Privacy notice: TimelinesAI WhatsApp Business Platform connector

This notice explains what happens to your data when you connect TimelinesAI to an AI assistant, such as Meta Muse or Claude, through the TimelinesAI WhatsApp Business Platform connector at https://mcp.services.timelines.ai/mcp/waba. The connector works only with WhatsApp Business Platform (Cloud API) numbers.

It adds to our Privacy Policy, our Terms and our Data Processing Agreement. For anything not covered here, those documents apply.

Who is responsible

TimelinesAI LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States · contact@timelines.ai

Your company controls the WhatsApp data in your workspace. TimelinesAI processes it on your company's behalf under our Data Processing Agreement, only for the purposes your company sets, and never for our own purposes. When you connect an AI assistant, you are telling us to make that data available to the assistant you chose.

How the connection works

• You sign in with your TimelinesAI account (OAuth 2.0). The AI assistant never receives your TimelinesAI password, and we never receive your AI assistant password.
• Each person connects separately. Every team member whose role allows it connects with their own login. There is no shared workspace connection.
• The assistant acts as you. It can only see and do what your TimelinesAI role allows. Owners and Admins can reach every WhatsApp Business Platform number in the workspace and its chats. Team supervisors and teammates can reach their team's numbers. Agents can reach the numbers assigned to them, and collaborators only the chats assigned to them. The assistant cannot raise its own permissions.
• Nothing is installed on your computer. The connector is hosted by TimelinesAI.
• Data moves only when you ask. The assistant requests data from TimelinesAI only when it uses a tool to answer your request.

What the assistant can access

Within your permissions, the assistant can read:

• Workspace details: your WhatsApp Business Platform numbers and your team members (names and email addresses)
• Chats and contacts: chat lists, contact names and phone numbers, labels, assignees, chat status and whether the 24-hour customer service window is open
• Messages: message text, sender and recipient, time and delivery status, including the reason when a message fails. For attachments, it gets the file name and a signed link to the file that expires after 15 minutes.
• Message templates: your approved templates and their content

It can also act for you. It can reply with free text while the 24-hour window is open, send approved templates, start new chats with an approved template, react to messages, open and close chats, assign chats and add or remove labels. Messages sent this way reach the real recipient, exactly as if you had sent them from the TimelinesAI inbox.

Where the data goes

• To the AI assistant you chose. The company behind that assistant receives the data and handles it under its own terms and privacy policy:

For any other MCP-compatible assistant, the company that provides it is responsible for the data it receives. TimelinesAI does not control how these providers store your conversations, so check your assistant's data settings.

• Through Meta's WhatsApp Business Platform. Messages to and from your WhatsApp Business Platform numbers travel through Meta's WhatsApp Business Platform (Cloud API), the same way as every message you send from TimelinesAI.
• Nowhere else. We don't sell this data, and we don't use it for our own purposes, including training AI models.

What TimelinesAI keeps

• Your actions. Anything the assistant does is saved in your workspace like any other inbox action. Sent messages stay in the chat history (6 months on Business plans, 1 month on other plans, as set out in our Terms), and labels and assignments stay until someone changes them. When your subscription ends, we delete your data within 30 days.
• Usage records. For each tool call we record which tool was used, when, which AI assistant and model made the call, whether it succeeded, and a one-sentence description of your goal. The AI assistant writes that sentence and is told to leave out names, phone numbers and email addresses. These records never include the content of tool requests or responses, such as message text or contact details. We use them to understand usage and fix errors. They are stored with our analytics provider, PostHog, in the EU, and have no fixed deletion date.
• Server logs. Our MCP server logs technical details only (time, which tool, response status and duration), never message or contact content. They are deleted after 30 days.
• Error reports. When something fails, we record the error without request content or personal data. Error reports have no fixed deletion date.
• Sign-in sessions. Session data is kept for up to 1 hour. The access token the assistant uses is short-lived, and once you remove the connector it expires shortly after.

Where it is hosted

TimelinesAI, including the MCP server, runs on Amazon Web Services in Frankfurt, Germany (EU), in our own private cloud. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Requests from authorities

We disclose customer data only when legally required, notify the customer unless the law prohibits it, and challenge requests that are overbroad.

Your controls

• Disconnect at any time by removing the TimelinesAI connector in your AI assistant's settings. No further calls can be made once its token expires.
• Your data rights (access, correction, deletion) work as described in our Privacy Policy. Contact contact@timelines.ai.

Security

• Sign-in uses OAuth 2.0 with PKCE. All traffic uses HTTPS.
• Permissions are checked by TimelinesAI on every call, not by the AI assistant.

Who this is for

TimelinesAI and the connector are business tools and are not intended for anyone under 18.

Contact

Questions about this notice: contact@timelines.ai. Product support: support@timelines.ai.