Your responsibilities to your customers

For the messages your customers send you, OMAI acts on your instructions. You decide who is messaged, what the assistant knows, and what is done with a conversation afterwards — so the duties towards those customers stay with your business. This article lists the ones that come up in practice.

The Terms of Service put it directly: you must have the necessary rights, notices and consents (opt-in) to message your customers, as required by law, and your use of WhatsApp is also subject to the WhatsApp Business Terms and Meta’s policies.

Permission to message

A customer who writes to you first has plainly asked to be answered. Everything else — a follow-up weeks later, a reminder, a promotion — depends on the permission you were given when you collected the number.

• Message people who gave you their number for this purpose, and be able to show when and how they gave it.
• Keep the message related to the reason they gave you the number.
• Honour a request to stop. WhatsApp gives customers their own block and report controls, and repeated unwanted messages damage the quality rating Meta assigns your number.
• Do not import a purchased list. A list you did not collect yourself carries no permission.

The 24-hour window

WhatsApp allows free-form messages only within 24 hours of the customer’s most recent message to you. OMAI enforces this: inside the window the assistant and your team can write anything; once it closes, a free-form reply is refused with The 24-hour window has closed — a free-form reply can’t be sent. Please send an approved template instead.

Outside the window the only thing that can be sent is a message template approved by Meta in advance. Message templates covers how they work. The rule is not an OMAI policy — it is how WhatsApp separates answering a customer from contacting one.

Telling customers the replies are automated

Replies are generated automatically by AI. The assistant hands the conversation to your team when a customer asks for a person, sounds frustrated, or raises a sensitive topic, and anyone on your team can take over a conversation at any moment. Customers should not have to guess which of those is happening.

There is no single "this is a bot" setting in OMAI, so say it in the places customers actually look:

• The description on your WhatsApp Business profile, which a customer sees before they write.
• Your own website privacy notice or terms, where you already describe how you handle enquiries.
• An FAQ entry in the knowledge base — add the question a customer really asks ("Am I talking to a person?") with an honest answer, so the assistant replies correctly instead of improvising.
• The After-hours message on Dashboard → Assistant Settings, if you use one.

Some sectors and some countries require the disclosure explicitly. Check what applies to yours; OMAI does not make that decision for you.

What not to ask for over WhatsApp

Message content is stored in OMAI, sent to the AI provider to produce a reply, and readable by every member of your team — including a viewer, who cannot change anything but can read every conversation. Decide what belongs in that space before a customer sends it.

• Card numbers, expiry dates and CVV codes. Send a payment link instead.
• Passwords, one-time codes and anything that would let someone into an account.
• ID or passport numbers, unless you have a real need and a lawful basis for holding them.
• Medical details, and anything else you would keep in a restricted system rather than a shared inbox.
• Files and information you are not permitted to process — that applies to knowledge base uploads as much as to messages.

When a customer asks about their own data

A WhatsApp user who contacted you deals with you, not with OMAI. If they ask OMAI directly, they are directed back to the business they messaged. OMAI helps you answer where it can, but the reply is yours to give.

What to put in your own privacy notice

• That enquiries sent to your WhatsApp number are answered with the help of an automated assistant.
• That the conversation is stored so your team can follow it up.
• That a service provider processes the messages on your behalf, and that AI processing is involved.
• How a customer reaches you to access, correct or delete what you hold about them.

OMAI’s own Privacy Policy describes what OMAI does with the data; it does not describe what your business does with it, and it is not a substitute for your notice.