Privacy Policy

1. Who we are

Jwab ("Jwab", "we", "us") provides an AI-assisted conversation management platform. We are based in the Arab Republic of Egypt. This policy covers our website at jwab.ai, our application at app.jwab.ai, and the APIs and background services behind them.

It explains what we do with personal data, and it applies both to the businesses that subscribe to Jwab ("you") and to the people whose messages pass through it. We handle personal data in line with Egypt's Personal Data Protection Law (Law No. 151 of 2020), the other data protection laws that apply to us, and Meta's Platform Terms and Developer Policies.

2. Two kinds of data, two different roles

This is the most important distinction in this policy, so we put it first.

Your account data - we decide how it is used

When you sign up, we hold your name, work email, company details and billing information because we need them to give you an account, bill you and support you. For this data we act as the data controller.

Your customers' messages - you decide how they are used

Everything that flows through your inbox - the messages your contacts send you, the replies your team sends back, phone numbers, profile names, attachments and the notes and tags you add - belongs to you. We hold and process it as your service provider (a data processor), acting on your instructions, so that the product works.

We do not decide why those conversations happen, what is said in them, or who you message. You do.

3. What we collect

• Account and company information: name, email address, password (stored hashed, never in readable form), phone number, company name, logo, language and role.
• Channel connection data: the access tokens, account and phone number identifiers and permissions that let Jwab connect to WhatsApp Business, Instagram or Messenger on your behalf - see section 5.
• Conversation data: message content, attachments, voice notes, sender names and phone numbers or account IDs, timestamps and delivery status.
• Knowledge base content: the documents, answers and instructions you upload for the assistant to use.
• Usage and technical data: IP address, browser and device type, pages used, actions taken, and error reports collected to diagnose faults.
• Billing data: plan, invoices and payment status. Card details are handled by our payment provider; we never see or store full card numbers.

4. How we use it

We use data to deliver and secure the service, and for nothing unrelated to it:

• To operate your inbox: send, receive, route, search and display conversations.
• To run the AI features you have enabled - see section 7.
• To authenticate users, apply permissions and keep an audit trail of sensitive actions.
• To detect abuse, fraud and outages, and to fix bugs.
• To bill you and provide support.
• To send service notices. Marketing email is separate and you can opt out at any time.

We process personal data only for these purposes and on the legal bases the law provides: to perform our contract with you, to meet a legal obligation, for our legitimate interest in keeping the service secure, or with consent where the law requires it.

We do not sell personal data, and we do not share your customers' conversations with advertisers.

5. Data from Meta platforms

When a business connects Facebook, Instagram, Messenger or WhatsApp to Jwab - through Facebook Login, Facebook Login for Business, WhatsApp Embedded Signup or by entering its own credentials - we receive data from Meta ("Platform Data"). This section explains how we handle it, in line with Meta's Platform Terms and Developer Policies.

What we receive

• Business and account identifiers: business, WhatsApp Business account, Facebook Page and Instagram account IDs, phone number IDs and display phone numbers.
• Access tokens and the permissions granted to Jwab.
• Profile information of the connected business accounts, such as name, picture and verification status, and a number's quality rating, messaging limits and message templates.
• Messages and their status: the content and attachments of messages exchanged with the business, the sender's name and phone number or account ID as Meta provides them, and delivery and read status.

How we use it

We use Platform Data only to provide Jwab to the business that connected the account: to show and send its messages, route them to the right team, run the features it enables (including the AI features in section 7), keep its channel connected and healthy, and secure the service.

What we never do with it

• We do not sell, license or purchase Platform Data.
• We do not use it for advertising, or to build or enrich profiles of people for advertising or any other purpose unrelated to the service.
• We do not make it available to data brokers, or place it in search engines or directories.
• We do not use it to make eligibility decisions about people - such as for housing, employment, insurance, education, credit or government benefits - or to discriminate against anyone.
• We do not use it for surveillance, or to infer sensitive characteristics such as health, religion, political opinions or sexual orientation.
• We do not use it to train AI models.
• We do not attempt to re-identify people from de-identified or anonymised data.

Sharing, retention and deletion

We share Platform Data only with the service providers in section 8, under written agreements that protect it at least as strongly as this policy, and with Meta where that is needed to send messages or where Meta's terms require it. We keep it only for as long as it is needed to provide the service to the business, and we delete it when it is no longer needed, when the person or business it concerns asks us to (see section 11 and our Data Deletion page), when Meta asks us to, or if we stop operating the service.

You can also remove Jwab's access at any time in your Facebook, Instagram or WhatsApp Business settings - see our Data Deletion page. Meta's handling of your data is covered by the Meta Privacy Policy and the WhatsApp Privacy Policy.

6. Your responsibilities

By using Jwab you confirm that:

• You have a lawful basis to message the people you message, and you have the opt-in that the law and the platform require. On WhatsApp, the opt-in must make clear that people will receive messages from your business on WhatsApp.
• You send marketing and campaign messages only to people who have agreed to receive them, clearly identify your business in them, and offer an easy way to opt out, as Egypt's Personal Data Protection Law and the WhatsApp Business Messaging Policy require. You honour opt-out and block requests promptly.
• You are responsible for what is said in your conversations, including messages sent by your team members and messages sent automatically by the assistant on your behalf.
• If you use automatic replies, people can easily reach a person on your team.
• You will comply with the rules of the channels you connect, including the WhatsApp Business Terms of Service, the WhatsApp Business Messaging Policy, the WhatsApp Commerce Policy and Meta's terms. Those platforms may suspend your account for breaches, and we cannot restore access on their behalf.
• You will not use Jwab to send unlawful, deceptive, harassing or unsolicited bulk messages.
• You will not ask people to share full payment card numbers, financial account numbers, national ID numbers, passwords or other sensitive identifiers through messaging channels, and you will avoid putting health records or similarly sensitive information into messages or your knowledge base.
• You will answer your own contacts when they ask about their data. You are their point of contact; we will help you locate, export or delete what we hold.
• You will keep your login credentials and channel access tokens confidential, and tell us promptly if you believe an account has been compromised.

If the law requires a written data processing agreement between us before we handle your customers' personal data, contact us and we will put one in place.

7. AI and automatic replies

Jwab uses AI models to make conversations easier to handle. Depending on the features enabled for your account, message content and knowledge base content may be processed to:

• search your knowledge base for a relevant answer;
• draft or send a reply;
• transcribe voice notes into text;
• summarise a conversation, detect sentiment or suggest a better phrasing.

Some of this processing happens on our own infrastructure, and some uses third-party AI providers under contract. Those providers process the content only to return a result to us, and their terms do not allow them to use it to train their models. We do not use your content or Platform Data to train AI models either.

8. Who else sees it

We share data only with providers who help us run the service, and only as far as they need to:

• Messaging platforms (Meta - WhatsApp, Instagram, Messenger): to deliver and receive your messages, and where Meta's terms require us to give it information about how its platforms are used through Jwab. Meta's own terms and privacy policies apply to that delivery.
• Hosting and infrastructure providers: to store and run the application and its databases.
• AI providers: to process the requests described in section 7.
• Error monitoring and real-time messaging services: to detect faults and keep your inbox live.
• Payment provider: to take payment and issue invoices.

Every provider is bound by a written agreement that requires it to protect the data and to use it only to provide its service to us. We never sell personal data or Platform Data.

We may also disclose data if the law or a competent Egyptian authority requires it, or to establish or defend legal claims. If Jwab is ever acquired or merged, data may transfer with the business; we will tell you before that changes anything material about how it is handled.

9. How long we keep it

• Conversation data: for as long as your account is active, because it is your history and you need to be able to look it up.
• Account data: for as long as your account is active, and afterwards only as long as we need it for legal, tax and accounting duties.
• Platform Data: only for as long as it is needed to provide the service to the business that connected it - see section 5.
• Logs and error reports: for a limited period, then deleted or aggregated.

When you delete your account, or when a person or business asks us to delete their data, we delete or anonymise it within 30 days of confirming the request, as described on our Data Deletion page. Backups are cycled out on their own schedule, so a copy may persist there for a short period before it is overwritten.

10. Security

We protect data in transit with encrypted connections, store passwords hashed, encrypt channel access tokens at rest, restrict access to production systems to the people who need it, separate each customer's data by tenant, and monitor for errors and abuse.

No system is perfectly secure. If a breach affects personal data, we will notify Egypt's Personal Data Protection Center and the people affected as Egyptian law requires, notify Meta where the breach involves Platform Data, and notify other authorities where their laws apply.

11. Your rights

Under Egypt's Personal Data Protection Law, and other laws such as the EU/UK GDPR where they apply to you, you have the right to know what personal data we hold about you and to access it; to have it corrected, updated or completed; to have it deleted; to object to or restrict its processing; to withdraw consent you previously gave; to be told about a breach that affects it; and, where the law provides it, to receive a copy in a portable format.

To use any of these rights, email [email protected] or follow the steps on our Data Deletion page. We respond within the period the law requires.

If you are a customer of a business that uses Jwab and you want your messages accessed or deleted, please contact that business directly - they control the conversation, and we act on their instructions. If you contact us instead, we will forward your request to them.

You can also complain to Egypt's Personal Data Protection Center, or to the data protection authority where you live.

12. Cookies

Our website and application use only the cookies and local storage needed to make them work: keeping you signed in, remembering your language and theme, and protecting forms against cross-site request forgery.

We do not use advertising cookies or third-party tracking pixels. You can clear or block cookies in your browser, but you will not be able to stay signed in to the application without them.

13. International transfers

Jwab is based in Egypt, and some of our providers - for hosting, AI and messaging - process data in other countries. Egypt's Personal Data Protection Law allows personal data to be transferred abroad only under conditions, so we transfer it only as that law allows and with the safeguards it requires, including contractual commitments from the provider concerned. Where other laws such as the GDPR apply, we rely on the transfer mechanisms they provide.

14. Children

Jwab is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child's personal data has reached us, contact us and we will remove it.

15. Changes to this policy

We may update this policy as the product changes. The date at the top always shows the current version. If a change materially affects how we handle personal data, we will tell account holders by email or in the application before it takes effect.

16. Contact us

Jwab is based in the Arab Republic of Egypt. For questions about this policy or the data we hold, or to use your rights: [email protected].

Please write "Privacy" in the subject line so it reaches the right people quickly.