01Who is responsible for what
Data-protection law distinguishes between the party who decides why and how personal data is processed (the controller) and the party who processes it on that party’s instructions (the processor). Getting this the wrong way round is the single most common mistake in agreements like this, so we state it plainly.
For the messages your customers send to your WhatsApp number: you are the controller. We are the processor.
Those people are your customers. They contacted your business. We hold and process what they write only because you have engaged us to run an assistant on your number, and only for that purpose.
For our own business records — your contact details, your account, our invoices, our website analytics — we are the controller, because we decide why and how we process those.
1.1 What follows from this
- We process end-customer data only on your documented instructions, and for no purpose of our own.
- The duty to have a lawful basis for processing your customers’ data is yours.
- The duty to tell your customers what happens to their data is yours (see clause 13).
- If one of your customers asks to see, correct or delete their data, the request is yours to answer. We will help you, promptly and without extra charge, but we cannot and will not answer on your behalf, and we will not act on a request from your customer directly — we will refer them to you.
This policy sits alongside our Terms of Service and forms part of them. Where we act as your processor, clause 13 of the Terms and this policy together constitute the data-processing terms between us.
02What data we handle
2.1 Data about you, our client (we are controller)
- Business name, trade licence details, and registered address.
- Name, role, email address and telephone number of your contacts.
- Billing details and payment records. We do not store full payment-card numbers.
- Your correspondence with us, including WhatsApp and email threads.
- Configuration you supply: catalogue, prices, stock, policies, tone-of-voice material.
2.2 Data about the people who message you (we are processor)
- Their WhatsApp telephone number and WhatsApp profile name.
- The content of messages they send — text, voice notes, and images.
- The content of replies sent to them, whether generated by the Assistant or written by your staff.
- Timestamps, message status, language detected, and the conversation thread.
- Whatever they volunteer in the course of the conversation — which may include an address, an order reference, a complaint, or a photograph.
A warning worth reading. You cannot control what a customer types into WhatsApp. Someone may volunteer a health condition, a national ID number, a bank detail, or a photograph of a document. This is sensitive personal data and it carries a higher legal duty.
Do not configure the Assistant to ask for any of it. If your business genuinely needs to handle sensitive categories, tell us in writing before go-live so that additional safeguards are put in place. Absent that written agreement, you must not use the Service for sensitive-category processing.
2.3 Data about visitors to our website
Our marketing site is deliberately minimal. We do not set advertising or tracking cookies, we do not run third-party analytics or advertising pixels on it, and we do not build visitor profiles. Our hosting provider may keep standard server logs (IP address, timestamp, page requested, user agent) for security and diagnostics. The site loads a web font from Google Fonts, which means your browser makes a request to Google’s servers; if you would rather it did not, block third-party font loading in your browser.
If you click a WhatsApp link on our site, you leave our site and enter WhatsApp, where Meta’s own privacy terms apply to that conversation in addition to ours.
03What we use it for
| Running the Service | Receiving messages, generating replies, checking your catalogue, routing conversations, escalating to your staff. |
|---|---|
| Building and tuning | Reviewing real conversations during the build and tuning period to improve how the Assistant answers for you. This is configuration work on your account, not model training — see clause 5. |
| Support | Diagnosing a problem you report. Access to conversation content for support is on a need-to-know basis and is logged. |
| Security and abuse prevention | Detecting fraud, abuse, spam and unauthorised access; maintaining service integrity. |
| Billing and administration | Invoicing you, keeping accounts, and meeting our legal and tax obligations. |
| Service statistics | Aggregated, irreversibly anonymised counts — message volumes, response times, error rates — used to operate and improve the Service. These cannot identify you or any individual. |
We do not sell personal data. We do not rent, trade or share it for anyone else’s marketing. We do not use the content of your customers’ conversations to market anything to them, or to you. These are absolute commitments, not preferences.
04Our lawful basis
Where we are the controller (clause 2.1 and 2.3), we process on the basis of: performance of our contract with you; our legitimate interests in operating, securing and improving our business, balanced against your rights; and compliance with our legal obligations, including tax and accounting.
Where we are the processor (clause 2.2), we do not have our own lawful basis and do not claim one. We process on your instruction, and you are responsible for establishing and documenting the lawful basis for that processing. You warrant to us that you have one.
We process in accordance with the data-protection framework applicable in the State of Kuwait, including the regulations issued by the Communication and Information Technology Regulatory Authority (CITRA). Where you or your customers are located elsewhere in the GCC or beyond, additional local requirements may apply to you as controller, and meeting them is your responsibility.
05We do not train AI on your data
We do not use your data, or the content of your customers’ conversations, to train, fine-tune, or improve any general-purpose artificial-intelligence model — ours or anyone else’s. We contract with our model provider on terms that prohibit them from doing so with data we send.
To be precise about the distinction, because it matters:
- Tuning your assistant means a human reading conversations from your account and adjusting your configuration and instructions so it answers better. Nothing leaves your account. This is included in your plan and is what “monthly tuning” refers to.
- Model training means feeding data into a machine-learning process that changes a model used for other customers. We do not do this, and we do not permit it.
If this ever changes, it will require your prior, specific, opt-in consent, sought separately. It will never be introduced by an update to this policy.
06Automated decisions and AI processing
The Assistant generates replies automatically, without a human reviewing each one before it is sent. Your customers are told they are speaking with an automated system.
The Assistant is not configured to make decisions producing legal effects or similarly significant effects on an individual — it does not assess creditworthiness, decide eligibility, price by individual profile, or refuse service to a person. You must not configure it to do so. A human escalation path is available in every conversation, and a customer may ask for a person at any point.
Messages are processed by a third-party model provider (clause 7) in order to generate a reply. That processing is transient and subject to contractual restrictions on retention and reuse.
07Sub-processors
We use a small number of third parties to deliver the Service. Each is bound by contract to protect the data, to process it only on our instructions, and to meet obligations no weaker than those in this policy.
| Meta Platforms / WhatsApp | Operates the messaging platform itself. All messages traverse Meta’s infrastructure. Meta’s own terms apply to your WhatsApp Business account. |
|---|---|
| Business Solution Provider | Provides technical access to the WhatsApp Business Platform and routes messages between it and our systems. |
| AI model provider | Generates the Assistant’s replies. Contracted so that data sent is not used to train their models. |
| Hosting / infrastructure | Runs our servers and stores conversation logs and configuration. |
| Email and business tooling | Handles our correspondence and billing records. |
We will give you at least thirty (30) days’ written notice before adding or replacing a sub-processor. If you object on reasonable data-protection grounds, you may cancel under clause 10 of the Terms without penalty. A current list naming each provider is available on request, and we will supply it before you go live.
08Where data is stored and sent
Delivering this Service necessarily involves transferring data outside the State of Kuwait. Meta, the model provider and our hosting provider all operate infrastructure internationally. We cannot provide the Service without such transfers, and by subscribing you instruct us to make them.
Where we transfer personal data internationally we rely on the recipient’s contractual commitments to protect it to a standard consistent with Kuwaiti requirements.
If your business is subject to a data-residency requirement — for example because you are regulated, or because you serve a government client — tell us in writing before go-live. Some residency requirements cannot be met by this Service in its current form, and it is better for both of us to establish that before a build than after.
09How long we keep it
| Conversation content | Retained for twelve (12) months from the date of the message, so that the Assistant can recognise a returning customer and you can review history. You may instruct a shorter period in writing. |
|---|---|
| Your configuration | For the life of your account, then deleted within 90 days of termination. |
| Account and contact records | For the life of your account, then as needed for legal claims. |
| Invoices and accounting | For the period Kuwaiti tax and commercial law requires, regardless of termination. |
| Security logs | Up to 12 months. |
| Backups | Deleted data persists in encrypted backups until they expire on their normal cycle, no longer than 35 days. Restored data is re-deleted. |
On termination we will, at your written request made within thirty (30) days, delete or return Client Data. Absent a request, we delete it within ninety (90) days, except where law requires us to keep it. Deletion is permanent and cannot be reversed — export anything you need first.
10How we protect it
- Data is encrypted in transit using current TLS, and encrypted at rest.
- Access is restricted to personnel who need it to do their job, and is logged.
- Credentials and API keys are held in a secrets store, never in source code, and are rotated.
- Access to systems requires multi-factor authentication.
- We keep audit logs of administrative access to conversation content.
- Personnel with access are bound by written confidentiality obligations that survive their engagement.
We will not overstate this. No system is perfectly secure, and we do not warrant that ours is. What we commit to is applying appropriate technical and organisational measures, keeping them current, and telling you quickly and honestly if something goes wrong.
Please note that WhatsApp’s end-to-end encryption does not apply in the ordinary way to messages sent to a business using the WhatsApp Business Platform. Messages to a business account are processed by Meta’s systems and by the business’s chosen providers — here, us. Your customers should be told this (clause 13).
11If something goes wrong
If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and in any event within twenty-four (24) hours of becoming aware. We apply the 24-hour standard because it is the tightest clock applicable in this region, and applying the tightest standard everywhere is simpler and safer than tracking several.
Our notification will tell you what happened, what data was involved, how many people are affected so far as known, what we are doing about it, and what we recommend you do. We will keep you updated as we learn more, including where the initial picture turns out to be wrong.
As controller, notifying the regulator and affected individuals is your decision and your responsibility. We will give you the information you reasonably need to make it, promptly and at no charge.
12Rights of individuals
Individuals have rights over their personal data, including to be told how it is used, to obtain a copy, to have inaccuracies corrected, to request deletion, to object to certain processing, and to withdraw consent.
- If you are our client and want to exercise a right over the data we hold about you as controller, contact us at sales@gulf.bot. We will respond within thirty (30) days. We may need to verify your identity first.
- If you are someone who messaged a business using GulfBot, your rights are against that business, not against us. We are only its processor. Contact the business you messaged. If you contact us instead, we will tell you so and, where we can identify the business, pass your request to it — we will not action it ourselves, because we have no authority to.
You may also complain to CITRA in Kuwait, or to your local data-protection authority. We would rather you raised it with us first so we have the chance to fix it.
13Your duty to the people who message you
The people messaging your number have no relationship with us. They have one with you. So the duty to tell them what happens to their data is yours, and it is a condition of using the Service.
You must maintain a privacy notice, accessible to your customers, that at minimum tells them:
- That messages to your WhatsApp number are answered by an automated assistant.
- That message content is processed by a third-party service provider on your behalf, and by an AI model provider, to generate replies.
- How long you retain conversations, and how they can ask for a copy or deletion.
- How they can reach a human being instead.
You must also hold valid opt-in consent for every number you message, and keep evidence of it (clause 6.3 of the Terms). We will provide a short template notice you may adapt — but it is a starting point, not legal advice, and you remain responsible for its accuracy and sufficiency for your business.
14Our own website
We do not use advertising cookies, tracking pixels, session recording or cross-site trackers on gulf.bot. If we ever introduce anything that requires consent, we will ask for it before setting it, and a refusal will leave the site fully usable.
Our site links to WhatsApp and Instagram. Once you follow such a link you are on a third-party platform governed by its own privacy terms, and we have no control over what it collects.
15Children
The Service is sold to businesses and is not directed at children. We do not knowingly process the personal data of anyone under 18 as a client. If a person under 18 messages a client’s number as a customer, that data is processed under the client’s instruction and the client is responsible for any additional protections the law requires. If you become aware that a child’s data is being processed in a way that requires special handling, tell us and we will assist.
16Changes to this policy
We may update this policy. Where a change materially affects how we handle personal data, we will give you at least thirty (30) days’ written notice before it takes effect, and you may cancel under clause 10 of the Terms if you do not accept it.
The commitment in clause 5 — that we do not train AI models on your data — will never be weakened by an update to this policy. Changing it would require your separate, specific, opt-in consent.
The version and effective date at the top identify the operative text. Earlier versions are kept and available on request.
17How to contact us
For any question about this policy, or to exercise a right:
- Email — sales@gulf.bot
- WhatsApp — +965 9609 4926
- Entity — [[LEGAL_ENTITY_NAME]], [[REGISTERED_ADDRESS]], State of Kuwait
If you are considering GulfBot and your lawyer wants to review this before you sign, send them here. We would rather answer their questions now than have a disagreement about data later.