You are handing us your order book. This page says exactly what happens to it, in words we are willing to be held to.
The short version
We never message your customers. Not automatically, not ever. The system writes reminders; you read them and send them yourself from your own number.
Your rates, amounts and party names are never shared with anyone: not other customers, not advertisers, not data brokers. We do not sell data. There is no version of this business where we do.
Your data is not used to train anyone's AI. Not ours, not Google's.
Everything is stored in India, in Google Cloud's Mumbai region.
Ask and we delete it. All of it, within seven days.
What we collect, and why
Only what is needed to keep your books. Specifically:
WhatsApp chat exports you upload. The full transcript, and any photos or voice notes inside a zip. This is the raw material; orders, payments and rates are read out of it.
Documents and photos you add: bills, challans, purchase orders, Tally or Excel exports. Read for the figures on them.
What is extracted from those: party names and phone numbers, qualities, quantities, rates, amounts, payment dates, dispatch details, outstandings. This is the product.
Your own details: business name, your name, phone number, email, city. Used to sign you in and to send your daily summary.
A record of every decision the system makes: which agent read what, how confident it was, how long it took, what it cost. This is how you can always check why a record says what it says.
We do not ask for and cannot accept card or bank details. Payment is taken in person.
Where it is stored
All of it in Google Cloud's Mumbai region (asia-south1). The database, the photos and documents, and the decision logs. It does not leave India at rest.
The database is not reachable from the public internet. Photos and documents sit in private storage with no public links. Your access token is stored only as a one-way hash, which is why we cannot look it up for you if it is lost; we can only issue a new one.
Who can see it
You, through the app, using your own token.
Us, the two people who run Longbook, when we are setting you up, or when you write in with a problem and we need to look at the record you are asking about. We look because you asked us to, not routinely.
Nobody else. Other customers cannot see your data; every record is locked to your business at the database level, not by convention.
If a court or the law obliges us to hand something over, we will tell you unless we are legally barred from doing so.
The AI part, honestly
Reading your messages is done by Google's Gemini, through the paid Gemini API. Your messages are sent to Google to be read, and this is the one place your data is processed by a company other than us. So it matters what their terms say:
On the paid tier, which is what we use, Google does not use what we send to improve or train their models, and does not make it available to anyone else.
The free tier is different: inputs there can be used for improving Google's products. We do not use the free tier, and we will not move to it.
Google retains prompts briefly for abuse monitoring and then deletes them, per their API terms.
We do not train any model of our own on your data. Not on your rates, not on your party relationships, not in aggregate with other customers' data.
If Google changes those terms in a way that matters, we will tell you before it takes effect, not after.
What we never do
Message your customers. The system has no ability to send anything to anyone you trade with. Reminders are drafts you send yourself. This is built into how it works, not a policy we could quietly change.
Sell, rent or share your commercial terms. What you charge, who owes you, and who you buy from stays yours.
Use your data to help a competitor of yours. We do not build benchmarks, market rates or industry reports out of customer data.
Advertise to you, or let anyone else advertise to you.
Keeping and deleting
We keep your data for as long as you are a customer, and for 90 days after that, because people come back, and re-reading six years of chats is not something you should have to do twice. After 90 days it is deleted.
If your subscription lapses, nothing is deleted. You are locked out of the screens; the records stay exactly as they were and come back the moment you renew.
To have it deleted sooner, just ask. Ring longbook.co@gmail.com or email longbook.co@gmail.com and say you want your data removed. We will do it within seven days and confirm when it is done. That removes everything: messages, documents, extracted records, party details and logs. It cannot be undone.
You can also ask for a copy of everything we hold, in a spreadsheet, at any time.
If something goes wrong
If your data is exposed by a mistake or a breach on our side, we will tell you within 72 hours of finding out: what happened, what was affected, and what we are doing. We would rather tell you an embarrassing truth than have you find out later.
Changes, and who to ask
If we change anything on this page that affects what happens to your data, we will tell you by email before it takes effect. We will not make a material change quietly.