Privacy Policy

1. Our Role: Controller and Processor

The role we play depends on whose information it is:

• Website visitors and prospective clients: for information you give us through the Site (contact form, newsletter, booking a call), MabAi is the data controller.
• Our clients' customers: when a business ("Client") uses our Services to automate conversations on its own WhatsApp number, the Client decides why and how its customers' messages are handled, and MabAi acts as a data processor (service provider) on the Client's behalf. If you are a Client's customer and want to exercise your privacy rights, please contact that business first; we will also assist you directly (see Section 12).

2. Information We Collect

A. From visitors to our Site

• Information you provide: When you fill out our contact form, we collect your name, email address, phone number, the service you're interested in, and your message. When you subscribe to our newsletter, we collect your email address. When you book a free strategy call, our scheduling provider (Calendly) collects your name, email, and the details you enter.
• Collected automatically: We use Google Analytics to understand how visitors use the Site (pages viewed, approximate location at country/city level, device type, referral source). We also use the Meta Pixel to measure how our ads perform and to show relevant ads to people who have visited the Site. This is collected via cookies and similar technologies.
• Chat conversations: If you use the AI chat assistant on our Site, the messages you send are processed to generate a response and may be temporarily stored in your browser session to keep the conversation going. If you use our live chat, your messages and any details you enter are stored by our live chat provider so our team can respond.

B. From our Clients

• Account and business details: name, business name, email, phone number, billing information, and team members' login details.
• WhatsApp connection details: your Meta Business portfolio and WhatsApp Business Account identifiers, phone number identifiers, and the access tokens that Meta issues when you authorize us (for example through Meta's Embedded Signup). Access tokens are stored in encrypted form.
• Configuration content you give us: business information, FAQs, product or service details, prices, tone instructions, message templates, and automation rules used to run your assistant.

C. From our Clients' customers (processed on the Client's behalf)

• Phone number and WhatsApp profile name of the person messaging the Client's business number.
• Message content (text, images, audio, documents, and other media), timestamps, and delivery/read status.
• Lead details that the Client sends to us from its own tools (for example name, phone number, and inquiry from a Google Sheet, lead form, or ad campaign), so that we can send a follow-up message on the Client's behalf.
• If the Client connects an existing WhatsApp Business app number and chooses to share it, synchronized contacts and recent chat history, as permitted by Meta's WhatsApp Business app coexistence feature.

3. How We Use Information

• To respond to your inquiries and provide the Services you request
• To send and receive WhatsApp messages on a Client's connected number, generate automated replies, qualify leads, book appointments, and hand conversations to the Client's team
• To operate, secure, troubleshoot, and improve our Services and the Site
• To send you a proposal, quote, invoice, or follow-up related to your project
• To send newsletter updates, if you subscribed (you can unsubscribe at any time)
• To comply with legal obligations and enforce our Terms of Service

We do not sell personal information, and we do not use Clients' customer conversations for our own advertising or marketing.

4. WhatsApp Business Platform and Meta

MabAi uses the WhatsApp Business Platform provided by Meta Platforms, Inc. to connect Clients' business numbers to our automation systems.

• We access a Client's WhatsApp Business Account only after the Client authorizes us, and only for the permissions needed to send, receive, and manage business messages and message templates.
• We do not access personal WhatsApp chats or any number the Client has not connected to our platform.
• Messages sent and received through the platform are also processed by Meta and WhatsApp under their own terms and privacy policies, including the WhatsApp Business Policy and WhatsApp Privacy Policy.
• A Client can revoke our access at any time from our portal, from Meta Business Settings, or by contacting us.

5. AI Processing

To generate automated replies, relevant message content and the Client's configuration content (such as FAQs and business details) are sent to AI model providers, such as Anthropic (Claude) and OpenAI, through their commercial API services. We select API terms under which submitted content is not used to train the provider's general models. AI-generated replies can occasionally be inaccurate; Clients can review conversations and take over any chat at any time.

6. Third-Party Services We Use

We share limited information with the following categories of providers, solely to operate the Site and deliver our Services:

• Meta (WhatsApp Business Platform, Facebook, and Instagram) - message delivery, Embedded Signup, and Meta Pixel for advertising measurement
• AI and voice providers (such as Anthropic, OpenAI, and ElevenLabs) - generating automated text and voice responses
• Cloud hosting and database providers - running our application and storing data securely
• Workflow and integration tools - connecting a Client's own tools (CRM, Google Sheets, calendars) to its assistant
• Google Analytics - website usage analytics
• Calendly - scheduling free strategy calls
• Tawk.to - live chat on our Site; chat messages and basic visit information (such as page viewed and approximate location) are processed to let our team reply
• Our email provider (SMTP) - delivering contact form and newsletter submissions to our team

These providers only receive the information necessary to perform their function and are bound by their own terms and privacy policies. We may also disclose information if required by law or to protect our rights, users, or systems.

7. Data Retention

We retain Site inquiries and related correspondence for as long as reasonably necessary to respond, deliver a project, or as required by law. For Clients, we retain account data and conversation records for as long as the Client's account is active, and delete or return them within 30 days after the account is closed or after a verified deletion request, except where we must keep limited records for legal, tax, or security reasons. Clients can ask us to delete specific conversations at any time.

8. Security

We use reasonable technical and organizational safeguards, including encryption of access tokens and credentials at rest, encrypted connections (HTTPS) in transit, access controls that separate each Client's data from other Clients' data, and limiting staff access to what is needed. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify affected Clients and authorities as required by law.

9. Cookies

The Site uses cookies for analytics and advertising measurement purposes. You can disable cookies through your browser settings, and you can manage ad preferences in your Facebook and Instagram settings, though some features of the Site may not function as intended.

10. Your Rights

Depending on where you're located (including under California's CCPA/CPRA for USA residents, the UAE Federal Personal Data Protection Law, and the GDPR where it applies), you may have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your personal information
• Object to or restrict certain processing, and request a copy of your data
• Opt out of newsletter and marketing communications at any time
• Ask us how your information has been used or shared

To exercise any of these rights, contact us at bilal@mabaisolutions.com. We will respond within a reasonable time and in any case within the period required by applicable law.

12. Requests From Clients' Customers

Because we process your messages on behalf of the business you contacted, that business is primarily responsible for responding to your privacy requests. If you contact us directly, we will help route and fulfill your request in line with the business's instructions and applicable law.

13. Children's Privacy

Our Services are intended for businesses and individuals over the age of 18. We do not knowingly collect personal information from children.

14. International Data Transfers

MabAi Solutions is based in Pakistan and serves Clients internationally, including in the USA and UAE. By using the Site or our Services, you understand that your information may be processed in Pakistan or in the countries where our third-party service providers operate, which may have different data protection laws than your country. Where required, we rely on appropriate safeguards for such transfers.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date, and material changes affecting Clients will also be communicated by email.

16. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

MabAi Solutions
2nd Floor, Room #1, Memoona Square, 13-C, Block 13-C, Gulshan-e-Iqbal, Karachi 74400, Pakistan
Email: bilal@mabaisolutions.com
Phone / WhatsApp: +92 310 7798608