Privacy policy

Last updated 24 July 2026

The short version

To run your assistant, Oleon stores your account, your workspace and team, the channels you connect, your contacts, and the message history between your assistant and your customers, in our database. There is no advertising and no tracking pixels, and we don't sell your data. We use a small set of providers (below) to host the app, send messages, take payments, and generate AI replies.

Who we are

Oleon (“we”) connects a business's WhatsApp number to an assistant that can answer their customers. This policy covers the Oleon website and app at two.oleon.io.

What we store

To run your assistant, we store the following in our database:

Your account - your name, email, and phone number, so we know who you are and can contact you.
Your workspace and team - your business name, your settings, and the people you invite along with their roles.
Your channel connections - the identifiers and access tokens for the channels you connect (for example WhatsApp, SMS, email, and social accounts such as Facebook, Instagram, and YouTube). Access and refresh tokens are encrypted before they are stored.
Your contacts and conversations - the people your assistant talks to, and the message history across every channel, so you can read and reply from the shared inbox.
Your bot's knowledge - the website content, notes, and files you add for the assistant to answer from.
Billing - your plan, your usage, and a record of payments. Card details are handled by our payment provider and are not stored by us.

Where it's stored

In a hosted Postgres database (Supabase), separated per workspace so one business cannot see another's data. Access tokens and other secrets are encrypted before they are written. Some sign-in and setup state is also kept in signed, httpOnly cookies in your browser.

Your customers' messages

Messages between your assistant and your customers are stored in our database so you can read the history and reply from the shared inbox, and so analytics and follow-ups can work. On WhatsApp (and Messenger, Instagram, and Telegram) the conversation also lives on that platform, governed by that platform's own privacy policy.

To generate an AI reply, the relevant message text is sent to our AI provider (Google, Gemini). The test conversation on the Chat page is kept in your browser tab.

Connecting Facebook, Instagram and YouTube

If you connect a Facebook Page, an Instagram account, or a YouTube channel, Oleon can read comments on your own posts and videos and - when you approve them, or switch a channel to automatic - reply to those comments and publish posts on your behalf. We only access the accounts you connect, and only your own content.

For each connection we store the account identifier and an access or refresh token, encrypted, so we can act on your behalf until you disconnect. The comment text and the replies your assistant drafts or posts are stored in our database so you can review and manage them.

YouTube.Oleon's YouTube features use YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data. Oleon uses the YouTube Data API only to read comments on your channel and post replies you allow; we do not use this data for advertising and do not sell or share it. You can revoke Oleon's access to your Google account at any time from your Google security settings (and disconnect it inside Oleon under Settings). If you disconnect, we stop accessing YouTube and delete the stored token.

Who else sees it (our providers)

We use a small set of providers, each only for the part of the product it powers:

Supabase - our database and sign-in.
Vercel - hosts the app and keeps standard access logs.
Meta - WhatsApp, Messenger, and Instagram, when you connect them.
Google (Gemini) - generates AI replies from message text.
Google (YouTube Data API) - reads and replies to comments on a YouTube channel you connect. Governed by the Google Privacy Policy.
PayHere - processes card payments.
ZeptoMail - sends transactional email (invites, email replies).
Your SMS provider - when you connect your own SMS gateway (for example Dialog or Text.lk), texts go through it.

We don't use advertising or tracking pixels, and we've never sold data to anyone.

Cookies

Only strictly-necessary cookies: one keeps you signed in, and setup state may be held in another. No advertising or analytics cookies.

Getting rid of it

Because your data is in a database, clearing your browser will not remove it. To delete your account and the data in it, contact support and we will remove it, except anything we are legally required to keep for a period (for example payment records).

Your WhatsApp Business account stays yours regardless. You can revoke Oleon's access at any time from your Meta business settings, and we lose the ability to send anything the moment you do.

Changes

If we start storing more - a database, a transcript, anything - this page changes before that ships, not after.

Contact

Questions about any of this: dilshanzmail@gmail.com.