Privacy Policy

1. Who we are and our role

Sarai is provided by Sarai Technologies Private Shareholding Company (شركة سراي للتكنولوجيا ش.م.خ), registered in the Palestinian Companies Registry under number 565053154, based in Ramallah, Palestine ("Sarai", "we"). Privacy contact: [email protected]

• Website visitors, account holders and users of the Service: Sarai is responsible for this data (controller).
• Data about a business's customers (messages, contact details and orders that reach the business through Sarai): the business is responsible for this data, and Sarai processes it on the business's behalf and only on its instructions, to provide the Service. If you are a customer of a business that uses Sarai, that business's privacy policy also applies to you, and you can contact the business or us.

2. Data we collect

a) Website visitors: what you type in the chat window on our website (Sarai Chat), including the start form (name, phone, email, business name and type) and your messages. If you contact us on WhatsApp or by email, we receive your number or email, your name and your messages, and use them only to reply to you.

b) Business owners at sign-up: business name, owner name, email, WhatsApp number (optional), business type, city (optional) and the chosen plan. When you pay: the billing entity name, billing contact details, invoices and amounts paid. We do not store payment card numbers.

c) Users of the Service (owner and staff): name, email, role and permissions, teams, account settings, and activity inside the Service (for example changing a conversation's status or assigning it).

d) A business's customers: messages and attachments (images, audio, files) and contact details (name, phone number, account name or username and public profile picture where available, email) that arrive through the channels the business connects, such as WhatsApp, Instagram, Messenger, TikTok, Telegram, website chat and email, or any other channel Sarai offers that the business connects. This includes what the business records about its customers inside the Service: tickets, lead stage, internal notes, labels, and orders, bookings and delivery addresses when commerce or appointment modules are used.

e) Technical data: IP address, browser and device type, sign-in times, and error and security logs, for operation and security.

3. Data we receive from connected platforms

When a business connects a channel, such as Messenger, Instagram or WhatsApp (Meta), TikTok or Telegram, we receive:

• From the business: the page, account, bot or number ID and name, the profile picture where available, and the access tokens needed to send and receive messages. Access tokens are stored encrypted.
• From people who message the business: messages and attachments (such as images and shared posts), the sender's platform ID or phone number, name or username, public profile picture where available, message times, and delivery and read status.

Some platforms give access to more account information than we need, such as account statistics. We do not store or use it.

We use this data only to show the conversations in that business's inbox, send its replies, run Sarai AI if the business turns it on, and keep the Service secure.

We never use data from connected platforms for advertising or retargeting. We never sell, rent or license it, build profiles of individuals, or combine it across businesses. We never use it to train or improve AI models, or for Sarai's own purposes beyond providing the Service. We share it only with the processors in section 7, and only as far as needed.

Disconnecting or revoking access: when a business disconnects a channel in Sarai, or removes Sarai's access in the platform's own settings, we stop receiving data from that channel and its access tokens stop working. Within 30 days we delete the tokens and the conversations received through that channel. We also delete the related contact details, unless the same person also contacted the business through another channel that is still connected. Deleted data leaves our backups within 6 months at most.

4. How and why we use data

• To provide and run the Service: account creation, connecting channels, receiving and sending messages, tickets and leads, notifications. (Performance of our contract with the business)
• To contact you about your account, request, invoices or important changes. (Contract and our legitimate interests)
• Security and prevention of abuse and fraud. (Legitimate interests and legal obligations)
• Product improvement using usage statistics and technical logs only, not the content of business customers' conversations.
• Legal compliance and responding to binding official requests.
• Marketing from Sarai to business owners only, with their consent, which they can withdraw at any time.

We do not sell personal data, do not use it for advertising, and do not use it for automated decisions with legal effects on individuals.

5. Sarai AI

When a business enables Sarai AI, the relevant conversation text and the information the business adds (such as products, prices, FAQs and opening hours) are sent to an AI model provider to generate or suggest a reply, which then returns to the conversation.

• We do not use business customers' data or conversations to train, develop or improve any AI model, and we bind the model provider in writing not to use them for that and to process them only to fulfil the request.
• We send the minimum data needed for each request.
• The business can switch Sarai AI off at any time, and any conversation can be handed to a human agent.
• AI replies can sometimes be inaccurate, so the business decides what Sarai AI knows and reviews its settings.

6. Cookies and browser storage

We use only essential storage:

• Website chat window: a cookie and data in your browser so your conversation continues when you return.
• Sign-in to Sarai Chat and the Sarai Dashboard: session cookies that keep you securely signed in.
• Our security provider: security cookies that protect our sites from attacks and bots.

We do not use advertising cookies or third-party tracking tools. You can delete these from your browser, but your chat or session may end.

7. Processors (service providers)

We work with a small number of trusted service providers, only as far as needed to provide the Service, under terms that require them to protect data and keep it confidential:

• Our hosting and server provider, within the EU (Germany).
• Social media and messaging platforms the business connects, such as WhatsApp, Instagram and Messenger (Meta), TikTok and Telegram, to receive and send messages.
• Security, infrastructure, email and mobile app notification services.
• Our AI model provider, to run Sarai AI when it is switched on.
• Payment providers, to process subscription payments.
• Services the business connects itself (such as delivery companies); we send them only what the business requests.

We update the list of service providers before adding any new provider that processes business customers' data, and the current list is available on request at [email protected]. We may also disclose data where required by law, a court order or a competent authority; to protect the rights and safety of our users and the Service; or as part of a merger, acquisition or investment in the company, in which case this policy continues to apply and we will tell you.

8. International transfers

Data is stored on servers in Germany (EU), so data of users and customers from Palestine and the region is transferred to the EU. Some service providers, such as messaging platforms and infrastructure and AI services, may process data in the United States and other countries within their networks. These transfers rely on the safeguards those providers offer, such as Standard Contractual Clauses or the EU–US Data Privacy Framework where applicable.

9. Retention

• We keep account data, conversations and contacts while the account is active.
• If the free month or a subscription ends without renewal, the account stays active for a 7-day grace period, then is paused; we keep its data for 30 days, then delete it.
• We delete data within 30 days of account closure or a deletion request, unless the law requires us to keep it longer.
• When a business disconnects a channel or removes Sarai's access in the platform's settings, we delete that channel's data within 30 days, as described in section 3.
• We keep technical and security logs for 90 days.
• We keep invoice and payment records for the period the law requires.
• Backups rotate automatically; deleted data disappears from them within 6 months at most.

10. Security

We encrypt connections between your browser or app and our servers (HTTPS), encrypt stored channel access tokens, separate each business's data with separate permissions, offer two-step verification to every user, limit server access to a small number of Sarai staff, and take daily backups.

Sarai staff access a business's account only to provide support it asks for, when necessary to protect the Service or investigate abuse, or when the law requires.

No system is 100% secure. If a breach affects your data, we will tell you without undue delay (our target is within 72 hours of confirming it) and notify authorities where the law requires.

11. Your rights

You can ask to access, correct, delete or receive a copy of your data, to object to or restrict its processing, or to withdraw consent where processing relies on consent, by writing to [email protected]. We reply within 30 days and may ask you to verify your identity first.

A business's customers can contact the business directly or us; we will inform the business and help it fulfil the request. Deletion details are on the Data Deletion page. You may also complain to the data protection authority in your country, where one exists.

12. Children

The Service is for businesses, and its users must be at least 18. We do not knowingly collect children's data directly from them and will delete it if we learn we have. Each business is responsible for complying with laws that protect children among its customers.

13. Changes

We may update this policy. We will post the new date here and email account holders about any material change before it takes effect.

14. Contact

Privacy and data: [email protected]
Sarai Technologies Private Shareholding Company · Companies Registry no. 565053154 · Ramallah, Palestine