Data processing agreement

Who is what

You are the controller for the people who write to your business: you decide why their data is processed. We are the processor and act on your instructions. For your own account, your team's sign-ins and your payments we are the controller, and the privacy notice covers that, not this agreement.

What is processed, why, and for how long

Only what is needed to answer your customers on the channels you connect.

• Whose data: anyone who writes to your business on a channel you have connected.
• What data: their phone number or chat identifier, the messages they send and the replies sent back, the conversation, booking and ticket records, and which AI provider wrote a reply.
• Why: to answer your customers and to give your team the conversation.
• How long: for as long as your workspace exists, each record for the period given under “Retention and the end of the agreement”.

Your instructions

The configuration is the instruction. Connecting a channel tells us to receive and send on it, and a rule you write tells us to apply it. We process nothing outside what the product does on your settings. We do not train any model on your customers' data, and we do not sell it. If an instruction would break the law, we tell you instead of following it.

Security

What is in place, stated as fact because each is tested.

• Separation between businesses is enforced by the database itself, so that one business cannot read another's records.
• Every connection to the platform is encrypted.
• Connection tokens are stored encrypted, and message text is written encrypted under a key of the workspace's own.
• Sensitive actions need a password typed in the last ten minutes. Two-step sign-in is available, and you can require it of your team.
• Administrative actions are written to a log the application can add to and cannot change or delete.
• Phone numbers, email addresses, and bank, card and identity numbers are masked before a message reaches an AI provider.
• What we do not claim: no ISO 27001 certificate, no SOC 2 report, and no penetration test by a third party.

Other processors we use

The current list, with what each receives and where it is, is on the providers page of this site. Each receives only what its part of the service needs. We tell you by email at least 14 days before adding a processor that will receive your customers' data, and you may object in that time; if we cannot settle the objection you may close the workspace. Notice is shorter only where the change is needed to mend a security or legal fault, and then we tell you at once.

Data that leaves the Kingdom

The platform and its database are hosted in Jeddah. Two providers receive your customers' data outside Saudi Arabia.

• DeepSeek, in China, writes the replies. It receives the text of a conversation and the information you approved, after the masking described above. Masking lowers the risk and does not remove it: free text can still identify a person.
• Meta carries WhatsApp messages through the number you connect, on its infrastructure in several countries. It receives the phone number and the message, which cannot be masked: they are the address and the content.
• Laws we and they are under: Jazerah Al Ibdaa is in Saudi Arabia and under Saudi law. DeepSeek is under the law of China, and Meta under the law of the United States and of the other countries it operates in.

Helping you with your customers' rights

When one of your customers uses a right, the request is yours to receive and ours to help carry out, promptly, so that you can answer within the 30 days the law gives you.

• A copy: on your request we export what is held about one person.
• Correction: you edit a contact's details in the workspace, and the change is logged.
• Deletion: you delete one person's data from the conversation screen, or we do it on your instruction. A record is kept that it ran, by count and never by phone number.

If there is a breach

We tell you without undue delay after learning of a breach that affects your customers' data, with what is known at the time: how many of your customers and which, what kinds of data, which providers received it and in which countries, and what was done. Telling the Saudi Data and Artificial Intelligence Authority and your customers is yours to do as the controller, and we give you what you need for it.

Retention and the end of the agreement

Your customers' conversations are kept for 180 days and then deleted by a job that runs every night. When you close the workspace there are 30 days in which nothing is removed and the closure can be undone, and then everything goes: conversations, contacts, the information you approved, sign-in sessions, connection tokens and the search index. Ask for an export before those 30 days end. Two things remain: invoices, which hold amounts and dates and no personal data, because financial records must be kept; and our log of administrative actions.

Checking on us

We answer reasonable questions about this agreement in writing and give you the documents it refers to. We do not offer an inspection on our premises or a third party's report, and we say so plainly.

Last updated

11 October 2026.