Skip to main content
← CoastalCode

Privacy Policy: CoastalCode

Last updated: 20 October 2026

This policy explains how personal data is handled when you talk to a CoastalCode assistant on a business's website, on its WhatsApp number, on its Facebook Page (Messenger) or on its Instagram account (Instagram Direct). The assistant runs as a Meta app named "Chatbot Coastal". The policy is written in plain language on purpose.

1. Who we are

CoastalCode is operated by RIBAUDO TOMMASO, trading as CoastalCode ("we", "us"), Calle atras hotel arena blanca, Playa Chiquita, Cahuita, Limón, 70403, Costa Rica. Phone: +506 6133 0624. You can reach us about anything in this policy at sales@coastalcode.dev.

Data controller. RIBAUDO TOMMASO, trading as CoastalCode, is the data controller for the data handled by the service as described in this policy. The business you write to also receives your conversation and is responsible for its own copy.

CoastalCode builds AI chat assistants for small hospitality and service businesses ("our clients"), such as hotels, vacation rentals and tour operators. A client connects its own website, WhatsApp Business number, Facebook Page and linked Instagram account. The assistant answers the client's customers using only the information published on the client's own website and the rules agreed with the client, and it says clearly in its first message that it is an AI assistant, not a person.

2. What data we handle

  • Your messages and the assistant's replies, kept together as a conversation, including any replies a person from the business writes when they take the conversation over.
  • An identifier for you on the channel. On WhatsApp this is your phone number. On Messenger and Instagram it is a number Meta assigns to you for that Page or account. On a website it is a random conversation code created by the chat window.
  • Your name, where the channel provides it. On WhatsApp, Meta sends the profile name you have set together with your message. We do not receive your friends, contacts or other profile information.
  • On websites only: the address of the page you were on when you wrote, and the language of the page.
  • Details you choose to give, such as a name, email address or phone number, if you type them into the conversation or into a contact card the assistant shows.
  • Voice notes on WhatsApp. If you send one, it is converted to text so the assistant can answer. The conversation keeps the text. Pictures and Messenger or Instagram voice messages are not read; the assistant asks you to write instead.
  • Technical records: message identifiers, times, whether a reply succeeded or failed, and usage counts. The company that hosts the service also processes standard connection data (such as your IP address) when you use the website chat window.

Please do not send sensitive information (health, payment card numbers, passwords, identity documents) in a chat. The assistant does not need it.

3. Data we receive from Meta platforms

When you write to a business on WhatsApp, Facebook Messenger or Instagram Direct, Meta passes us your message, your phone number (WhatsApp) or the number Meta assigns to you for that Page or account (Messenger and Instagram), your WhatsApp profile name, and the time of the message. We use this data only to:

  1. receive your message and send the assistant's answer back to you through the business's own account;
  2. keep the conversation so the business owner can read it and take it over (when a person from the business replies, the assistant pauses);
  3. email the business owner a copy of the conversation.

We do not use data from Meta platforms for advertising, marketing or broadcast messages, we do not sell it, and we do not use it to build profiles of you.

4. Why we use it

  • To answer your question, using only the client's website information and rules.
  • To keep the conversation so the business can read it and reply to you itself.
  • To send a copy of the conversation to the business by email, together with any contact details you left.
  • To keep the service secure, working and within daily limits per sender, using the technical records.

We do not sell your data, and we do not use your conversations for advertising or to build advertising profiles. The assistant does not make decisions that have legal or similarly significant effects on you, and it does not take bookings or payments.

5. Who receives it

Each client's conversations are kept separate from every other client's. They are never shared with other clients, never sold and never given to third parties for their own purposes.

  • The business you wrote to receives the conversations that belong to it.
  • Our processors, which help us run the service. Each only receives what it needs, and only to provide its service to us:
    • Meta Platforms (WhatsApp, Messenger, Instagram): delivers your messages to us and our replies to you, under its own terms and privacy policy.
    • OpenAI (AI model provider): writes the answer. It receives your message, recent messages of the conversation, relevant text from the client's website, and, for WhatsApp voice notes, the audio to be transcribed.
    • Supabase (database): stores the conversations and settings.
    • Vercel (hosting): hosts the service.
    • Resend (email delivery): sends the conversation email to the business.
    • Sentry (error monitoring): records technical errors so we can fix them.

We disclose data to authorities only when the law requires it.

6. Transfers outside your country

Some of these providers are located in, or process data in, the United States or other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

7. How long we keep it

  • Conversations are kept for as long as the business uses the CoastalCode assistant, so its owner can read them and follow up. When the business stops using the service, we delete its conversations within 30 days.
  • If you ask us to delete your data, we delete your conversations within 30 days and confirm by email (see section 9).
  • Technical error and usage records are kept only as long as needed to run and fix the service.

8. Your rights

Depending on where you live (for example, under the EU and UK GDPR), you can ask for access to your data, correction, deletion, restriction or portability, and you can object to its use. You can also complain to your data protection authority. To use these rights, write to sales@coastalcode.dev. You can also write directly to the business whose assistant you spoke with.

Stopping the assistant on WhatsApp: send the word STOP and it will stop answering you; send START to turn it back on.

9. Data deletion instructions

To have your conversation data deleted, follow the steps on the data deletion page: email sales@coastalcode.dev with the subject "Delete my data", your phone number (WhatsApp) or your Messenger or Instagram username, and the business you wrote to. We delete the matching conversations within 30 days and confirm by email.

A copy of the conversation may already have been emailed to the business, which then holds it under its own responsibility; we will tell you how to ask it to delete its copy.

10. Children

The assistant is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has written to an assistant, contact us and we will delete the conversation.

11. Security

Access to the service's systems is restricted, connections are encrypted, and access keys are stored encrypted. No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will place the new version at the same address.

13. Contact

RIBAUDO TOMMASO, trading as CoastalCode

Calle atras hotel arena blanca, Playa Chiquita, Cahuita, Limón, 70403, Costa Rica

Phone: +506 6133 0624

Email: sales@coastalcode.dev