Privacy Policy

Last updated: 27 September 2026

Fahim (fahim.digital) is a platform that gives businesses AI employees that answer their customers on WhatsApp and website chat, qualify them, book appointments and carry out the actions the business authorises. This policy explains what data we collect, why, who processes it, and your rights.

1. Who is responsible

• Account holders' data (businesses subscribed to Fahim and their staff): Fahim is responsible.
• Data of a business's customers (people who message a business that uses Fahim): the business is responsible and decides how it is used; Fahim processes it on the business's behalf, solely to provide the service to that business.

2. Data we collect

a. From account holders

• Name, email, company name, notification phone number, and password (stored hashed, never in plain text).
• Content the business provides to train Fahim: company, product, pricing and policy information, project/unit inventory, settings and rules.
• Billing data: invoices and subscription status. Card details are entered on the payment gateway's page (Moyasar); we do not store them.
• When WhatsApp is connected through Meta (Embedded Signup): the WhatsApp Business Account ID, phone number ID, and the access token needed to send and receive messages. If the number is connected in "coexistence" mode with the WhatsApp Business app, we receive copies of messages the business's staff send from the app, so Fahim does not repeat a reply already sent.
• Payment keys a business adds to collect deposits from its own customers (e.g. its own Moyasar secret key) are stored encrypted.

b. From a business's customers (via WhatsApp and website chat)

• Phone number and name as shown on the WhatsApp profile or as provided by the customer.
• Message content, voice notes (transcribed to text to reply), and images/files the customer sends.
• Details the customer shares to fulfil their request: need, budget, city, preferred time, and similar.
• Conversation summaries and the business's customer "memory", booked appointments, and deposit requests and their status.

c. Technical data

• Server logs (IP address, browser type, request times) and error reports — to operate and protect the service.
• We use browser local storage to keep you signed in. We do not use advertising cookies or ad-tracking tools.

3. How we use data

• To run the service: replying to customers, qualifying them, presenting relevant offerings of the business, booking appointments, sending payment links, and alerting the business when its decision is needed.
• To show the business its results: reports, qualified customers and conversations.
• Billing, account-holder support, platform security and abuse prevention, and legal obligations.

We do not sell data, do not use it for advertising, and do not use customer conversations to train AI models. Each business's data is isolated from other businesses.

4. Service providers

We use providers that process data only to deliver the service, under their contracts and terms:

This means data is processed outside Saudi Arabia (in the EU and the United States). We limit processing to what the service requires.

5. Retention

• We keep account data and conversations while the account exists or until the business deletes them.
• On a deletion request (see Data Deletion) we delete the data from our live systems within 30 days of verifying the request. Copies may remain in backups until overwritten in their normal cycle and are not used in the meantime.
• Billing records may be kept for the period required by law.

6. Your rights

• Stop messages: any customer can immediately stop a business's messages by sending the word «إيقاف» (stop) in the chat.
• Access, correction and deletion: a business's customers may contact that business, or us directly and we will forward the request and help carry it out. Account holders may contact us.
• Withdraw consent: by stopping messages or requesting deletion at any time.

7. Security

Connections are encrypted (HTTPS), passwords are hashed, businesses' payment keys are encrypted, each business's data is isolated, and incoming WhatsApp webhooks are accepted only with Meta's verified signature. No system is risk-free; if an incident affects your data we will notify you as required by law.

8. Children

The service is intended for businesses and is not directed at anyone under 18.

9. Changes

We may update this policy and will change the "Last updated" date above. We will inform account holders of material changes.

10. Contact

For any privacy or data question or request: support@fahim.digital