When you message Touly

Who is responsible

Touly Messaging is the integration used by Touly for WhatsApp, Instagram direct messages and Facebook Messenger messages sent to our business accounts. The data controller is Aurum Ventures SL, company number B23860331, Cami de Genova 33, 07014 Palma de Mallorca, Spain. Contact info@touly.ai for privacy questions. This notice supplements the site privacy policy.

What reaches Touly

If you contact our connected business accounts, Meta may deliver your message text, the profile name or account identifier it makes available, your phone number for WhatsApp, attachment information, timestamps, and message, reply, reaction, read or delivery events. We receive messages and events for our connected accounts, not access to your unrelated private conversations.

Why we use it

We use incoming messages to receive and handle your enquiry, maintain its context, and keep our messaging connection reliable and secure. If you explicitly choose WhatsApp reminders in your signed-in Touly settings and verify your phone by sending the prepared linking message, we also use that number to send the selected getting-started and return reminders. Contacting us by itself does not subscribe you. Instagram and Facebook Messenger messages do not enroll you in WhatsApp reminders.

Messages are not automatically added to your private Touly reflections, relationship canvas or coaching memory, or sent to an AI model by this integration. Phone linking takes place only when you choose reminders in the authenticated app and send the time-limited verification message from that phone. Reminders are generic: they do not include conversation text, relationship details or your partner's activity. Use the authenticated Touly app for private coaching. Please avoid sending intimate, health, financial or identity information through social messaging.

Access, storage and retention

Access is restricted to authorized operational access. Incoming message payloads are encrypted and stored in Touly's existing Supabase infrastructure in Frankfurt, Germany. A separate event record supports delivery tracking and prevents duplicate capture. Captured payloads expire after 30 days and are removed by a daily cleanup job together with their associated event records. Cleanup timing can therefore add up to one day after expiry. You may request earlier deletion using the instructions below.

Meta operates the messaging channels under its own terms and privacy notices. Supabase provides Touly's encrypted message ingestion, consent records and storage, and Vercel hosts this notice and the reminder worker. We do not sell message data or share your message content with other Touly users or affiliates through this integration. Copies retained by Meta or on participants' devices are governed by those services and people; deleting Touly's copy does not delete those copies.

For optional WhatsApp reminders, we store your verified phone number encrypted, an account link, language, consent choices and version, delivery status and the dates needed to limit reminders. We use timestamps from your own Touly sessions and practices to decide whether a reminder is due; we do not read their content for messaging. Active phone and consent records remain while subscribed. Minimal account-level onboarding and reminder dates remain until account deletion so reconnecting does not restart the sequence. Operational metadata for an unreadable messaging event contains no message content and remains until its investigation is resolved; it is then removed after thirty days. We remove a suppressed phone record after thirty days, terminal reminder records after thirty days, and attempt metadata after thirty-one days. Linking proofs expire after fifteen minutes and are deleted one day later. Account deletion removes its linked reminder records. Incoming message payloads follow the thirty-day retention described above. Scheduled cleanup may add time until the next run.

Your choices and deletion

Reminders are optional. You can reply STOP (or BAJA) from your connected phone, or turn them off in Touly settings. These choices do not affect access to the app or private coaching. To enable reminders again, you must make a fresh choice in the app and verify your phone again. A request already in flight may still arrive. The prepared cadence is a welcome, one practice reminder after three days without a return, and one reminder after fourteen days of inactivity; reminders are at least three days apart, with a maximum of four dispatch attempts in thirty days. We wait for a return before another inactivity reminder.

You can ask for access, correction or deletion, or raise a privacy concern, by writing to info@touly.ai. Follow our data deletion instructions so we can identify the correct channel and verify your request without asking for your conversation text. You do not need a Touly account to request deletion of messaging data. We aim to respond within 30 days. You may also contact the Spanish supervisory authority, Agencia Española de Protección de Datos (AEPD).

Messaging availability

Availability depends on Meta's setup, approved templates and the reminder settings enabled by Touly. Only the optional reminder uses described here are enabled by your consent. Further uses of messaging data require updated information and appropriate authorization.