Privacy Policy

1. Data we collect

• Website visitors: name, mobile number, organization, email and industry when you fill in the contact form, plus basic technical data such as IP address and browser type for security.
• Account holders and teams: name, email and password (stored with one-way hashing), and basic profile data when you sign up with Google.
• Organization content: the files, images, website pages and instructions you teach the agent.
• Conversations and customer data: messages, voice notes (and their transcripts), images and files, contact details, bookings, orders and payment status, and comments on your pages.
• Connected-system data: products and orders from your store, and the data you choose to share from Google Sheets, databases, Odoo or hotel systems — read only, never changed.
• Billing data: your plan, payment history and any transfer receipts you upload. We do not store card details; they are processed by Paymob.
• Usage data: the pages you open in the platform and the actions you take, kept in an audit log for security, support and product improvement (this never includes Google user data).

2. How we use data

• To provide the service: running the AI agent and replying to customers, and managing conversations, bookings, payments, campaigns and reports.
• To manage your account, subscription and billing, and to send important notifications such as alerts and the weekly report (which you can switch off).
• To contact you when you ask us to through the contact form.
• To secure the platform, prevent abuse and fraud, and meet our legal obligations.
• To improve the platform using aggregated usage data — never Google user data, and never to train AI models. We never sell your data or your customers' data.

3. AI and AI providers

To generate replies, transcribe voice notes, understand images and search your organization's knowledge, we send the necessary parts of conversations and knowledge to the AI model providers we work with through their business APIs, such as OpenAI, Anthropic and Google (Gemini). These providers process the data under their business API terms. We send only what the task needs and never send passwords or encrypted integration keys.

These providers do not use the data we send to train their models, and we do not use your data, your customers' data or Google user data to train generalized AI or ML models.

4. Google user data (Limited Use)

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Aref's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: only what the user connects — basic profile data (name and email) for Google sign-in, and the Google Sheets the user explicitly links, to read their data and, if they enable it, to write their leads to their own sheet.
• How we use it: only to provide the features the user asked for, and only for that same user and organization.
• No AI/ML training: we do not use or retain Google Workspace data — raw, aggregated or derived — to develop, improve or train generalized or foundational AI and/or ML models, whether our own or any third party's. When a user asks the data assistant a question, only the part needed to answer that user's own question is sent to our AI model provider, under API terms that prohibit the provider from using it for training.
• We do not sell Google user data or use it for advertising, and we do not transfer it to third parties except as necessary to provide the feature, to comply with law, or as part of a merger or acquisition with notice to users.
• No human reads it unless the user gives explicit permission, it is needed for security or legal reasons, or it is aggregated and anonymized for internal operations.
• Retention and control: sheet data is kept only while the sheet is linked and is deleted when the user removes the sheet, disconnects Google or requests deletion. Users can disconnect Google inside Aref at any time and revoke access at myaccount.google.com/permissions.

5. Who we share data with

• The messaging platforms you connect (Meta, TikTok, Telegram) to send and receive messages.
• Service providers we rely on to run the platform — such as hosting, email, AI providers, the Paymob payment gateway, Google and store platforms — only as needed to provide the service.
• Competent authorities when required by law or court order.
• An acquirer or partner in a merger or acquisition, who must respect this policy.

6. How we protect data

• Each organization's data is isolated from every other organization's at the database and search level.
• Channel, store, payment-gateway and database keys are stored encrypted and never returned through the API.
• Passwords are stored with one-way hashing, permissions are set per teammate, and sensitive actions are recorded in an audit log.
• Database and Odoo connections are read-only, and transfer receipts are kept in private storage that is not publicly accessible.

No method of transmission or storage is 100% secure, but we apply reasonable measures to protect your data and will notify you without undue delay if a breach affects you.

7. Data retention

We keep your account data and conversations for as long as your account is active. When you close your account we delete or anonymize your data within 30 days of your request, except what the law requires us to keep, such as billing records. We keep website contact-form data as long as needed to get back to you, and you can ask us to delete it at any time.

8. Your rights

• Access your personal data and get a copy of it.
• Correct or complete inaccurate data.
• Ask us to delete your data or restrict its processing, and object to its use for marketing.
• If you are a customer of an organization that uses aref.ai, contact that organization directly to exercise your rights and we will help it respond. You can stop WhatsApp campaign messages by replying "stop".

To exercise any of these rights, email info@aref.ai and we will respond within 30 days.

For step-by-step deletion instructions, see our Data Deletion page at aref.ai/en/data-deletion.

9. Cookies

Our website uses strictly necessary cookies to run your session and protect forms; we use no advertising cookies.

To count visits and learn which pages help and how many people sign up or contact us, we use Plausible Analytics, which uses no cookies and collects no personal data, and Google Analytics, which uses cookies to measure visits in aggregate. We do not use this data for advertising, and you can block Google Analytics cookies in your browser settings or with Google's opt-out add-on.

Fonts are loaded from Google Fonts, which means your IP address reaches Google when the page loads. The platform uses secure cookies to keep you signed in, and if you arrive through a partner's link it keeps the partner's code in a cookie for 30 days so the partner is credited when you sign up.

10. International transfers

Some data may be processed or stored by service providers outside the Arab Republic of Egypt, such as AI, hosting and messaging providers. We only work with providers that apply appropriate safeguards.

11. Children

The platform is intended for businesses, and we do not knowingly collect data from anyone under 18 to create accounts.

12. Changes to this policy

We may update this policy from time to time. We will publish the updated version here with its last-updated date and notify you of any material change by email or in your account.

13. Contact

For any question or request about your privacy, email info@aref.ai or call +20 109 999 8021.