Privacy Policy
This policy explains what information Pocket Buddy ("Buddy") collects, why, how it's protected, and the choices you have. Buddy is provided by BotNMe Private Limited ("we", "us"), a company registered in Singapore. We've tried to write it in plain language. If anything is unclear, email us at hello@getpocketbuddy.app.
The short version
- Buddy only connects to the accounts you choose to connect, and you can disconnect any of them at any time.
- Buddy never sends an email for you. It only creates drafts in your Gmail, which you review and send yourself.
- Calendar and Google Drive access are read-only.
- We don't sell your data, we don't use it for advertising, and we don't use it to train AI models.
1. Who we are
Buddy is an AI assistant that works through WhatsApp. It helps business owners reply to messages, triage their email, stay on top of their calendar, and answer customer questions using their own reference documents. Each customer connects their own accounts: their own Anthropic (Claude) API key, their own WhatsApp Business number, and, if they choose, their own Gmail, Google Calendar and Google Drive.
BotNMe Private Limited is responsible for your personal data under Singapore's Personal Data Protection Act 2012 (PDPA).
2. Information we collect
Account and billing information
Your name, email address, WhatsApp phone number, business details you give Buddy (for example your business description and how you'd like to be addressed), and your subscription status. Payments are processed by Stripe. We receive confirmation of payment and your Stripe customer ID, but we never see or store your full card number.
WhatsApp messages
Messages sent to your Buddy WhatsApp number, and the replies Buddy drafts or sends. We keep a short recent history so Buddy can follow a conversation (for example, "put that in point form"). Voice notes you send are converted to text so Buddy can understand them.
Keys and connection tokens
Your Anthropic API key, your optional Google Cloud text-to-speech key, and the access tokens Google issues when you connect Gmail, Calendar or Drive. These are always stored encrypted (see section 7) and are never shown back to you or anyone else.
Usage and technical information
Basic logs needed to run and secure the service: sign-in times, errors, and which features were used. We don't use advertising trackers.
AI processing
To draft replies, Buddy sends the relevant content (for example the message you received, your business details, and a short snippet from your reference documents) to Anthropic's Claude API using your own API key. That processing happens under your own Anthropic account and is subject to Anthropic's terms and privacy policy.
3. Data from Google accounts
Connecting Google accounts is optional. Each one is a separate permission you grant on Google's own screen. You can connect any of them without the others, and disconnect them separately.
| Service | What Buddy can access | Why |
|---|---|---|
| Gmail gmail.readonly, gmail.compose |
Reads the messages in your inbox, and creates draft replies in your Gmail Drafts folder. | To tell you which emails need attention and to prepare suggested replies. Buddy never sends an email. Google describes the compose permission as including sending, but Buddy only ever creates drafts. You review, edit and send them yourself from Gmail. |
| Google Calendar calendar.readonly |
Reads your calendar events: titles, times, attendees, locations and descriptions. Read-only. Buddy cannot create, change or delete events. | To remind you of upcoming events and help you prepare for meetings. |
| Google Drive drive.readonly |
Read-only. Buddy reads the documents in the one "Reference Folder" you choose, such as price lists, FAQs and policies. | So Buddy can quote your real prices and policies when drafting replies, instead of guessing. Google's permission screen describes access to your whole Drive, because that's how Google's read-only Drive permission works. Buddy itself only ever reads the single folder you pick. It cannot edit, delete or share your files. |
Content from these services is used only to show it to you or to prepare drafts for you. Where a draft needs AI, the relevant email text or document snippet is sent to Anthropic's Claude API using your own API key, as described in section 2. We store your Google access tokens (encrypted) and the Reference Folder you chose. We don't keep copies of your emails, calendar events or Drive files beyond what's needed to prepare a draft or show you a summary.
4. Google API Services User Data Policy (Limited Use)
Buddy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, for data we receive from Gmail, Google Calendar and Google Drive:
- We only use it to provide and improve the features you can see and use in Buddy, as described in section 3.
- We only transfer it to others when that's necessary to provide those features (for example, sending an email's text to the Claude API under your own Anthropic account to draft a reply), to comply with the law, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use it for advertising, including personalised, retargeted or interest-based ads.
- We do not sell it, and we don't transfer it to data brokers or information resellers.
- We do not use it to determine creditworthiness or for lending purposes.
- We do not use it to develop, improve or train generalised AI or machine-learning models.
- No person at BotNMe reads it, unless you give us permission for specific messages (for example when you ask for support), it's necessary for security (such as investigating abuse), it's required by law, or it's aggregated and anonymised for internal operations.
5. How we use information
- To provide Buddy: drafting replies, triaging email, calendar reminders, and answering from your reference documents.
- To keep your account secure: sign-in, fraud and abuse prevention, and the safety controls you can use (pause, freeze, disconnect).
- To bill you and manage your subscription.
- To contact you about your account, service changes, and support requests.
- To fix problems and improve Buddy's reliability.
Buddy is designed to confirm first. Emails are only ever drafted, never sent. On WhatsApp, simple messages (such as a greeting) may get an automatic reply, depending on your settings. Anything sensitive waits for your approval.
6. Who we share it with
We don't sell personal data. We share it only with the service providers we need to run Buddy, and only for that purpose:
| Provider | What for |
|---|---|
| Anthropic (Claude API) | AI drafting, under your own API key and Anthropic account |
| Meta (WhatsApp Business Platform) | Receiving and sending WhatsApp messages |
| Gmail, Calendar and Drive, if you connect them; text-to-speech voice replies under your own Google Cloud key, if you set that up | |
| OpenAI (Whisper API) | Converting WhatsApp voice notes to text |
| Stripe | Payments and subscriptions |
| Vercel | Hosting the Buddy application |
| Neon | Database hosting |
| Resend | Account emails, such as sign-in links and onboarding |
We may also disclose information if the law requires it, to protect people's safety or our legal rights, or as part of a merger or sale of the business (with notice to you).
7. How we store and protect it
- API keys and Google access tokens are encrypted at rest with AES-256-GCM, and they're never displayed after you enter them.
- All connections to Buddy use HTTPS. Our database connection is encrypted.
- Sign-in uses one-time magic links and secure session cookies. Sensitive account actions need your Recovery PIN.
- You can pause Buddy, freeze your account in an emergency, or disconnect every integration at once from your account page.
- Access to production systems is limited to the people who need it to run the service.
Our providers may store data outside Singapore (for example, our database and hosting run in the United States). Where that happens, we take reasonable steps to make sure your data gets protection comparable to the PDPA.
No system is perfectly secure. If a data breach affects you, we'll notify you and the Personal Data Protection Commission as the PDPA requires.
8. How long we keep it
- WhatsApp conversation history: Buddy only uses recent history to follow a conversation. Message records are kept while your account is active so we can operate and support the service.
- Google tokens and API keys: kept until you disconnect the integration or close your account, then deleted (and Google tokens revoked).
- Account and billing records: kept while your account is active, and afterwards for as long as the law requires (for example, tax records).
- When you close your account, we delete or anonymise your personal data within 30 days, except where we must keep it by law.
9. Disconnecting and deleting your data
Disconnect an integration
- From your Buddy account page, use Disconnect integrations. This deletes your stored API keys and Google tokens and revokes Buddy's access with Google.
- You can also remove Buddy's Google access at any time from your Google Account at myaccount.google.com/permissions. Buddy will then stop accessing that service, and will ask you to reconnect if you want to use it again.
Delete your data
Email hello@getpocketbuddy.app from the email address on your account and ask us to delete your data. We'll confirm the request and complete it within 30 days, except for records we must keep by law.
10. Your rights
Under the PDPA you can ask to access the personal data we hold about you, ask us to correct it, and withdraw consent for us to use it. Withdrawing consent may mean we can no longer provide some or all of Buddy. To make a request, email hello@getpocketbuddy.app. We may need to verify your identity first.
11. Your customers' and contacts' data
When your customers message your WhatsApp number, or emails from your contacts pass through Buddy, we process their data on your behalf and for your purposes. For that data, we act as a "data intermediary" under the PDPA, and you are responsible for having the consents or legal basis needed to use Buddy with it. We protect it in the same way as your own data, and delete or return it when your account ends.
12. Children, transfers and changes
- Buddy is a business tool and isn't meant for anyone under 18.
- If we change this policy, we'll update the date at the top. For material changes, we'll tell you by email or in Buddy before they take effect.
13. Contact us
For privacy questions, requests, or complaints, contact our Data Protection Officer:
BotNMe Private Limited (UEN 202644668Z), Singapore
Email: hello@getpocketbuddy.app
If you're not satisfied with our response, you can contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.