Privacy Policy
Last updated: September 13, 2026
This policy explains what personal information ventas.ai handles, why, and on whose behalf. It covers our website, our customer portal, and the AI sales agents we operate for our business customers on WhatsApp.
We use two words precisely throughout. A “customer” is a business that uses ventas.ai to serve its own customers. An “end customer” is a person who messages that business on WhatsApp. Our responsibilities differ for each, and section 2 sets out how.
Who we are
ventas.ai provides AI sales agents that operate inside a business's own WhatsApp Business account. We are the operator of that software and the contact point for questions about this policy.
- Entity
- [LEGAL ENTITY NAME] (ABN [ABN]), trading as ventas.ai.
- Registered address
- [REGISTERED ADDRESS], Australia.
- Privacy contact
- privacy@ventas.ai
We have not appointed a data protection officer. We do not consider one to be required for our scale and activities, and we will appoint one if that changes. We have no establishment in the European Union or the United Kingdom and do not currently offer the service to businesses there.
Our two roles
Which obligations apply to us depends on whose information is involved. There are two distinct cases and we do not blur them.
- We are the controller
- for information about our customers and the people who administer their account — the account holder's name and email, sign-in and security records, the business profile they give us, billing details, and support correspondence. We decide how that information is used, within this policy.
- We are a processor
- for the WhatsApp conversations between a customer and their end customers, and for the business content a customer uploads for their agent to use. The customer decides what those conversations are for; we handle them on that customer's instructions and under our agreement with them. The customer owns the WhatsApp Business account the messages are sent from and is the sender of those messages.
If you are an end customer and you want your information corrected or deleted, the business you were messaging is the right place to ask, because they decide what happens to it. Ask us and we will help them action it, but we cannot act on our own initiative over their data.
The precise controller and processor characterisation under each applicable law, and the data processing terms that sit behind it, require confirmation by counsel.
What information we handle
As controller, for our customers and their administrators:
- Account and identity: name, work email, and the sign-in method used, including records of sign-in attempts and security events.
- Business profile: the business name, description, industry, operating hours, contact details, and the countries and languages the business operates in.
- Commercial: subscription, usage volumes, invoices, and payment status. We do not store full card numbers.
- Support: messages you send us and our replies.
As processor, on our customers' instructions:
- Conversation content: the messages exchanged between an end customer and the business's agent on WhatsApp, including text and transcriptions of voice notes.
- End-customer identifiers: the WhatsApp phone number a message came from, and any name WhatsApp supplies with it.
- Conversation memory: a short-term record of the current conversation and a longer-term summary, so the agent does not ask the same question twice.
- Business knowledge: the documents, product information, and policies a customer uploads for their agent to draw on.
We do not ask end customers for payment details, government identifiers, or health information, and agents are not designed to collect them. If an end customer sends such information anyway it is held as ordinary conversation content, and we ask customers to configure their agents not to invite it.
Why we use it
- To provide the service: routing messages to the right agent, generating replies, keeping conversation context, and reporting results to the customer.
- To operate reliably and securely: monitoring, error diagnosis, abuse prevention, and audit records of administrative actions.
- To bill and to support: invoicing, and answering the questions customers ask us.
- To comply with law and with the WhatsApp and Twilio terms we and our customers are bound by.
We do not sell personal information. We do not use conversation content for advertising, and we do not use one customer's data to serve another customer.
Where a law requires us to identify a basis for handling your information, we rely on:
- Performance of our contract
- for providing the service, operating a customer's agents, billing, and support. We cannot provide the service without this.
- Our legitimate interests
- for security, abuse prevention, error diagnosis, and improving the service — interests we have weighed against the effect on the people concerned, and which do not extend to advertising or to profiling end customers.
- Compliance with law
- for tax and accounting records, for responding to lawful requests, and for meeting the WhatsApp and provider obligations we and our customers are bound by.
- Consent
- only for optional marketing communications to our own customers, which you can withdraw at any time without affecting the service.
For end-customer conversations we act on our customer's instructions, so the basis for handling that information is the customer's to establish, not ours. Our terms require them to have one.
How AI processing works
Agent replies are generated by large language models we access through Amazon Web Services in the region where the service runs. Conversation content and the customer's own business content are sent to the model in order to produce a reply.
- Content sent to a model is not used to train that model.
- An agent can only retrieve business content belonging to the customer it serves. Every retrieval is filtered and then re-checked against that customer before a result is used.
- Automated safety checks run on both what an end customer sends and what a model produces, to block harmful content and attempts to manipulate the agent.
- An agent can decide a conversation needs a person and hand it to the customer's team. Nothing about that handover changes who controls the data.
Agents are not used to make decisions that have a legal or similarly significant effect on an end customer. They answer questions and help with sales.
Who else is involved
The service cannot work without these providers. Each handles only what its function requires.
- Amazon Web Services
- hosting, storage, encryption key management, and the AI models that generate agent replies.
- Twilio
- carries WhatsApp messages between the end customer and the platform, and supplies phone numbers where the customer buys one through us.
- Meta
- operates WhatsApp itself. Our customers hold their own WhatsApp Business account with Meta and accept Meta's terms directly, so Meta's handling of WhatsApp messages is governed by Meta's own terms and privacy policy with that customer.
We may also disclose information where the law requires it, and to professional advisers or an acquirer in connection with a corporate transaction, subject to equivalent protection.
Where information is held
The service runs in Amazon Web Services in the United States by default. Customers in Australia, Chile, Colombia and elsewhere are served from there unless we have agreed a specific region with them, which we do for customers who need their data to stay in a particular country.
This means information is transferred out of the country where the business and its end customers are located. How we make that lawful depends on the country:
- Australia
- We remain accountable for information we disclose overseas under Australian Privacy Principle 8 of the Privacy Act 1988 (Cth), and we take reasonable steps to ensure our providers handle it consistently with the Australian Privacy Principles.
- Colombia
- Ley 1581 de 2012 restricts transfers to countries the Superintendencia de Industria y Comercio does not recognise as providing adequate protection. Where that applies we rely on the customer's authorisation for the transfer, given when they sign up, and on contractual protections with our providers.
- Chile
- Handling is currently governed by Ley 19.628. Ley 21.719 replaces it and takes full effect on 1 December 2026, creating the Agencia de Protección de Datos Personales and introducing specific transfer mechanisms. We will update this policy and our arrangements before that date.
In every case we contract with our providers on terms requiring them to protect the information, to use it only to provide their service to us, and not to disclose it except as those terms permit.
How long we keep it
- Conversation content and conversation memory are kept while the customer's account is active, so their agent has context and their team can review conversations.
- Business content uploaded by a customer is kept until the customer removes it or closes their account.
- Account, billing, and audit records are kept for as long as we need them to run the business and to meet our legal obligations.
- Diagnostic logs are kept for a short, fixed period and do not contain message content.
When a customer closes their account we delete their data and their agents' data. The customer keeps their WhatsApp Business account and their phone number, because those are theirs and not ours.
The periods we work to:
- Conversations and conversation memory
- for the life of the account, then deleted within 30 days of closure. A customer can delete an individual conversation sooner.
- Business content a customer uploads
- until they remove it, or within 30 days of account closure.
- Account and audit records
- for 7 years after closure, which is the period Australian tax and corporations law requires us to keep business records for.
- Diagnostic logs
- 30 days. They do not contain message content.
- Verification codes
- minutes, not days — they expire automatically and are then unreadable.
How we protect it
- Data is encrypted in transit and at rest. Each customer's data is encrypted with a key dedicated to that customer.
- Separation between customers is enforced at more than one layer, and a result that cannot be confirmed as belonging to the requesting customer is discarded rather than returned.
- Access to production systems is restricted, authenticated, and logged.
- Credentials and access tokens are held in a managed secret store and are never written to logs.
No system is perfectly secure. If a breach affects your information we will notify you and the relevant authority as required by law.
Your rights
Depending on where you live, you may be able to ask for a copy of your information, correct it, delete it, restrict or object to its use, take it elsewhere, or complain to a regulator.
If you are a customer or an administrator of a customer account, contact us and we will action it. If you are an end customer, contact the business you were messaging, for the reason given in section 2.
We respond within 30 days. We do not charge for a request, and we will not treat you differently for making one. If we cannot do what you ask we will tell you why.
If you are not satisfied with our response you can complain to your regulator:
- Australia
- Office of the Australian Information Commissioner (oaic.gov.au).
- Colombia
- Superintendencia de Industria y Comercio, through its Delegatura para la Protección de Datos Personales (sic.gov.co).
- Chile
- The Agencia de Protección de Datos Personales, once it begins operating on 1 December 2026 under Ley 21.719.
Children
The service is for businesses. It is not directed at children and we do not knowingly handle their information. WhatsApp sets its own minimum age for its users.
Changes to this policy
We will update this policy as the service changes. The date at the top shows when it last changed. Where a change materially affects our customers we will tell them before it takes effect.
Contact us
For any question about this policy, or to make a request under section 10, email privacy@ventas.ai. Please tell us which business you are asking about, so we can find the right records.
If your question is about a conversation you had with a business on WhatsApp, contact that business first — they decide what happens to that information, for the reason given in section 2.
Language
This policy is published in English and Spanish. If the two versions differ, the English version applies.