Privacy Policy

Privacy Policy - 1ma.ai

Last Updated: March 5, 2026

ООО «1ма» (hereinafter "1ma.ai", "we", "our", "us") Address: 220117, Minsk, Lyubimova Ave. 39, office 1Н, Republic of Belarus Taxpayer ID (UNP): 193954730 Email: hello@1ma.ai

1ma.ai acts as the Data Controller for data of its registered users, and as a Data Processor for data processed on behalf of its business clients (see Section 5 below).

By using our services, you agree to this Privacy Policy.

1. Information We Collect

When you interact with our platform, we may collect the following types of information:

a. Personal Information you provide directly:

• Name and email address
• Social media account identifiers (e.g., Instagram username, page ID)
• Any messages, inquiries, or feedback you send to us
• Payment and billing information (processed by third-party payment providers)

b. Automatically collected information:

• Log data: IP address, browser type, device type, operating system
• Usage data: pages visited, time spent, referring URLs
• Technical identifiers: cookies, session tokens, analytics identifiers

c. Information from integrations:

• When you connect your Instagram Business Account or Facebook Page, we collect account-related data (account IDs, permissions, profile information) and conversation content necessary to operate the service.
• Media content (images, videos) shared in conversations may be stored and processed for service delivery, including text recognition and content analysis by our AI processing providers.

d. Product data:

• Product catalog information you import (names, descriptions, prices, images, metadata) from external data feeds.

We do not intentionally collect sensitive categories of data (e.g., health, financial, biometric information) unless explicitly provided by you.

2. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal grounds:

You may withdraw your consent at any time by contacting us at hello@1ma.ai. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

3. How We Use Your Information

We use the collected information to:

• Provide and improve our AI-powered messaging and customer support services
• Enable Instagram and Facebook message automation and responses
• Process and analyze conversation content using AI technologies to generate automated replies
• Perform text recognition on media content shared in conversations
• Generate and store vector representations of product data for semantic search functionality
• Ensure compliance with Meta Platform policies
• Provide customer support
• Monitor performance, prevent fraud, and enhance security
• Communicate updates, features, or important service notices

We do not sell your personal data.

4. Cookies & Tracking Technologies

We use cookies and similar technologies for the purposes described in our Cookie Policy. In summary, we use cookies to:

• Authenticate sessions and maintain security
• Remember your preferences (language, theme)
• Measure service performance
• Provide analytics (e.g., traffic, usage trends)

You may disable cookies in your browser settings, but some features may not function properly. For detailed information, please see our Cookie Policy.

5. Processing of End-User Data (Instagram Conversations)

When our clients use 1ma.ai, we process messages from individuals who communicate with our clients' Instagram Business Accounts ("End-Users"). This includes:

• Message text content
• Media attachments (images, videos)
• Instagram user identifiers and profile information (username, profile picture)
• Message metadata (timestamps, message type)

Important:

• For End-User data, our client (the business) is the Data Controller, and 1ma.ai is the Data Processor, acting solely on the client's instructions.
• Our processing of End-User data is governed by our Data Processing Agreement with each client.
• End-User message content is processed by our AI service providers to generate automated responses.
• Our clients are responsible for informing their End-Users about the use of AI-powered automated messaging and for ensuring the lawfulness of data collection in their jurisdiction.

6. Sharing of Information

We may share your information with:

• Sub-processors — third-party service providers (cloud infrastructure, AI processing, authentication, message queuing, hosting, storage) who process data on our behalf under binding data processing agreements. See our Sub-Processors List for the current list of providers.
• Meta Platforms (Instagram/Facebook) — to enable messaging features as required by the platform integration.
• Aggregated or anonymized data — for analytics or reporting purposes, in a form that cannot identify individuals.
• Business transfers — if we merge, acquire, or sell assets, user data may be included in the transfer. We will notify you of any such change.
• Legal requirements — if required by law, regulation, legal process, or governmental request.

We do not share your personal login credentials or store third-party passwords.

7. Sub-Processors

We engage third-party sub-processors to assist in providing our services. These sub-processors are bound by data processing agreements and are authorized to process data only as necessary to perform their services.

A current list of our sub-processors, their categories, purposes, and data processing locations is maintained at our Sub-Processors List page.

We will notify users of any changes to our sub-processors at least 30 days in advance via email or in-app notification.

8. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this Policy:

When data is no longer needed, we securely delete or anonymize it. Upon termination of a client's account, all associated data is deleted within 30 days unless retention is required by law.

9. International Data Transfers

Your data may be processed and stored in various jurisdictions, including the United States, the European Union, and other countries where our sub-processors operate.

If you are located in the EU/EEA, UK, or other jurisdictions with data transfer restrictions, we apply the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all sub-processors that include appropriate transfer mechanisms
• Technical and organizational security measures

For users subject to the Law of the Republic of Belarus "On Personal Data" (dated May 7, 2021), we comply with the applicable requirements for cross-border data transfers.

10. Your Privacy Rights

Depending on your location, you may have the following rights:

a. Under GDPR (Europe/UK):

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict processing of your data
• Data portability (receive your data in a structured format)
• Object to processing based on legitimate interest
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

b. Under CCPA (California, USA):

• Know what personal information we collect and share
• Request deletion of your personal information
• Opt-out of sale of personal information (we do not sell data)
• Non-discrimination for exercising your rights

c. Under the Law of the Republic of Belarus "On Personal Data":

• Access your personal data
• Request correction or deletion
• Withdraw consent for processing
• Lodge a complaint with the National Center for Personal Data Protection of the Republic of Belarus

To exercise any of these rights, contact us at hello@1ma.ai. We will respond within 30 days. Verification of your identity may be required.

11. Automated Decision-Making

Our service uses AI technologies to automatically generate responses to messages received by our clients' Instagram accounts. This constitutes automated processing of personal data.

• AI-generated responses are based on conversation context, product catalog data, and client-configured behavior settings.
• No solely automated decisions with legal or similarly significant effects are made about individuals.
• An escalation mechanism is always available: conversations can be escalated to a human operator at any time (automatically by the AI or manually by the client).
• You have the right to request human intervention, to express your point of view, and to contest automated decisions by contacting the business whose Instagram account you are communicating with, or by contacting us at hello@1ma.ai.

12. Children's Privacy

Our services are not directed at children under 13 years of age (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will promptly delete it. If you believe a child has provided us with personal data, please contact us at hello@1ma.ai.

13. Security

We implement reasonable technical and organizational measures to protect personal data, including:

• AES-256 encryption of sensitive credentials at rest
• Encrypted data transmission (TLS/HTTPS)
• Row-level security policies in our database
• Access controls and authentication mechanisms
• Regular security reviews

However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

14. Third-Party Links

Our platform may contain links to external websites or services. We are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party services you interact with.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a new "Last Updated" date. Significant changes will be communicated via email or in-app notification at least 30 days before they take effect.

Your continued use of our services after changes become effective constitutes acceptance of the updated Policy.

16. Contact Us

If you have any questions, requests, or complaints regarding this Privacy Policy or our data processing practices, contact us at:

ООО «1ма» 220117, Minsk, Lyubimova Ave. 39, office 1Н, Republic of Belarus 📧 hello@1ma.ai

For EU/EEA residents, you also have the right to lodge a complaint with your local Data Protection Authority.

For residents of the Republic of Belarus, you may contact the National Center for Personal Data Protection of the Republic of Belarus.