and WhatsApp Business account, reads the messages customers send them, and helps answer those messages and create orders.
This policy explains what we collect, why, who we share it with, and how to have it removed. It covers two different groups of people: the businesses who use Hariken, and the customers who message those businesses.
Who is responsible for your data
MyMentor, Dhaka, Bangladesh, operates Hariken. You can reach us at privacy@mymentor.bd.
When a business uses Hariken to talk to its customers, that business decides what is said and why, and we process those messages on their behalf. If you are a customer of one of those businesses and want your data removed, you can contact either them or us — see Delete my data.
What we collect
If you are a business using Hariken
| What | Why |
|---|---|
| Name, email and password | To create your account and sign you in |
| Workspace name, currency, timezone | To run your workspace correctly |
| Facebook Page, Instagram account and WhatsApp number you connect | To receive and send messages on your behalf |
| Access tokens issued by Meta | To call Meta's APIs as you. Encrypted at rest and never shown in the interface |
| Your product catalog — names, prices, images, stock | So the assistant can answer questions about what you sell |
| Information you give the assistant — notes, files you upload (price lists, brochures, policies), web pages you point it to, and your Facebook Page's public details if you import them | So the assistant can answer your customers' questions from it |
| Your Shopify store, if you connect it — products, prices, stock, locations, and the store's name, email, currency and timezone | To import your catalog, keep it up to date, and prefill your account when you install from Shopify |
| Usage and billing records | To operate your plan and invoice you |
If you are a customer messaging a business
| What | Why |
|---|---|
| Your messages — text, photos, voice notes, location, attachments | To show them to the business and generate a reply |
| Your name and profile picture as Meta provides them | So the business can recognise who they are talking to |
| Your Facebook, Instagram or WhatsApp identifier | To keep your conversation together across messages |
| Phone number and delivery address, if you provide them | Only to fulfil an order you asked for |
| Booking details, if you book a service — your name, phone, when you'd like it, and your answers to the business's questions | Only so the business can arrange the booking you asked for |
| Order history with that business | To answer questions about your orders |
We never collect your Facebook password, your friends list, your posts, or anything outside the conversation you have with the business.
Photos you send
A central feature of Hariken is identifying a product from a photo or screenshot a customer sends. To do this we create a mathematical representation of the image — a numeric vector — and compare it with the business’s own product photos. We also read any visible text in the image to look for a product code.
- Images are compared only against the catalog of the business you messaged.
- They are never compared against, or made visible to, any other business using Hariken.
- We do not perform facial recognition and do not attempt to identify people in photos.
- We do not use your photos to train general-purpose AI models.
Artificial intelligence
Replies may be drafted by an AI model. To produce a reply, the conversation, the relevant products and the business’s own policies are sent to our AI provider. We choose providers who are contractually barred from using this content to train their models.
A person at the business can take over a conversation at any moment, and the AI stops immediately when they do.
Who we share data with
| Who | What they receive | Why |
|---|---|---|
| Meta Platforms | Messages sent to and from Facebook, Instagram and WhatsApp | They operate the messaging channels themselves |
| Our AI provider | Conversation text and images needing a reply, and files a business uploads for the assistant to read | To generate a response and to read documents. Not used for model training |
| Our hosting and database providers | Data at rest and in transit | To run the service |
| The business you messaged | Your conversation and any order details | They are who you are talking to |
| Shopify, if the business connects its store | Orders you place in the chat: items, your name, phone and delivery address | So the business can fulfil the order from its Shopify store, when it chooses to |
We do not sell personal data. We do not share it for advertising. We do not give one business access to another business’s conversations, customers or catalog.
Where data is held
Data is stored on servers operated by our infrastructure providers and may be processed outside Bangladesh, including in the European Union and the United States. Where data crosses borders we rely on our providers’ standard contractual protections.
How long we keep it
| What | Kept for |
|---|---|
| Conversations and messages | 24 months after the last message, then deleted |
| Photos and attachments from customers | 90 days, then deleted. The numeric representation used for product matching is kept while the catalog entry exists |
| Orders | 7 years, because businesses are legally required to keep sales records. Identifying details are removed on request |
| Booking requests | 24 months, then deleted, or straight away on request |
| Files, web pages and notes a business gives the assistant | Until the business deletes them or closes their account. Deleting a file removes it from our servers straight away |
| Account records | Until the business closes their account, then 30 days |
| Access tokens | Deleted immediately when a channel or store is disconnected |
| Messages and events as received from Meta and Shopify | 30 days, then deleted |
| Products copied from a Shopify store | Deleted 48 hours after the business uninstalls the app |
| Audit logs, including who viewed customer details | 24 months |
How we protect it
- Access tokens are encrypted with AES-256-GCM before being stored.
- Backups are encrypted with AES-256 before they are written.
- All traffic is encrypted in transit over HTTPS.
- Every incoming webhook from Meta is cryptographically verified before it is accepted, so messages cannot be forged.
- Every record is tied to one workspace and every query is scoped to it, so one business’s data cannot be reached from another’s account.
- Access to production data is limited to staff who need it, and is logged.
- Within a business, opening, printing or exporting customer details is recorded in that business’s audit log. Only owners and admins can connect stores or change settings.
- If a breach affects your data, we tell the businesses concerned within 72 hours of finding it.
Your rights
You can ask us to:
- See what data we hold about you
- Correct anything inaccurate
- Delete your data — see Delete my data
- Export your data in a portable format
- Object to a particular use of your data
Email privacy@mymentor.bd and we will respond within 30 days. If you are a customer of a business using Hariken, we may need to pass your request to them, because the conversation is theirs.
Children
Hariken is for businesses and is not directed at children. We do not knowingly collect data from anyone under 13. If you believe a child’s data has reached us, contact us and we will remove it.
Changes
If we change this policy in a way that materially affects you, we will tell you by email before it takes effect. The date at the top always reflects the current version.
Contact
MyMentor
Dhaka, Bangladesh
privacy@mymentor.bd
This policy is published at https://agent.mymentor.bd/privacy.