Privacy Policy
Stimch lets a business put an AI agent on its own WhatsApp number. This page explains what data that involves, what we do with it, and what we never do with it. Questions about anything here go to[email protected] and a person answers.
What we collect
- Your account. Name, email address and a password hash — or, if you sign in with Google, your Google account email and basic profile.
- Your agent's instructions. The prompt you write, the sections Peachy helps you draft, and the settings on the agent.
- What the agent produces. Bookings, contact records and the summaries an admin asks for.
- Messages you send us. The contact form stores your name, email and message so a person can reply.
We do not ask for payment card numbers, and the agents are instructed never to ask your customers for card numbers, passwords or identity documents.
Google user data
Connecting a Google integration is always your choice, one integration at a time, and you can disconnect it at any moment. These are every Google permission Stimch can ask for and the only reasons it asks:
| Scope | What it allows | Why Stimch asks |
|---|---|---|
userinfo.email | Read the email address of the Google account. | To sign you in, and to show which account an integration is attached to. |
drive.file | Access only the files you pick with Google's own file picker, and files Stimch itself creates. It cannot list or open anything else in your Drive. | So an agent can log a row per enquiry into your spreadsheet, or read a price list you chose to share with it. |
calendar.events | List, create and delete events on the calendar you select. It does not read your other calendars and does not change calendar settings. | So the agent can see what time is genuinely free before it promises a slot, put the booking on your calendar, and remove it if the customer cancels. |
gmail.send | Send mail as you. It cannot read, search or delete your mail. | To email a confirmation on your behalf. This integration is not enabled yet; the permission is only requested if you turn it on. |
Stimch's use and transfer of information received from Google APIs to any other app will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.
In plain terms, and without exception:
- We do not sell Google user data, and we never will.
- We do not use it for advertising, profiling or any form of ad targeting.
- We do not use it to develop, improve or train generalised artificial intelligence or machine-learning models.
- No human at Stimch reads your Google data, except with your explicit permission (for example when you ask us to help with a problem), where required by law, or where it is necessary for security — such as investigating abuse.
Revoking access
Turn the integration off in Stimch, or revoke it directly atmyaccount.google.com/permissions. Revoking stops all further access immediately. We delete the stored tokens, and anything the agent already created in your Drive or calendar stays yours — it is in your account, not ours.
Who else processes your data
We use a small number of providers to run the product. They process data on our instructions and for no purpose of their own:
- OpenAI — message content and your agent's instructions are sent to generate a reply, transcribe a voice note or read an image. Under OpenAI's API terms this content is not used to train their models.
- Cloudflare — stores media received on WhatsApp (images, voice notes, documents) and routes our email.
- Google — for the integrations you connect, as described above, and for Google Analytics, described in the next section.
- Our hosting provider — runs the servers and the database.
We do not sell your data or your customers' data to anyone, for any purpose.
Analytics
We use Google Analytics on this site and inside the dashboard to see which pages people open, where they arrive from, and where they get stuck. It sets a cookie in your browser so a visit that starts here and continues in the app is counted once rather than twice.
What we deliberately do not send it:
- Nothing your customers wrote, and nothing your agent said. No message content, no phone numbers, no contact names.
- Not your email or your name. Pages inside the dashboard are reported with an account number, which means nothing outside our database.
- Not the address bar as-is. Sign-in links and invitations carry a token in the URL, and the description you type on the home page is carried the same way. Every address is stripped down to the page and the campaign tags before it is reported.
Advertising features are turned off, so this data is not used to build advertising audiences or to personalise ads — ours or anybody's. If you would rather not be counted at all, any browser extension that blocks analytics will do it, and nothing in Stimch works differently when it is blocked.
Stimch connects to WhatsApp by linking a device to the number you already own, the same mechanism as WhatsApp Web. We are not affiliated with WhatsApp or Meta, and your use of WhatsApp remains subject to their terms. Because the agent answers on your number, the messages it sends are sent as you.
Security
Traffic is encrypted in transit. Passwords are stored hashed, never in plain text. OAuth tokens are stored server-side and never exposed to the browser. Access to production is limited to the people who need it. No system is perfect, and if something happens that affects your data we will tell you rather than wait to be asked.
Your rights
Write to [email protected] to get a copy of your data, correct it, or have it deleted. We answer within 30 days. You do not need to give a reason.
Children
Stimch is a tool for businesses and is not intended for anyone under 16. We do not knowingly collect data from children.
Changes
If this policy changes we update the date at the top of this page. If a change materially affects how we handle your data, we will tell account holders by email rather than leave it to be discovered.
Who we are
Stimch is operated by Rebord LLC, which is the company responsible for the data described on this page. Write to us at the address below about anything on it.
Contact
[email protected] — for privacy questions, data requests and anything else on this page.