Privacy policy

1. Two different roles, and this is the important part

We are the controller of the data that belongs to your account: your name, email, organisation and plan. For your customers' conversations passing through the platform we are a processor acting for you — you are responsible for them, we act on your instructions, and we do not use them for our own purposes. In practice: your customer messaging you is not our data, it is your data in our care.

2. What we collect

Four kinds, and no fifth:

• Your account data: name, email address, a hashed password (or a Google account identifier if you signed in with Google), organisation name, and your language and theme preferences.
• Your customers' conversations: the text of inbound and outbound messages, the customer name and number as the platform supplies them, and attachment types. These reach us from WhatsApp, Messenger or Instagram only after you connect the channel.
• The material you upload: knowledge documents, inventory rows and their prices, media files. You put these there, and they are the only thing the agent answers from.
• Operational data: sign-in times, IP address, browser type, error logs, and the session counter used for billing.

3. What we do not collect

There is no advertising tracker and no third-party analytics pixel anywhere in the application. We do not read conversations on any channel you have not connected yourself. And we reach nothing in your Meta account beyond the permissions you explicitly granted when connecting.

4. Where conversations go

To produce a reply, the conversation text and excerpts of your material are sent to an AI model provider. That is not a technical footnote — it is a fact you are entitled to know. The parties that see conversation content are:

• Meta — the source and destination of the messages; its own policy governs the channel itself.
• The model provider — receives the conversation text and the retrieved excerpts in order to generate the reply.
• The hosting provider — where the database and files are stored.

We do not sell your data or your customers' data to anyone, and we do not share it for marketing. Your conversations are not used to train any model.

5. How long data is kept

Your conversations, customers and documents stay as long as your account does — there is no automatic expiry, because a customer record months later is exactly what your team needs. Deleting a document or an inventory row really removes it from the database and from storage rather than hiding it. Closing your account deletes its data within thirty days, except what we are legally required to keep, such as billing records.

6. Isolation between organisations

Every organisation has its own isolated space enforced at the database layer, not in the interface. A query carrying no organisation identity returns nothing rather than everything — a deliberate design choice: a mistake there produces an empty screen, not one business seeing another's data.

7. Cookies

Three, all functional:

• The session cookie — keeps you signed in.
• Language — remembers whether you read Arabic or English.
• Appearance — remembers light or dark.

No advertising cookies and no cross-site tracking, which is why no consent banner stands between you and the page.

8. Your rights

You may request a copy of your data, its correction, its deletion, or an export. The leads and inventory screens export CSV and Excel from inside the application without asking anyone. For full deletion or any other request, write to us and we will respond within thirty days.

9. Security

Passwords are hashed and never stored as text. Traffic is encrypted over HTTPS. Platform tokens are actually erased when a channel is disconnected rather than left sitting in a deleted row. No system is perfectly secure, and we will not claim otherwise.

10. Children

This is a business service and is not directed at anyone under eighteen. We do not knowingly collect children's data, and we delete it if any reaches us.

11. Transfers outside your country

Your data may be processed on servers outside your country of residence, because model and hosting providers operate globally. We work only with providers that commit to recognised data-protection safeguards.

12. Changes to this policy

If something material changes in how we handle data, we will update this page and tell you inside the application. The date at the top is the date of the last real change.