Privacy notice: WhatsApp MCP and AI assistants

This notice explains what happens to your data when you connect TimelinesAI to an AI assistant, such as Claude, ChatGPT, Cursor, Gemini or Perplexity, through the TimelinesAI MCP server at https://mcp.services.timelines.ai/mcp.

It adds to our Privacy Policy, our Terms and our Data Processing Agreement. For anything not covered here, those documents apply.

Who is responsible

TimelinesAI LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States · contact@timelines.ai

Your company controls the WhatsApp data in your workspace. TimelinesAI processes it on your company's behalf under our Data Processing Agreement, only for the purposes your company sets, and never for our own purposes. When you connect an AI assistant, you are telling us to make that data available to the assistant you chose.

How the connection works

• You sign in with your TimelinesAI account (OAuth 2.0). The AI assistant never receives your TimelinesAI password, and we never receive your AI assistant password.
• Each person connects separately. Every team member whose role allows it connects with their own login. There is no shared workspace connection.
• The assistant acts as you. It can only see and do what your TimelinesAI role allows in the inbox. Owners and Admins can reach every chat in the workspace. Team members can reach their team's WhatsApp accounts. Agents can only reach the chats they already have access to. The assistant cannot raise its own permissions.
• Nothing is installed on your computer. The MCP server is hosted by TimelinesAI.
• Data moves only when you ask. The assistant requests data from TimelinesAI only when it uses a tool to answer your request.

What the assistant can access

Within your permissions, the assistant can read:

• Workspace details: your connected WhatsApp numbers, team members (names and email addresses) and usage quotas
• Chats and contacts: chat lists, contact names and phone numbers, labels, assignees and chat status
• Messages: message text, sender and recipient, time and delivery status. For attachments, it gets the file name and a signed link to the file that expires after 15 minutes.
• WhatsApp Business API templates

It can also act for you. It can send messages and replies, react to messages, start WhatsApp Business API chats with approved templates, open and close chats, assign chats and add or remove labels. Messages sent this way reach the real recipient, exactly as if you had sent them from the TimelinesAI inbox.

Where the data goes

• To the AI assistant you chose. The company behind that assistant receives the data and handles it under its own terms and privacy policy:

For any other MCP-compatible assistant, the company that provides it is responsible for the data it receives. TimelinesAI does not control how these providers store your conversations, so check your assistant's data settings.

• Nowhere else. We don't sell this data, and we don't use it for our own purposes, including training AI models.

What TimelinesAI keeps

• Your actions. Anything the assistant does is saved in your workspace like any other inbox action. Sent messages stay in the chat history (6 months on Business plans, 1 month on other plans, as set out in our Terms), and labels and assignments stay until someone changes them. When your subscription ends, we delete your data within 30 days.
• Usage records. For each tool call we record which tool was used, when, which AI assistant and model made the call, whether it succeeded, and a one-sentence description of your goal. The AI assistant writes that sentence and is told to leave out names, phone numbers and email addresses. These records never include the content of tool requests or responses, such as message text or contact details. We use them to understand usage and fix errors. They are stored with our analytics provider, PostHog, in the EU, and have no fixed deletion date.
• Server logs. Our MCP server logs technical details only (time, which tool, response status and duration), never message or contact content. They are deleted after 30 days.
• Error reports. When something fails, we record the error without request content or personal data. Error reports have no fixed deletion date.
• Sign-in sessions. Session data is kept for up to 1 hour. The access token the assistant uses is short-lived, and once you remove the connector it expires shortly after.

Where it is hosted

TimelinesAI, including the MCP server, runs on Amazon Web Services in Frankfurt, Germany (EU), in our own private cloud. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Your controls

• Disconnect at any time by removing the TimelinesAI connector in your AI assistant's settings. No further calls can be made once its token expires.
• Your data rights (access, correction, deletion) work as described in our Privacy Policy. Contact contact@timelines.ai.

Security

• Sign-in uses OAuth 2.0 with PKCE. All traffic uses HTTPS.
• Permissions are checked by TimelinesAI on every call, not by the AI assistant.

Who this is for

TimelinesAI and the MCP are business tools and are not intended for anyone under 18.

Contact

Questions about this notice: contact@timelines.ai