Where your data lives, in plain words.
Three questions every owner should ask before a bot touches their WhatsApp: where does a message go, who can read it, and what happens if something leaks. Here are the real answers. The Privacy Policy is the binding text; this page is its plain-language version.
Only what it needs to answer your customers.
To answer them, the desk handles: the messages they send to your WhatsApp number, their name and phone number as WhatsApp shows them, and whatever your business gives the system to answer from — prices, hours, policies, stock and order status.
It never handles card or payment credentials. Payment runs on your own channels. We never sell data, never use it for advertising, and never mix one client's data with another's: each business runs in its own separate store.
Stored in Kuwait, on our own machine. Carried by named platforms.
Conversations and customer records are stored on GulfBot's own operator machine in Kuwait — a system we built and run ourselves, not a shared cloud CRM. For a message to reach you and be answered, it passes through these platforms and no others:
| Meta / WhatsApp Business PlatformUSA · EU | Carries every message your customers send and receive — the network they already use. Meta's own terms apply to your WhatsApp Business Account. |
|---|---|
| 360dialog GmbHGermany | The WhatsApp Business API gateway between Meta and our machine. |
| Cloudflareglobal edge | Carries the webhook traffic from the gateway to our machine, and hosts this website. Transit and standard logs only; conversations are not stored there. |
| AnthropicUSA | The language model that composes replies. It receives conversation text only when a reply needs composing, and its commercial terms bar it from training on that data. |
| Microsoft 365only with the email desk | If you take the email desk option, that mailbox runs here. |
| Voice notesKuwait · our machine | Transcribed on our own machine with an open-source model. No third-party speech service is involved. |
That is the complete list. Nothing is unnamed.
Data residency, honestly. Storage is in Kuwait, but delivering the service necessarily moves data outside Kuwait in transit: Meta, the gateway and the model provider all operate internationally, and we cannot provide the service without them.
If your business is subject to a data-residency requirement — because you are regulated, or because you serve a government client — tell us in writing before go-live. Some residency requirements cannot be met by this service in its current form, and it is better for both of us to establish that before a build than after.
You, the founder, and no model in training.
You read every conversation live — it is your number and your customers. On our side, the founder reads conversations during the build and tuning period to make the desk answer better for you; that is configuration work on your account, not model training.
We do not train AI on your data. Not ours, not anyone else's. We contract with our model provider on terms that prohibit it from doing so with what we send. That commitment is written into clause 5 of the Privacy Policy.
For the messages your customers send to your number, you are the controller and we are the processor: we act on your instructions, and we refer any customer who contacts us directly back to you.
Twelve months by default. Shorter on your instruction. Gone on termination.
| Conversation content | Kept twelve months from the date of the message, so the desk recognises a returning customer and you can review history. You may instruct a shorter period in writing. |
|---|---|
| Your configuration | For the life of your account, then deleted within 90 days of termination. |
| Backups | Deleted data persists in encrypted backups no longer than 35 days. Restored data is re-deleted. |
| On termination | At your written request within 30 days we delete or return your data. Absent a request, we delete it within 90 days. Export anything you need first — deletion is permanent. |
Only the do-not-contact list is kept beyond that — an obligation, not an asset.
Your number, before, during and after.
Customers keep messaging the number already printed on your receipts and your Instagram bio. The WhatsApp Business Account sits under your own Meta Business Manager, not ours. If we ever part ways, the number, the account and the conversation history carry on with you, with a written handover.
One thing your customers should be told, and we say it plainly: WhatsApp's end-to-end encryption does not apply in the ordinary way to messages sent to a business on the WhatsApp Business Platform. Those messages are processed by Meta's systems and by the business's chosen provider — here, us.
Kuwait's clock is 24 hours. Our runbook is written to it.
Kuwait's regulator, CITRA, requires under Administrative Decision No. 26 of 2024 that a breach be notified to CITRA and to the affected individuals within 24 hours — stricter than the 72 hours most jurisdictions allow. Our incident runbook is choreographed against that clock:
- Immediately: contain — isolate the machine, revoke every key.
- Within 2 hours: your named contact is called, with what is known in writing.
- Within 24 hours: CITRA and the affected individuals are notified.
- Within 72 hours: a full written incident report to you.
Credentials and API keys live in a secrets store, never in source code, and are rotated. Each client is isolated from every other.
Three things that are not finished.
- A Kuwaiti lawyer is confirming whether any in-country storage rule applies to this setup. Our storage is already in Kuwait; the question is whether the transit described above needs anything further.
- A signable per-client processing agreement is being drafted. Until then, clause 13 of the Terms, the Privacy Policy and this page together are the standing answer.
- No SOC 2 or ISO 27001 certificate. We are a small operator and we don't claim one. If your procurement requires it, say so before a build and we will tell you honestly whether we can meet it.
Ask the question you actually have
If your question isn't answered above, ask it on WhatsApp or by email. If a regulated or government client is involved, ask before the build, not after.