Privacy Policy

Last updated: 2026-10-15

In short

• We do not keep the content of your messages — only that a message was sent, not what it said. The one exception is a business that has turned on the AI assistant: then the conversation is kept for three days and deleted automatically. Separately, where the business has asked for it, we keep for ninety days a dated record of which of its topics, products or sets of questions you asked about, and whether you were passed to its team — it holds no word you wrote.
• We use your information only to give you the service. We do not sell it and we do not use it for advertising.
• You can ask at any time to see, correct or delete your information.
• WhatsApp and Meta carry the messages, and their own privacy policies apply separately.
• Any questions: afkartech@afkartech.app

This policy explains how AFKAR TECH ("Afkar Tech", "we") handles personal information — when you visit afkartech.app, when a business uses our dashboard, and when you message a business that runs on our platform.

1. Who we are

AFKAR TECH, Omar ibn al-Khattab 27, Kafr Kanna. For anything at all, including anything in this policy: afkartech@afkartech.app. Phone +972 55 248 2412.

2. What we collect

From businesses that use Afkar Tech

• Business name, address and the sector you work in.
• A contact name, email address and phone number for each dashboard user.
• Login details. Passwords are never kept in readable form — only a bcrypt hash.
• WhatsApp Business account identifiers and access tokens, encrypted while stored.
• The content you set up: services, opening hours, answers, catalogue items and message templates.
• Billing and payment details, where there is a paid plan.
• Where you have asked us to keep the whole conversation: what your staff type to a customer by hand in WhatsApp, kept for three days with that conversation.

From people who message a business on WhatsApp

• The WhatsApp phone number the message came from, and the WhatsApp profile name attached to it.
• A record that a message was sent or received: its direction, its type, its timestamp, its delivery status and WhatsApp's own message identifier.
• The answers you give to questions the business has set up — such as your name, a contact number, or the service you want.
• The appointments you book and the orders you place, including items, quantities and prices.
• The language the conversation is in.
• Whether you have asked WhatsApp to stop sending you marketing messages from that business. WhatsApp does not tell us directly; we only find out when it stops a message being delivered, and we record it so the business stops trying. It does not affect appointment reminders or a reply to something you asked.
• Notes the business writes about you in its own records. The business decides what it writes; we store it on their instructions, and correcting or deleting it is theirs to do.
• Where the business has asked for it, and only with the AI assistant on: a dated record of your earlier requests — which of the business's own topics, products or sets of questions you asked about, and whether you were passed to its team. The platform notes it from what the assistant did; it holds no word, number or link you wrote. Each line is deleted after ninety days, or sooner if the business deletes it.
• Where the business has asked for it, and only with the AI assistant on: a short profile of you — a few lines on who you are and what you come to the business for, written by a person at the business or saved by them from a draft the assistant suggested. A draft is written from what the platform records about you, not from your words, and is kept only if that person saves it. A profile holds no number and no link.

Where the business has turned on the AI assistant, one thing is different: your conversation with that business is kept for three days, counted from your last message, so the assistant can remember what you have already told it. After three days it is deleted automatically. Where the business has also asked for it, that conversation includes the other side as well: what the business's staff wrote to you by hand, the automatic messages its bot sent in reply to you and the buttons you tapped. They are kept for the same three days and deleted with it. It is used for two things only — answering you, and letting that business check that the assistant answered you well. It is never used to advertise to you and never shared with another business, and if the business turns the assistant off it is deleted straight away rather than waiting out the three days. A voice note is part of that conversation: we turn what you said into text first, and it is that text which is kept for the three days and then deleted.

From visitors to this website

The public pages of afkartech.app set no cookies, run no analytics and load no third-party scripts. The only thing kept in your browser is the language you chose, in local storage, so that the site opens in the same language next time. You can clear it at any time through your browser. Our web servers keep ordinary request logs — IP address, time, the page requested and the browser type — for security and troubleshooting.

3. Why we use it

• To give you the service: send automatic replies, take bookings, send reminders and handle orders.
• To sign dashboard users in and keep accounts secure.
• To tell a business about new leads, appointments and orders.
• To provide support and look into faults.
• To spot and stop abuse, spam and fraud.
• To meet our legal, tax and accounting obligations.
• To make the service more reliable, using combined figures that identify nobody.

We do not sell personal information and we do not use it for advertising. For a business without the AI assistant, conversation content is never written to our database, so nothing is kept for us to use later; it lives in the running application only for as long as it takes to answer, and the one thing it is used for is answering that message. For a business with the AI assistant on, the conversation is kept for three days and used for two things only: answering you, and letting that business check that the assistant answered you well. Where the business has asked for the record of your earlier requests, it is used for the same two things, so the assistant does not ask again what it already knows, and, only where the business has also asked for it, so that a follow-up message after you go quiet can name one of the topics you raised since your last message. One business's data is kept apart from every other business on the platform and is never shared between them.

4. WhatsApp and Meta

Messages are delivered through the WhatsApp Business Platform, run by Meta Platforms, Inc. When a message is sent or received, its content and its metadata pass through Meta's systems and are also handled under Meta's own terms. See the WhatsApp Privacy Policy and the WhatsApp Business Messaging Policy.

WhatsApp requires businesses to message only people who have agreed to hear from them. A business using Afkar Tech is responsible for getting that agreement and keeping a record of it.

5. Our legal basis

Where a legal basis is needed, we rely on: performing a contract, to give a business the service it signed up for; legitimate interests, to keep the platform secure, prevent abuse and support our customers; consent, where you have given it — for example by opting in to messages from a business; and legal obligation, where the law requires us to keep or hand over records.

6. Who we share it with

• Meta Platforms, Inc., to send and receive WhatsApp messages.
• Our hosting and infrastructure providers, for running the application, the managed database and push notifications.
• Professional advisers and public authorities, where the law requires us to disclose.
• OpenAI, currently the only provider of AI language models we use, and for three purposes only: to work out what a customer is asking, to word a reply from an answer the business itself wrote, and to choose which topic of a customer's current visit a follow-up message names — off for every business until we switch it on at that business's request.

We do not pass personal information to any other third party.

What reaches that provider is the customer's message itself — and, where we have conversation context switched on, the earlier messages of that same conversation: the customer's own, the assistant's earlier replies, and, where the business has asked us to keep the whole conversation, what its staff typed by hand, the automatic messages its bot sent and the buttons the customer tapped — together with the answers and service names the business wrote for its own bot. It is used to work out what the customer is asking and, for the answers a business has marked for it, to word the reply from what that business already wrote. Where the business has asked for the record of your earlier requests, its lines go too: which of the business's topics, products or sets of questions you asked about, and roughly how long ago, each one not already in the part of the chat the assistant is shown — so the provider can receive something about you from before the three days; and requests the business has already handled reach back ninety days instead of thirty. Where the business keeps a profile of you, it goes too, with every reply the assistant writes to you; and when the business asks the assistant to draft one, what the platform records about you goes for that draft: the business's own names for what you asked about, requested and booked, your stage with the business and the answers you chose from its options — never your name, your number or anything you typed. We add nothing else to it except our own short notes of how long ago those earlier messages were sent and where one is not shown: no name, no phone number, no contact details, and no identifier for the account or the conversation. Those answers and the hand-typed replies are the business's own text, and an automatic message may repeat back what the customer answered; a name, a phone number or an address may appear in any of them, so we treat them as personal information too. For a follow-up message, where the business has asked for it, only the business's own names for the topics of the customer's current visit go — a request passed to its team, or a topic or product the customer asked about since their last message — and nothing the customer wrote, no name, no number and no identifier. The provider only chooses one of them and one of our fixed sentences; the message is our own wording followed by the business's, and nothing of it is kept.

7. How long we keep it

• Message records — the surrounding details only, not the content: kept while the business's account is active, and deleted according to the retention period the business sets.
• Messages sent to that AI provider: held by the provider for up to thirty days so it can check for misuse, and longer only where the law requires it or it is reasonably necessary to protect its services or another party from harm. They are not used to train its models. Where the business has not turned on the AI assistant they are not written to our database at any stage.
• Conversation content, and only where the business has turned on the AI assistant: three days, counted from your last message to that business, then deleted automatically. Where the business has asked for the whole conversation to be kept, this includes what its staff typed by hand, the automatic messages its bot sent in reply to you and the buttons you tapped. Deleted straight away if the business turns the assistant off.
• The record of your earlier requests, and only where the business has asked for it: ninety days from when each line was last written, then deleted automatically, and straight away if the business turns the assistant, the kept conversation or this option off. The business can delete a line at any time.
• A profile of you, and only where the business keeps one: a year from when it was last saved, then deleted automatically, and straight away if the assistant or the profile option is switched off for the business, if the business changes the number it has for you, or if it deletes the profile. A draft the business did not save is not kept at all.
• Contacts, appointments and orders: while the business's account is active, and for up to twelve months after it closes, unless the business asks us to delete them sooner.
• Notes a business writes about its customers: on the same basis as contacts above, and deleted when the business deletes them or its account.
• Business account records: for the life of the account, and afterwards for as long as tax and accounting law requires.
• Web server logs: a short operational period, then deleted.

8. Security

Traffic is encrypted in transit with TLS. WhatsApp access tokens are encrypted while stored. Passwords are kept only as bcrypt hashes. Every request to the platform is limited to a single business account, and our staff can only reach what they need to run and support the service. No system is perfectly secure and we do not claim otherwise; if a security incident affects you, we will tell you and the relevant authority as the law requires.

9. Your rights

Depending on where you live, you may have the right to see the personal information we hold about you, to have it corrected or deleted, to limit or object to how it is used, to get a copy in a portable form, to withdraw consent you gave earlier, and to complain to your data protection authority.

If you messaged a business on WhatsApp and want your information deleted, please go to that business first: they decide what happens to their contact and booking records, and we act on their instructions. If you come to us instead, we will pass your request on to the business and help them deal with it.

To use a right that concerns data we control, write to afkartech@afkartech.app. We will reply within the time the applicable law allows.

10. International transfers

Meta, our infrastructure providers and our AI provider may process data in countries other than your own. Where information crosses borders, we rely on the safeguards those providers have in place, including standard contractual clauses where they apply.

11. Children

The Afkar Tech platform is a business tool and is not meant for children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, contact us and we will delete it.

12. Changes to this policy

We may update this policy. The date at the top of the page always shows the current version, and we will tell our business customers directly before any significant change takes effect.

13. Contact us

AFKAR TECH, Omar ibn al-Khattab 27, Kafr Kanna. Email afkartech@afkartech.app, phone +972 55 248 2412, or message us on WhatsApp.