Privacy Policy

1. Introduction

Welcome to Famori ("we," "our," or "us"). Famori is a family calendar and scheduling assistant that operates through WhatsApp and a web dashboard, provided by Iris Tech.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our service. We are committed to protecting your privacy and handling your data responsibly.

This Privacy Policy applies to all users of Famori. The legal bases for our data processing are detailed in Section 3.7. By using Famori, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

Account Information:

• Phone number (via WhatsApp)
• Your name
• Family name you create
• Email address (if you sign up via the web dashboard)
• Profile picture (if provided or imported from Google)

Family Member Information:

• Names of family members you add
• Phone numbers of invited family members
• Relationships within the family (e.g., spouse, parent, child)

Children's Information:

When you add children to your family calendar, we may collect: child's name, age or birthdate (if provided), school information (if provided), and activity schedules.

Calendar & Event Data:

• Event titles and descriptions
• Event dates, times, and locations
• Reminder settings
• Recurring event patterns
• Event participants

Message Content:

• Text messages you send to Famori
• Commands and requests
• Natural language inputs in any language

Media Content:

• Voice notes you send (audio files are processed for transcription — see Section 4)
• Images you send (photos are processed for event extraction — see Section 4)
• Documents you send (PDFs, text files, CSVs are processed for event extraction — see Section 4)

Emoji Reactions:

When you react to a Famori message with an emoji, the reaction is recorded and interpreted as a response.

Live Chat & Feedback:

• If you use the live chat support widget on our website, your messages, conversation subject, and support history are stored
• If you submit product feedback, your feedback content and any upvotes are stored

2.2 Information Collected Automatically

Usage Data:

• Daily message count and AI interaction count per user (for rate limiting)
• Feature usage patterns
• Language preferences detected from your messages

Technical Data:

• Timestamps of all interactions
• Message delivery status (sent, delivered, read)
• WhatsApp message metadata and webhook payloads (for debugging and troubleshooting)
• Error logs

Geolocation Data (Website Only):

When you visit the Famori website or use the live chat widget, we may automatically collect approximate geolocation data including: city, country, region, latitude, longitude, and timezone. This data is derived from your IP address via our hosting provider (Vercel) and is used for live chat context and analytics.

IP Address:

Your IP address may be collected when you visit our website. It is used for geolocation detection and security purposes.

Performance Data:

We use Vercel Speed Insights to collect anonymized website performance metrics (page load times, web vitals). This data is not linked to your identity.

2.3 Information from Third Parties

WhatsApp (Meta):

We receive your messages, media, reactions, and message status updates through the WhatsApp Business API. We do not have access to your WhatsApp contacts, status, stories, or other WhatsApp data beyond your messages to Famori.

Google (if you sign in via Google):

Email address, name, profile picture, and country.

3. How We Use Your Information

3.1 Provide the Service

• Create and manage your family calendar
• Process your natural language commands (text, voice, images, and documents)
• Send reminders and notifications via WhatsApp
• Enable family member invitations and sharing
• Support multiple languages (language auto-detected from your messages)
• Track message delivery status to ensure reliable communication

3.2 Rate Limiting & Fair Use

Track daily message and AI call counts per user to prevent abuse and ensure fair service for all users.

3.3 Improve the Service

• Analyze anonymized usage patterns to improve features
• Fix bugs and technical issues using stored error logs and webhook payloads
• Develop new features

3.4 Communicate with You

• Send trial reminders and subscription notifications
• Respond to your questions and requests
• Send important service announcements
• Send admin broadcast messages (e.g., new feature announcements, maintenance notices)

3.5 Process Payments

• Process subscription payments via Stripe
• Manage billing and invoicing
• Handle refund requests

3.6 Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests
• Protect our rights and safety

3.7 Legal Basis for Processing (GDPR Article 6)

Under the General Data Protection Regulation (GDPR), we are required to have a valid legal basis for each type of data processing. Below is the legal basis we rely on for each category:

Performance of Contract (Article 6(1)(b)):

We process this data because it is necessary to provide the Famori service you requested:

Legitimate Interest (Article 6(1)(f)):

We process this data based on our legitimate business interests, balanced against your rights:

Consent (Article 6(1)(a)):

For non-essential processing, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing:

4. AI Processing

4.1 How AI Works in Famori

Famori uses artificial intelligence (provided by Groq) to understand your messages and respond appropriately. Here is what data is sent for each type of interaction:

How each message type is processed:

Text Messages:

Your message, along with your recent conversation history (up to 1,000 messages) and family context, is sent to Groq. The AI processes your message, may call tools (e.g., create an event), and the response is sent back to you via WhatsApp.

Voice Notes:

Your audio file is downloaded from WhatsApp and sent to Groq's Whisper model for transcription. The transcribed text is then processed the same as a text message. Supported audio formats: OGG, MP3, M4A, AMR, AAC.

Images:

Your image is downloaded from WhatsApp and converted to base64 format. The image is sent to Groq's vision model to extract event details (dates, times, locations, titles). Extracted events are presented to you for confirmation before being added to your calendar.

Documents:

Your document is downloaded from WhatsApp. Text is extracted locally (supported formats: PDF, TXT, CSV, HTML, JSON). The extracted text (up to 8,000 characters) is sent to Groq's AI for event analysis. Extracted events are presented to you for confirmation before being added. Binary formats (DOCX, XLSX, PPTX) are not supported.

4.2 Important AI Disclosures

• Conversation Context: To provide coherent responses, we send your recent conversation history (up to the last 1,000 messages in your session) to our AI provider with each request.
• AI Limitations: AI may occasionally misunderstand your messages or provide incorrect responses. Always verify important information.
• No Human Review: Your messages are processed by AI automatically. Humans do not review your conversations unless you report an issue or contact support.
• Not Professional Advice: Famori does not provide medical, legal, financial, or other professional advice.

4.3 Your Data and AI Training

5. How We Share Your Information

5.1 Within Your Family

Famori is a family sharing service. Information you add to your family calendar (events, reminders) is visible to all family members you have invited. This is the core function of the service. You control who is in your family by inviting members, removing members, or leaving a family.

5.2 Service Providers

We share data with trusted service providers who help us operate Famori:

All service providers are contractually obligated to protect your data and use it only for the specified purposes.

Internal Team Communications: We use Slack and/or Discord for internal team alerts (e.g., new user signups, error notifications). These alerts may contain anonymized or summarized activity data but do not expose your full personal information to external parties.

5.3 Legal Requirements

We may disclose your information if required by law, such as: court orders or subpoenas, government or regulatory requests, to protect our legal rights, or to prevent fraud or security threats.

5.4 Business Transfers

If Famori is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you of any such change.

5.5 What We Never Do

We NEVER: sell your personal information to third parties, share your data with advertisers, use your data for targeted advertising, or share individual data with other Famori families.

6. Data Retention

6.1 Active Accounts

We retain your data for as long as your account is active and you have a valid subscription.

6.2 Trial and Grace Period

6.3 Data Deletion

Automatic Deletion: If you do not subscribe within 30 days after your trial ends, your family data is automatically deleted, including: all calendar events, all family member records, all reminders, all message and conversation history, and your account information.

We send deletion warnings at: Day 25 (5 days before), Day 28 (2 days before), and Day 30 (1 day before).

Manual Deletion: You can request deletion of your data at any time by emailing dev@iristech.my. We will process deletion requests within 30 working days.

How Deletion Works: Some data in our system uses soft-delete flags (marking records as removed) before permanent purging. During the deletion process, soft-deleted data is not accessible to you or other users but may remain in our database temporarily until the purge cycle completes.

6.4 After Subscription Cancellation

If you cancel your Premium subscription: you keep access until the end of your billing period, after that you enter a 30-day grace period (view only), and after 30 days your data is deleted.

6.5 Conversation History

Your chat conversation history with Famori (up to the last 1,000 messages per session) is retained for as long as your account is active to provide context for AI responses. This history is deleted when your account is deleted.

6.6 Debugging & Webhook Logs

WhatsApp webhook payloads and message metadata are stored for debugging and troubleshooting purposes. These logs are periodically purged and are not used for any purpose other than maintaining service reliability.

6.7 Backup Retention

For disaster recovery, we may retain encrypted backups for up to 90 days after deletion. These backups are not accessible for normal use and are permanently purged after 90 days.

7. Children's Privacy

7.1 Age Requirement

Famori is intended for users aged 18 years or older. By using Famori, you confirm that you are at least 18 years old.

7.2 Children's Information

When parents or guardians add children to the family calendar, they are responsible for: ensuring they have the right to share their children's information, deciding what information to share, and managing their children's privacy within the family.

7.3 Special Protections

• Children's information is only visible to family members
• We do not share children's data with third parties (except service providers necessary to operate the service)
• Parents can delete children's information at any time

7.4 Kids Safety Features (Coming Soon)

When we launch Kids Safety features, additional safeguards will apply: check-in reminders controlled by parents, location sharing (if implemented) requiring explicit consent, and children's responses visible only to designated family members.

8. Data Security

8.1 Security Measures

• Encryption in Transit: All data is encrypted using TLS/SSL
• Encryption at Rest: Stored data is encrypted
• Access Controls: Limited employee access on a need-to-know basis
• Secure Infrastructure: We use reputable cloud providers with strong security certifications
• Rate Limiting: Daily message and AI call limits protect against abuse
• Token Expiration: Dashboard access tokens (for WhatsApp-first users) expire after 24 hours

8.2 Data Breach Notification

If we discover a data breach that affects your personal information, we will: notify affected users within 72 hours, notify relevant authorities as required by law, take immediate steps to mitigate the breach, and provide guidance on protective measures.

8.3 Your Responsibilities

• Keeping your phone and WhatsApp secure
• Not sharing your family access with unauthorized people
• Reporting any suspicious activity to us immediately

9. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data by emailing dev@iristech.my.
• Correction: Update your information by messaging Famori or contacting us.
• Deletion: Request deletion of your data by emailing us. We will process requests within 30 working days.
• Withdrawal of Consent: You can stop using Famori at any time. Your data will be deleted according to our retention policy.
• Data Portability: Request your data in a machine-readable format by emailing us.
• Complaint: You have the right to lodge a complaint with your local data protection authority.

10. International Data Transfers

Famori operates globally. Your data may be transferred to and processed in countries other than your own, including:

• United States: Our AI provider (Groq), hosting infrastructure (Vercel, Convex), payment processing (Stripe), and email delivery (Resend)
• Other Countries: Where our service providers operate

We ensure appropriate safeguards are in place for international transfers, including: contracts with service providers requiring data protection, use of providers with recognized security certifications, and compliance with applicable data transfer regulations.

11. Cookies and Tracking

11.1 Famori App (WhatsApp)

The Famori WhatsApp assistant does not use cookies.

11.2 Famori Website

• Essential Cookies: Required for the website to function (authentication, session management)
• Performance Monitoring: Vercel Speed Insights collects anonymized page performance data (load times, web vitals). This data is not linked to your identity.

11.3 Geolocation

When you visit our website, approximate geolocation data (city, country, region) may be derived from your IP address for analytics and live chat context. No precise GPS location is collected. You can control cookies through your browser settings.

12. Third-Party Links

Famori may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. Please review their privacy policies separately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes: we will update the "Last Updated" date, for significant changes we will notify you via WhatsApp, and continued use of Famori after changes constitutes acceptance. We recommend reviewing this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

15. Language

This Privacy Policy is provided in English. If there is any conflict between the English version and a translated version, the English version prevails.