Privacy Policy
Committed to safeguarding the privacy and personal data of merchants, their end-customers, and partner platforms with absolute transparency, encryption, and regulatory compliance.
1. Data Architecture & Regulatory Roles
Under international privacy frameworks (GDPR Article 28, Saudi PDPL, and Egyptian Data Protection Law No. 151 of 2020):
- Merchant as Data Controller: The merchant controls the relationship with their prospective buyers, determining the categories of products offered and the business purposes of customer communication.
- Rad Zaki as Data Processor: Rad Zaki acts strictly as a technology processor, executing automated conversations, RAG indexing, and order generation solely on behalf of and according to instructions from the merchant.
2. Categories of Data Processed
Customer Conversations & Inquiries
Message transcripts transmitted via WhatsApp, Instagram Direct, and Messenger, processed in real time to generate accurate product recommendations and sales replies.
Store Knowledge & Inventories
Product specs, catalogs, and business documents uploaded by the merchant to ground the AI sales agent and prevent hallucinated pricing.
Platform Scoped Identifiers
Phone numbers and platform IDs necessary to preserve multi-turn dialogue context and respect customer takeover states.
Zero Raw Card Data (PCI-DSS)
We NEVER collect, process, or store raw credit/debit card numbers, CVVs, or cardholder PINs. All payments are handled securely via PCI-DSS Level 1 compliant Stripe checkout sessions.
3. Security, Encryption & PII Sanitization
Security is engineered into every layer of Rad Zaki:
AES-256-GCM At-Rest
All merchant API secrets (Meta tokens, Stripe keys, HubSpot tokens) are encrypted in MongoDB using AES-256-GCM with salted PBKDF2 derivations.
In-Transit TLS 1.3
All web traffic and API integrations use modern HTTPS with HSTS preloading, strict origin isolation, and automated DDoS protection.
Pre-AI PII Sanitizer
Our privacy engine automatically scrubs accidental card numbers, CVVs, and national IDs from customer text before dispatching to external LLM providers.
4. Meta WhatsApp Business Policy & Automated Opt-Out
In strict alignment with WhatsApp Business Messaging Policies and consumer protection regulations:
- Instant Opt-Out (STOP / UNSUBSCRIBE): When an end-customer texts "STOP", "UNSUBSCRIBE", "إيقاف", or "إلغاء الاشتراك", our system immediately marks the contact as opted-out, confirms the unsubscription, and halts automated marketing.
- Campaign Exclusion: Broadcast campaigns automatically filter out any opted-out contact, guaranteeing that customers who withdraw consent never receive unsolicited messages.
- Meta Webhook Integrity: Webhook events are validated against Meta’s HMAC-SHA256 signature (`x-hub-signature-256`) to protect against spoofing and forged message injections.
5. Your Privacy Rights (GDPR, CCPA & Saudi PDPL)
Right to Access & Portability
Merchants can export all store files, product listings, and conversation logs in structured JSON format anytime.
Right to Erasure (Right to be Forgotten)
Merchants can delete their account permanently via self-service, triggering cascade deletion of all tenant data across databases.
End-Customer Data Deletion
End-customers can text "Delete my data" or "امسح بياناتي" in chat, automatically anonymizing their customer record and ceasing processing.
Zero Data Monetization
We never sell, rent, monetize, or broker merchant or customer data to advertisers, data aggregators, or unauthorized third parties.
6. Meta Platform Data Deletion Instructions
According to Meta Platform Rules, we provide a transparent procedure for users to remove their Facebook/Instagram messaging records:
- Log in to your Facebook / Instagram account.
- Navigate to Settings & Privacy > Settings.
- Click on Apps and Websites to view connected applications.
- Select Rad Zaki and click Remove.
- To request immediate deletion of all past messaging logs from our database, email our data desk at
privacy@rad-zaki.techor use the account deletion button in your dashboard.