1. Who this covers
Career Velocity BD ("we", "us", "our") builds and operates AI chat assistants for client businesses, based in Dhaka, Bangladesh. When you message a Facebook Page, comment on a post, or use a website chat widget that runs on our platform, this policy explains what happens to your information — regardless of which specific client business you were messaging.
We act as the client business's technology provider: the business owns the relationship with you, and we operate the AI on their behalf.
Sections 2–6 cover people who message or comment. Section 7 covers business owners who connect a Facebook Page to Coqui.
2. What we collect
Depending on how you reach out, we collect:
- Your public profile name, if you message us via Facebook Messenger or comment on a Facebook Page.
- The content of your messages — whatever you type, and any photo, sticker, voice message, short video or document you choose to send, so the assistant can understand it and reply. Media files are not kept on our servers after the reply.
- Your name, email address and phone number, if you chat with us on careervelocitybd.com (see section 8a).
- Anything you voluntarily provide during the conversation to get help, such as your phone number, a preferred appointment time, or an order/delivery address — only when relevant to what you asked for (e.g. booking an appointment or placing an order).
We never ask for or store passport numbers, national ID numbers, bank or card details, or passwords, under any circumstance — no client business's assistant is permitted to request these.
3. How we use it
Your information is used only to:
- Generate a relevant reply to what you asked.
- Remember context within your own conversation, so you don't have to repeat yourself (see retention period below).
- Complete a specific request you made, such as confirming an appointment or an order, or notifying that business's team when a human needs to step in.
We do not use your data for advertising, and we do not sell it. We share it only with the specific business you were messaging and with the service providers that run Coqui on our behalf (see section 6).
4. How long we keep it
Conversation history used by the assistant is automatically and permanently deleted after 30 days of inactivity on that conversation. The business's contact record for you (your name, any phone number you shared, and a short summary of your enquiry) stays in that business's Coqui inbox until the business deletes it, the business disconnects its Page, or you ask us to delete it. We don't keep an indefinite archive.
5. Deleting your data before that
You don't have to wait 30 days. Two ways to have your data removed immediately:
- Message "DELETE DATA" (in exactly those words) to any Page, WhatsApp number or chat widget that uses our platform. This permanently deletes your stored conversation history, your contact record in that business's inbox, and any active session, right away, and you get a confirmation message.
- Email support@careervelocitybd.com with the name of the business you messaged. We complete the deletion within 7 days.
6. Who can see your conversation
Your conversation is visible to the team of the specific business you messaged (so a person can step in when needed). It is not visible to any other client business we work with, and not shared with advertisers or data brokers.
These service providers process data on our behalf, only to run Coqui:
- Google (Gemini API) generates the assistant's replies. The text of your message (and any photo, voice message, video or document you send) and the recent conversation are sent to it for that purpose. We use the Gemini API's paid tier, under which Google does not use these prompts or replies to improve its products or train its models.
- Hostinger hosts our servers and database (data centres in Malaysia and Lithuania).
7. Business owners who connect a Facebook Page
When a business owner connects a Facebook Page with Facebook Login for Business, we receive from Meta:
- The list of Pages they manage (shown once so they can choose which Pages to connect; Pages they don't select are not stored).
- For each Page they select: the Page ID, Page name and a Page access token, which lets Coqui receive the Page's messages and comments and reply to them. Access tokens are stored encrypted.
- Their Facebook name and an app-scoped Facebook user ID, so we know who connected the Page and can act on a deletion request from Facebook.
We use this data only to provide Coqui to that business: to receive and answer messages and comments on the Pages they connected, and to show those conversations in their dashboard. We do not use it for advertising and do not sell it.
Disconnecting and deletion: a business owner can remove a Page at any time in the dashboard (Connectors → Meta Integration), which deletes its token, products, settings and contacts. Removing the Coqui app in Facebook (Settings & Privacy → Settings → Business Integrations, or Apps and Websites) sends us a deletion request: we automatically delete every Page access token that person granted, stop receiving those Pages' messages, and give them a confirmation code they can check at /data-deletion. To close a dashboard account entirely, email support@careervelocitybd.com.
8. Business owners who use Google sign-in or Google Calendar
Sign in with Google: we receive the account's name, email address and whether Google has verified that email. We use them only to create or log in to that person's dashboard account.
Google Calendar: a business owner can connect their Google Calendar so Coqui can book appointments. With the permission they grant (create and edit events on calendars they own), Coqui:
- reads the start and end times of events on their primary calendar, only to know when they are busy, so it never books a customer into a time that clashes. Event titles, descriptions and guests are not requested or stored. This check runs on our own servers when a booking is made;
- creates an event for each appointment Coqui books, with the customer's name, phone number and the reason they gave, and deletes that event if the appointment is cancelled in the dashboard or the customer asks for their data to be deleted.
Coqui never changes or deletes events it didn't create. The Calendar access token is stored encrypted, is used only by our servers to do the above, and is never shown to anyone. Data from Google is not used for advertising, is not sold, is not used to train AI models, and is not shared with anyone except as needed to provide this feature or required by law.
AI and Google user data: Coqui uses an AI model (the Google Gemini API, paid tier) to write chat replies. Data received from Google Calendar, raw or derived (including busy times and anything calculated from them), is never sent to the Gemini API or to any other AI or machine-learning service, and is never used to create, train or improve any AI or machine-learning model. When Coqui suggests appointment times in a chat, it uses only the opening hours the business set in Coqui and the appointments already booked in Coqui; the Google Calendar check happens separately on our servers. We do not use any other third-party AI provider, aggregator or model hub.
Limited Use statement: Career Velocity BD's use and transfer of information received from Google APIs, including raw or derived user data received from Google Workspace APIs, adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting: Connectors → Google Calendar → Disconnect deletes the stored token and revokes Coqui's access at Google. You can also remove access at myaccount.google.com/permissions.
8a. Chatting with us on careervelocitybd.com
Before the chat on our own website starts, we ask for your name, email address and phone number.
- Why: to answer your questions and to follow up on your enquiry by email or phone (for example, to help you sign up or to send what you asked for). This is necessary to respond to the request you are making.
- Offers and updates (marketing): only if you tick the separate, optional box on the form. It is never pre-ticked, and saying no never stops you from chatting. You can withdraw at any time by replying "unsubscribe" to any email, telling us in the chat, or emailing support@careervelocitybd.com.
- Proof of your choice: we record what you agreed to and when. We do not store your IP address or a device fingerprint for this.
- Who sees it: only Career Velocity BD's own team. We never sell it or share it with other businesses or advertisers.
- How long: the chat itself is deleted after 30 days (section 4). Your name, email and phone are kept while we're in touch and deleted automatically after 24 months without any activity.
- Deleting it: type "DELETE DATA" in the chat to delete the conversation and your details at once, or email us. You can also ask us for a copy of what we hold about you, or to correct it.
9. How we protect your data
We protect personal and sensitive data, including data received from Google (Google Calendar access tokens and busy times) and Meta (Page access tokens), with these measures:
- Encryption in transit: every connection to our website, dashboard, webhooks and APIs uses HTTPS (TLS), with HTTP Strict Transport Security turned on. Our servers talk to Google and Meta over HTTPS only.
- Encryption at rest for access tokens: Google and Meta access and refresh tokens are encrypted before they are stored, using authenticated encryption (Fernet: AES with an HMAC-SHA256 check). The key is kept separately from the database. Tokens are used only on our servers and are never shown in the dashboard, in emails or in logs.
- Passwords and sessions: passwords are stored only as salted PBKDF2-SHA256 hashes, never in plain text. Login sessions use secure, HTTP-only cookies, and session tokens are stored only as hashes. Business owners can turn on two-factor authentication.
- Access control: each business can see only its own conversations, contacts and settings; this separation is checked on every request and covered by automated tests. Our own admin accounts must use two-factor authentication, and staff get only the permissions they need.
- Minimum data: we ask for the fewest permissions possible. From Google Calendar we read only event start and end times, never titles, descriptions or guests. Google user data is never sent to any AI model (see section 8).
- Server security: our servers allow only key-based administrator login, run a firewall that opens only the ports the service needs, and automatically block repeated failed login attempts.
- Backups: backups are kept on the server, which only administrators can access, and the off-site copies are copied over an encrypted SSH connection and stored encrypted with AES-256. Backups are rotated and old ones are deleted.
- Retention and deletion: chat history is deleted after 30 days. Disconnecting Google Calendar deletes its token at once and revokes our access at Google. Removing a Page deletes its token and data (see sections 4, 5 and 7).
- If something goes wrong: if we learn of a security incident that affects your data, we will act to contain it, revoke affected tokens, and tell affected users and the relevant platforms (Google, Meta) without undue delay.
10. Changes to this policy
If this policy changes in a way that affects how your data is handled, we'll update this page and revise the date below.
11. Contact us
Career Velocity BD, Dhaka, Bangladesh. Email support@careervelocitybd.com with any question about this policy or any data request. You can also reply to the Facebook Page or chat widget you originally contacted.