Aimarket AI Messaging Privacy Policy
This Privacy Policy applies to Aimarket AI Messaging, a service provided by ORMUS TECHNOLOGIES Limited Liability Company (“Ormus”, “we”, “us”, “our”).
Aimarket helps businesses manage customer conversations from Instagram and other supported communication channels, work with human operators, and, where enabled by the business, use artificial intelligence features.
We treat privacy as a core product requirement, not as an add-on. This Policy explains what information we may process, why we process it, who may receive it, how we protect it, and how individuals and business customers can request deletion.
1. Who is responsible for the data
Service operator:
ORMUS TECHNOLOGIES Limited Liability Company
Tax ID / VÖEN: 1310049261
Registered address: AZ1012, Baku, Yasamal District, Yeni Yasamal 1, Building 1, Apartment 56, Republic of Azerbaijan
E-mail: info@aimarket.az
For data relating to Aimarket user accounts and administration of the Aimarket service itself, Ormus generally determines the purposes and means of processing.
Where an end user messages a business through that business’s connected Instagram account or another connected channel, the business will generally determine the purposes of the customer relationship, while Aimarket processes relevant communication data on the business’s behalf. The exact legal role may depend on applicable law and the agreement with the business customer.
2. Information we may process
Depending on the features used, Aimarket may process:
Aimarket user and staff information. Name, e-mail address, organization, role, login and security information, account status and administrative activity.
Business and channel information. Workspace information, connected Instagram Professional username, platform identifiers, granted permissions, connection status, webhook status and integration diagnostics.
OAuth and access information. Access tokens and related technical information needed for official integrations. Access tokens are stored server-side in encrypted form and are not intended to be exposed in the user interface.
Customer conversations. Incoming and outgoing message content, timestamps, sender/recipient identifiers, delivery and read status, message author, conversation status and other metadata made available by the connected channel.
Files and media. Images, documents and other attachments, or the metadata required to process them securely, where the relevant feature is supported.
Knowledge and agent configuration. Business instructions, product/service information, rules, system prompts, prompt versions, test questions and AI-agent settings.
AI processing. If a business administrator enables AI functionality, the minimum necessary message content, conversation context and relevant knowledge excerpts may be sent to the selected AI provider to generate a response or suggestion. When AI is disabled, Aimarket does not automatically send AI replies to live customers.
Technical and security information. IP address, browser/session information, audit events, API and webhook events, error codes, operational logs and security logs.
3. Where information comes from
Information may come directly from Aimarket users, from their organization, from connected platforms such as Instagram, from activity within Aimarket, and from technical/security logs.
We seek to access only the information necessary for the enabled feature and within the permissions granted by the account owner.
4. Why we process information
We process information to:
- create and manage Aimarket accounts and company workspaces;
- receive and display messages from connected channels;
- enable human operators to handle customer conversations;
- provide AI, Copilot and agent functionality when enabled;
- retrieve relevant information from the business knowledge base;
- support AI-to-human handoff and operator control;
- monitor integration permissions, tokens and connection health;
- detect errors, abuse and security incidents;
- maintain service reliability, security and performance;
- comply with lawful obligations and requests.
Aimarket does not sell customer conversation content to advertising brokers.
Unless separately agreed in writing, Aimarket does not use customer conversation content to train a general-purpose model.
5. AI and human oversight
The connected business decides whether AI auto-reply is enabled, whether AI is used only as Copilot, or whether a conversation is handled entirely by a human operator.
AI can be incorrect, incomplete or out of context. Aimarket therefore supports human oversight, pause and handoff controls, and operator intervention.
The business remains responsible for determining whether AI use is appropriate for its industry, customer relationship and legal obligations.
6. Who may receive information
Only as necessary to operate the service:
Meta Platforms and other connected channel providers. Instagram functionality relies on official platform APIs and permissions.
AI providers. Only when the business enables AI functionality and only with information reasonably necessary to perform the requested AI operation.
Infrastructure and technical service providers. Hosting, security, e-mail, backup and other operational services where needed.
Authorities and legal process participants. Where disclosure is legally required or reasonably necessary to protect rights, users, or service security.
We expect service providers to process information only for the agreed service purpose and with appropriate safeguards.
7. International processing
Some channel providers, infrastructure providers and AI providers may operate outside Azerbaijan. Certain processing may therefore occur in other jurisdictions.
Where this happens, we seek to use appropriate contractual, technical and organizational safeguards consistent with applicable requirements.
8. Retention
We do not seek to retain information longer than necessary for the purposes described in this Policy.
Account and company information may be retained while the account or commercial relationship remains active. Conversation retention may depend on workspace settings, contractual requirements and applicable obligations.
When a channel integration is disconnected or authorization is revoked, the active access token is removed from active use and should be deleted from secure token storage.
Deleted information may remain temporarily in protected backups until normal backup rotation removes it. It is not restored to active use merely for convenience.
Minimal security or audit records may be retained where reasonably necessary for fraud prevention, security investigation, dispute handling or legal obligations.
9. Security
Depending on the component, Aimarket uses measures such as:
- HTTPS/TLS in transit;
- encryption of integration tokens at rest;
- role-based access control;
- tenant/company data isolation;
- secure session settings;
- webhook signature verification;
- idempotency/replay protection;
- audit logging;
- restricted administrative access;
- security and error monitoring.
No system can guarantee absolute security. We nevertheless take reasonable technical and organizational measures to reduce the risk of unauthorized access, loss, misuse or disclosure.
10. Cookies and sessions
Aimarket may use strictly necessary cookies and similar technologies for authentication, session continuity and security.
Marketing or advertising cookies are not used unless separately introduced with appropriate disclosure and, where required, user choice.
11. Your rights and choices
Subject to applicable law, you may request access to, correction of, deletion of, or restriction regarding information relating to you.
If you are a customer of a business that uses Aimarket, contacting that business directly may be the fastest route. You may also use https://messaging.ormus.az/data-deletion or contact info@aimarket.az.
We may request reasonable information to verify identity or authority before acting on a request.
12. Data deletion
Deletion instructions and a request form are available at:
https://messaging.ormus.az/data-deletion
Once identity or authority is sufficiently verified, we normally aim to complete a valid deletion request within 30 days.
Certain minimal information may be retained where required by law or reasonably necessary for security, fraud prevention or legal claims.
13. Children
Aimarket is a B2B SaaS service intended for businesses and their authorized staff. An administrator of a business account must be authorized to act for that organization.
Where a connected business has special legal obligations when communicating with minors, that business remains responsible for compliance applicable to its activity.
14. Changes to this Policy
We may update this Policy as the product, integrations or legal requirements change.
When a material change is made, we update the effective date and provide additional notice where appropriate.
15. Contact
ORMUS TECHNOLOGIES Limited Liability Company
Tax ID / VÖEN: 1310049261
E-mail: info@aimarket.az
Registered address: AZ1012, Baku, Yasamal District, Yeni Yasamal 1, Building 1, Apartment 56, Republic of Azerbaijan