- Home
- Privacy Policy
Privacy Policy
What we collect, why, where it's stored, and what you're entitled to ask of us.
Three sentences are enough for most readers
- With on-premise operation, your customers' conversations stay on your server, and are not stored with us.
- We do not sell your data, do not share it for marketing purposes, and do not use it to train a model serving anyone else.
- You can request your copy or its deletion whenever you like, and we respond within thirty days.
Who is the controller and who is the processor?
This distinction determines responsibility. You're the controller of your customers’ data, and we are the processor on your behalf. We only process what you ask for, and we don't decide on a new purpose for your data ourselves.
That’s why compliance remains your commitment as the controller, and our role is to make it easier for you.
The data, its reason, and how long it stays
| Type | What it is | Why | Duration |
|---|---|---|---|
| Contact data | your name, email and number from the “contact us” form | Replying to you and starting your trial | Two years from last contact |
| Your customers’ conversations | The text of messages and images sent to your number | Generating the reply and keeping the customer context | Depending on your settings, from 30 days to indefinitely |
| Customer records | stage, quotes, contracts and payments | Running the system and avoiding repeated questions | For as long as the subscription lasts |
| Operations log | the time of each decision, its source, and which tool was called | Auditing, and explaining any reply after the fact | 12 months |
| Payment data | the transaction reference, its status and amount | Confirming and recording payment | As required by invoicing regulations |
We never store card data at all. Payment happens at a licensed gateway, and all that reaches us from it is the transaction reference and its status.
Two ways to run it, and where the data stays in each
Runs on your server
Available on Professional and Enterprise. The system is on your own server, and we hold no copy of your chats. Reading documents and images needs a cloud provider, which is the limit of this mode. When you end your subscription, the data stays with you as is.
Managed
On our servers in data centres inside Saudi Arabia (Riyadh), which we manage for you. Conversations are processed by a cloud AI provider, and we name it for you in the contract. If that provider is outside your country, we only start with your written consent and the safeguards your country’s law requires.
The AI that writes the replies runs on your server or at a cloud provider, depending on the setup you choose. We tell you which provider is used for your business before go-live, and you can require that it runs on your server only.
Health data is sensitive data under the Personal Data Protection Law. If your business is a clinic or health centre, we advise running on your own server, and we do not process your patients’ messages with a cloud provider without your written consent.
What you can ask for, and how
Access and a copy
a copy of your data in a readable format.
Correction
amending any incorrect or incomplete data.
Erasure
deleting your data unless a law obliges us to keep it.
Send your request to privacy@naateq.com, and we respond within thirty days. And if your request is not handled as it should be, you may complain to the Saudi Data and AI Authority.
What leaves, and what does not
Who we share with
- WhatsApp: Message text passes through it because it's the delivery channel.
- The payment gateway you choose: the transaction amount and reference.
- The systems you connect yourself, within the limits you set.
- AI provider on managed operation, and we name it in your contract.
Cookies
This site does not use tracking cookies. What we keep in your browser is a single local item (naateq-theme) remembering your choice of light or dark theme; it never leaves your device and does not identify you.
We measure visit counts with analytics from Vercel, which is also our hosting provider. It works cookie-free and without any personal identifier: it records the page requested, the country, the device type and the referring site, and no profile is built from them to follow you across sites. That's why you don't see a consent banner: what we collect doesn't require one.
The demo dashboard at /app/demo/ holds display data, and no data is collected from you there.
Security, and disclosure on a breach
- The connection is encrypted, and integration keys are stored separately and never appear in any log.
- Every incoming text is screened before it reaches the model, and attempts to impersonate the owner are blocked.
- On any breach affecting your data, we notify you within 72 hours of becoming aware of it, and notify the competent authority as the law requires.
We may update this policy. We'll notify you of any material change thirty days before it takes effect. Last updated: October 2026.
A question about your data?
Write to us directly, and someone from our team will reply.