Privacy Policy

We collect information from two types of users:

A. Business Owners (Our Customers)

When you create an account and use our Service, we collect:

• Account information: Your Gmail address, display name, and profile information provided by Google during sign-in. We use Google OAuth 2.0 for authentication — we never see or store your Google password.
• Business information: Business name, tagline, location, working hours, timezone, products and services, pricing, shipping policies, refund policies, contact information, social media links, language preferences, and AI behavior settings that you provide during onboarding.
• Payment information: Subscription plan selection and billing history. Payment card details are handled entirely by Paddle (our payment processor) and never touch our servers.
• Usage data: Message counts, feature usage, and analytics data related to your use of the Service.
• Marketing attribution: If you arrive at our website from an advertisement, we may collect the referring source (such as UTM parameters and ad platform click identifiers) to measure advertising effectiveness. This data is stored in a first-party cookie for up to 90 days.

B. End Customers (Your Customers on WhatsApp)

When someone sends a WhatsApp message to a business using our Service, we collect:

• Contact information: Phone number and WhatsApp display name, as provided by the WhatsApp platform.
• Message content: The text of messages exchanged during the conversation. Messages are stored in a rolling 12-hour window and older messages are automatically purged.
• Audio transcriptions: If a customer sends a voice message, we transcribe it to text using AI services. The original audio file is NOT stored — only the transcription text.
• Location data: If a customer shares their location, we store the coordinates and resolved address for service delivery purposes.
• Order information: If a customer places an order through the chat, we store the order details (products, quantities, delivery address).

We use collected information for the following purposes:

• Service delivery: To provide AI-powered customer service responses, process orders, and manage business-customer conversations.
• Authentication: To verify your identity using Google OAuth.
• Billing: To process subscription payments through Paddle.
• AI processing: To classify customer messages and generate appropriate responses using artificial intelligence.
• Analytics: To provide business owners with usage statistics and performance metrics.
• Communication: To send service notifications, alerts, and important updates about your account.
• Security: To detect and prevent fraud, unauthorized access, and abuse.
• Advertising measurement: To measure the effectiveness of our marketing campaigns by tracking which advertising sources lead to paid subscriptions (server-side only, no client-side ad tracking pixels are used for user profiling).

We share data with the following third-party services to provide the Service. Each service receives only the minimum data necessary for its function:

A. Meta (WhatsApp Cloud API)

• Purpose: Sending and receiving WhatsApp messages.
• Data shared: Message content, phone numbers, media files.
• Their privacy policy: whatsapp.com/legal/privacy-policy

B. Google (OAuth 2.0)

• Purpose: User authentication (sign-in).
• Data received: Gmail address, display name.
• Their privacy policy: policies.google.com/privacy

C. Paddle (Payment Processing)

• Purpose: Subscription billing and payment processing.
• Data shared: Email address, subscription plan selection.
• Note: Paddle acts as the Merchant of Record. Payment card details are handled entirely by Paddle and never reach our servers.
• Their privacy policy: paddle.com/legal/privacy

D. Google (Gemini AI)

• Purpose: AI message classification, response generation, and audio transcription.
• Data shared: Message text content (not phone numbers or personal identifiers).
• Their privacy policy: policies.google.com/privacy

E. OpenAI

• Purpose: Backup AI processing when the primary AI service is unavailable.
• Data shared: Message text content (not phone numbers or personal identifiers).
• Their privacy policy: openai.com/privacy

F. Anthropic (Claude)

• Purpose: Future AI processing capability.
• Data shared: Message text content when active (not phone numbers or personal identifiers).
• Their privacy policy: anthropic.com/privacy

G. OpenStreetMap (Nominatim)

• Purpose: Converting GPS coordinates to readable addresses when customers share their location.
• Data shared: GPS coordinates only (no personal identifiers).

H. Telegram (Bot API)

• Purpose: Sending operational notifications to business owners and platform administrators (optional — users choose to connect Telegram).
• Data shared: Alert messages only (no customer data).

I. Advertising Platforms (Facebook/Meta, Google Ads, TikTok)

• Purpose: Reporting subscription conversion events for advertising measurement.
• Data shared: Hashed email address, transaction value, and ad click identifiers. Sent server-side only when a paid subscription is created. No browsing behavior or personal profiles are shared.

Important: API usage with AI providers (Google Gemini, OpenAI, Anthropic) is through their commercial API programs. Under their current API terms, data sent through the API is NOT used to train their AI models.

Our servers are located in Europe (Germany). Data is stored as follows:

• Account information: Retained for the lifetime of your account. If you delete your account, your data is anonymized within 30 days (see Data Deletion section).
• Business onboarding data: Retained while your account is active. Deleted when you delete your account.
• WhatsApp messages: Stored in a rolling 12-hour window. Messages older than 12 hours are automatically purged from our system.
• Customer records: Retained while the business account is active. When a business deletes their account, customer records are anonymized (personal details replaced with hashed values).
• Orders: Order records are retained for financial compliance purposes even after account deletion, but all personal identifiers are anonymized.
• Audit logs: Operational logs are retained permanently for security and compliance purposes. These logs contain action descriptions but not message content.
• Free plan accounts: Automatically deleted after 30 days of inactivity.
• Paid plan accounts: Retained until the business owner deletes their account or requests deletion.

We use a minimal number of cookies:

• Session cookies (Essential): Used to keep you logged in. These are HTTP-only secure cookies that cannot be accessed by JavaScript. They expire after 15 minutes (access token) and 7 days (refresh token).
• Attribution cookie (Marketing): If you arrive from an advertisement, we store the referring source in a first-party cookie for up to 90 days. This helps us measure advertising effectiveness. This cookie does not track your browsing on other websites.

We do NOT use third-party tracking cookies. We do NOT use cookies for advertising profiling. For more details, see our Cookie Policy at nistabli.com/cookies.

We implement the following security measures:

• All data in transit is encrypted using HTTPS/TLS.
• Sensitive credentials (such as WhatsApp API tokens) are encrypted at rest using AES-256 encryption.
• Database access is controlled through Row-Level Security, ensuring each business can only access its own data.
• Staff access to business data is controlled through role-based access control with 7 permission levels.
• All administrative actions are recorded in an immutable audit log that cannot be modified or deleted.
• Staff sessions are limited to 8 hours with mandatory re-authentication.

Depending on your location, you may have the following rights:

• Access:Request a copy of your data. Available via the "Export my data" button in your account settings.
• Deletion:Request deletion of your account and associated data. Available via the "Delete my data" button in your account settings. See our Data Deletion Policy at nistabli.com/data-deletion for details.
• Correction: Update your business information at any time through the onboarding form.
• Portability: Export your data in a machine-readable format (JSON).
• Objection: Contact us at support@nistabli.com to object to specific data processing activities.

For end customers (WhatsApp users): If you are a customer who has communicated with a business through our Service, you may request access to or deletion of your data by contacting the business directly, or by emailing us at support@nistabli.com with the phone number and business name.

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information.

Our servers are located in Europe (Germany). If you access the Service from outside the European Economic Area, your data may be transferred to and processed in Germany. AI processing services (Google Gemini, OpenAI, Anthropic) may process data in the United States. By using the Service, you consent to these transfers.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us:

• Email: support@nistabli.com
• Address: Casablanca, Morocco
• Website: nistabli.com