Privacy Policy

Agent Kesh sits between a shop and the shop's customers, so it handles data about two groups. Your rights differ depending on which one you are.

• To run the agent — read an incoming message, find the right products, and generate a reply in the customer’s language.
• To show the shop owner their inbox, orders and usage.
• To meter conversations against the plan cap and bill the subscription.
• To keep the service working and secure — monitoring, error alerts, fraud and abuse prevention.
• To support you when you ask for help.
• To meet legal and tax obligations in Sri Lanka.

We do not sell your data, and we do not use it for advertising. We do not use the content of customer conversations to train AI models, and the AI providers we use are on API terms that do not permit training on the content we send them.

Agent Kesh is built on third-party infrastructure. These are our sub-processors — each receives only what it needs to do its job.

We may also disclose data where the law requires it, or to protect our rights, users or the safety of others. If Kesh Business Hub is ever sold or reorganised, data may transfer with the business — you will be told before that happens.

When a shop connects its WhatsApp number, we receive access to that WhatsApp Business Account through Meta's official platform. We commit that:

• We access WhatsApp data only to provide Agent Kesh to the shop that authorised it.
• We never sell, rent or share WhatsApp data with data brokers, advertisers or anyone building profiles of people.
• We never use WhatsApp data for advertising or for training AI models.
• One shop can never see another shop’s conversations — every record is locked to its own workspace at the database level.
• We follow Meta’s Platform Terms and the WhatsApp Business Messaging Policy, and we delete WhatsApp data when the shop disconnects or asks us to.

Messages sent over WhatsApp are also governed by WhatsApp's own privacy policy.

Replies are generated by an AI assistant, not a person. Every shop's agent carries an AI disclosure and will say it is an AI when asked. A customer can ask for a human at any time and the shop owner can take over the conversation.

The agent answers only from the shop's own catalog and uploaded knowledge. It is not permitted to invent products, prices or promises — but it is software, and a shop should check anything that matters before acting on it.

• Every row of shop data is tagged to its workspace and protected by database-level row-level security, so a query can never reach another shop’s data.
• Store and WhatsApp credentials are encrypted at rest.
• Traffic is encrypted in transit over HTTPS.
• Staff access to the admin panel is role-based, and every action taken on a shop’s account is written to an audit log.
• No system is perfectly secure. If a breach affects your data, we will tell you promptly.

Our database, servers and AI providers are located outside Sri Lanka, principally in the European Union and the United States. By using Agent Kesh you agree to your data being processed in those locations. We can confirm the exact regions on request.

You can ask us to:

• Show you a copy of the data we hold about you.
• Correct anything that is wrong.
• Delete your data — see the data deletion page.
• Export your conversations and orders.
• Stop processing your data, which for a shop owner means closing the account.

Email [email protected] and we will respond within 30 days. If you are a customer of a shop rather than a shop owner, we will pass your request to that shop, because the data is theirs.

Agent Kesh is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

We will update this page when the service changes and move the “last updated” date. If a change materially affects how we handle your data, we will email account holders before it takes effect.