Privacy Policy — Owasel (WaselProAI)

Effective: 20 September 2026 · Operator: Nuzum Tech (operating as Owasel / WaselProAI), Ireland (EU) · Contact: [email protected]

1. What this service does

Owasel is an AI sales assistant for social-commerce merchants in Iraq. It reads customer messages sent to a merchant's connected Facebook Page, Instagram Professional account, or WhatsApp number, and drafts replies, product answers, and order drafts for the merchant. The merchant — not Owasel — is the seller of record.

2. Data we process

• Customer messages: text, images/voice notes you send to a merchant's Page, Instagram account, or WhatsApp number (message content, sender IDs, timestamps).
• Order details you provide: name, phone number, delivery address, ordered items — only when you place an order with the merchant.
• Merchant account data: business name, connected Page/Instagram/phone IDs, product catalog, business rules.
• Technical logs: message IDs, model token counts, latency, delivery status — used for billing, debugging, and abuse prevention.

We do not collect payment card data (payments run via Stripe or the merchant's local rails), passwords, or location beyond the delivery address you provide.

3. Why we process it (lawful bases, GDPR)

• Contract: providing the merchant's customer-service and ordering functionality.
• Legitimate interests: AI assistance quality, fraud/abuse prevention, billing accuracy.
• Consent: marketing messages, where applicable.

4. Subprocessors

• Supabase (EU region) — database, auth, storage.
• Google (Gemini AI, EU endpoint) — message understanding and reply drafting.
• Meta Platforms — Messenger / Instagram / WhatsApp message transport.
• Cloudflare — hosting and edge delivery.
• Stripe (Ireland, EUR) — merchant billing.

5. Retention

• Messages: 24 months, then anonymized.
• Media source URLs: purged after 30 days (private archived copies per merchant need).
• AI run prompts: 12 months, admin-only, then hashed.
• Billing/security audit logs: retained as legally required, append-only.

6. Your rights — access, correction, deletion

Under GDPR (and as an Meta platform user) you may request a copy of your data, correction, or deletion at any time:

• Meta/Facebook/Instagram users: email [email protected] from any address with the subject "Data deletion request" and include: (a) which merchant's Page/Instagram/WhatsApp you messaged, (b) your sender ID or phone number if known, (c) what to delete (messages only, or everything including order records). This page is our designated data-deletion instructions URL.
• Merchants: same address with your merchant name; merchant deletion enters a 30-day grace period, then hard-deletes catalog, conversations, customers, and media (audit hashes retained).

We confirm receipt within 72 hours and complete deletion within 30 days, and we notify you when done. Deletion is logged in an append-only audit trail (hashed identifiers only).

7. International transfers

Primary processing is in the EU (Ireland). Where a subprocessor processes data outside the EU/EEA (e.g. AI inference, message transport), transfers rely on adequacy decisions or Standard Contractual Clauses in our processor agreements.

8. Children

The service is a business tool for merchants; we do not knowingly process children's data. Deletion requests concerning minors are prioritized.

9. Changes

Material changes to this policy are announced to merchants 14 days in advance; the effective date above is updated accordingly.

10. Contact & complaints

Questions or requests: [email protected]. EU residents may also complain to their national supervisory authority (Ireland: the Data Protection Commission, dataprotection.ie).

ملخص: نستخدم رسائلك مع التاجر للرد وخدمتك فقط، ونحذف بياناتك خلال 30 يوماً عند طلبك عبر [email protected].