This Privacy Policy explains how Rafeeq handles personal data when you visit rafeeq.cloud, apply for the Service, use the dashboard, or message a business that uses Rafeeq on WhatsApp. We designed Rafeeq to collect as little as possible and to protect what it holds.
1. Who is responsible
- For website visitors, applicants and dashboard users, Rafeeq is the controller of your personal data.
- For people who message a business on WhatsApp, that business is the controller. Rafeeq processes those conversations only on the business's instructions, as its service provider (processor). If you messaged a business, please contact that business first about your data; we will help them respond.
2. Data we collect
- Applications: business name, type, city, country, website, your name, email, phone, chosen plan, message volume, your note, the date you accepted our terms, IP address and browser type (to prevent spam).
- Accounts: name, email, role, language and email preferences, a salted scrypt hash of your password (never the password itself), an encrypted two-step verification secret and hashed recovery codes if enabled, sign-in times, IP addresses and device type, and an audit log of security-relevant actions.
- Billing: plan, fees, payment dates, amounts, method and reference.
- WhatsApp conversations (processed for the business): the sender's WhatsApp number and profile name, message text, images and interactive replies, detected language/dialect, appointments, and lead details the assistant notes from the conversation (e.g. interest, budget, timeline), plus delivery statuses.
- Emails: we log the recipient, template, time and delivery status of emails we send — never their content, so passwords and reset links are not stored.
- Security signals: spam, flood and abuse events (time, type, number) used to protect businesses from attacks and unwanted costs.
3. Why we use it (and our legal bases)
- To provide the Service — run the assistant, bookings, dashboards and reports (performance of our contract with the business).
- To review applications and onboard customers (steps at your request before a contract).
- To keep accounts and the platform secure, prevent fraud, spam and abuse, and debug problems (legitimate interests; legal obligations).
- To send service and security emails such as invitations, password resets, sign-in alerts, receipts and billing notices (contract; legitimate interests). Optional reports can be turned off in your account.
- To keep financial records and comply with law (legal obligation).
4. How the AI uses conversations
To write a reply, the relevant conversation and the business's information are sent securely to our AI model provider. The provider processes it to generate the response under commercial terms that do not allow it to use the data to train its models.
The assistant does not make decisions with legal or similarly significant effects about anyone. It can be asked at any time to connect you with a human, and businesses can take over any chat.
6. International transfers
Some providers (such as Meta, Anthropic and Cloudflare) process data in other countries, including the United States and the European Union. Where required, we rely on appropriate safeguards such as contractual commitments, and we only use providers with strong security practices.
7. How long we keep it
- Conversations, contacts and appointments: while the business's subscription is active, then deleted within 30 days after it ends (backups roll off within a further 14 days).
- Daily encrypted backups: 14 days.
- Email delivery log: 12 months. Security/abuse events: 6 months. Audit log: 24 months.
- Applications that are not approved: 12 months, then deleted.
- Billing records: as long as tax and accounting laws require.
8. How we protect it
- Encryption in transit (HTTPS/TLS with HSTS) and encryption at rest for WhatsApp access tokens and two-step verification secrets (AES-256-GCM).
- Passwords hashed with scrypt; optional two-step verification with authenticator apps; account lockout and rate limiting; alerts for new sign-ins.
- Strict tenant isolation — each business can only reach its own data; staff roles with least privilege; full audit log.
- Hardened, read-only application container; secure, HttpOnly cookies; CSRF and content-security protections.
- An abuse shield that blocks spam floods, repeated messages and manipulation attempts before they reach the AI.
10. Your rights
Depending on where you live — including under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law and, where applicable, the EU/UK GDPR — you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent.
To exercise these rights email [email protected]. We will respond within 30 days and may need to verify your identity. If you messaged a business on WhatsApp, contact that business — we will assist it. You may also complain to your local data-protection authority.
11. Children
The website and dashboard are for businesses and are not directed at children under 18. We do not knowingly collect children's data through them.
12. Changes & contact
We may update this policy and will change the effective date above; material changes will be announced to account administrators. Questions or requests: [email protected].