Privacy Policy

1 Introduction & Scope

SalmanBot ("SalmanBot", the "Service") is an AI-powered sales assistant that operates on a business's own messaging channels (WhatsApp number, Facebook Page/Messenger, and/or Instagram account) to read and reply to that business's customers' messages, record orders, book appointments, and hand conversations over to human staff when needed. The Service is provided by Salman for Marketing & E-Commerce ("we", "us", "the Provider"), based in Al-Bireh / Ramallah, Palestine.

This Privacy Policy applies both to the businesses that subscribe to SalmanBot ("Business Clients") and to those businesses' own customers who message them via connected messaging channels — WhatsApp, Facebook Messenger, and/or Instagram ("End-Customers").

2 Who We Are & Our Two Roles (Controller & Processor)

Under data-protection laws such as the EU General Data Protection Regulation (GDPR), we act in two different roles depending on whose data is involved:

• As a Controller — for the account and business information of our Business Clients (the people and companies who subscribe to SalmanBot). We decide how and why we use that data to provide, bill, support, and secure the Service.
• As a Processor (on behalf of our Business Client) — for the personal data of End-Customers who message the Business Client on WhatsApp. Here, the Business Client is the Controller of its own customers' data and decides why it is collected; we process that data only on the Business Client's documented instructions to operate the assistant on their behalf.

3 Data We Collect

(a) From Business Clients — we act as Controller

Name and contact details of the account owner/staff, business name and details, the WhatsApp Business number connected to the Service, login/authentication data, the product/catalog and pricing information you configure, subscription and payment records, and support communications.

(b) From End-Customers, via WhatsApp — we act as Processor for the Business Client

The End-Customer's WhatsApp phone number and WhatsApp profile information (such as display name); the content of the messages they send to and receive from the business (text and, where applicable, media); and information derived from those messages such as order details, appointment details, and conversation history.

Sources

We receive End-Customer data directly from their messages on the connected channels, delivered to us through Meta's platform APIs and our messaging infrastructure provider (Zernio). We receive Business Client data directly from the Business Client during sign-up and use.

4 Why We Process Data & Legal Bases

We process Business Client data to: provide and configure the Service (basis: performance of a contract); bill and manage the subscription (contract / legal obligation); provide support and secure and improve the Service (legitimate interests); and comply with law (legal obligation).

We process End-Customer data solely to operate the assistant for the Business Client: to read incoming messages, generate and send replies, log orders and appointments, and escalate to human staff. Because we act as Processor here, the lawful basis for processing End-Customers' data is the responsibility of the Business Client (the Controller) — typically the End-Customer's consent/opt-in to receive WhatsApp messages from that business, or the business's contract or legitimate interest. We require every Business Client to have obtained a valid lawful basis and any required opt-in before using SalmanBot (see Section 11).

5 How the AI Works (Automated Processing & Transparency)

SalmanBot uses a large language model to understand messages and draft replies automatically. To generate a reply, the content of the End-Customer's message (together with relevant conversation context and the business's configured information) is sent to Anthropic's Claude API, which returns suggested text that is sent back to the End-Customer on WhatsApp.

Replies are generated automatically, but the Service is designed for human escalation: staff can take over a conversation at any time, and the assistant is limited to sales, ordering, appointment, and support tasks. It does not make decisions that produce legal or similarly significant effects on End-Customers. If you would prefer to speak only to a human, you can ask at any time and the conversation will be handed to staff.

6 Sub-Processors & Third Parties

To run the Service we rely on the following third parties, and we disclose them openly:

• Anthropic, PBC (Claude API) — our AI sub-processor. Message content is sent to Anthropic to generate replies. Anthropic processes this data as a processor on our instructions and, under its commercial terms, does not use it to train its models; it retains API inputs and outputs for a limited period for operational and safety purposes and then deletes them.
• Meta Platforms (WhatsApp Business, Messenger, Instagram messaging) — the platforms through which messages on connected channels are transmitted and temporarily handled. WhatsApp messages are encrypted in transit on WhatsApp; once delivered through the platform APIs, they are processed by us to run the Service. Meta's handling of each platform's data is governed by Meta's own terms and privacy policies.
• Messaging infrastructure provider (Zernio) — a sub-processor through which channels are connected (via its Meta-approved apps) and through which inbound/outbound channel messages pass. To operate the Service, it retains copies of connected-channel conversations and identifiers on its systems under its published policies. It is not authorized to use this data for its own purposes beyond operating the Service, and connections are made with your explicit consent during the channel-connect flow.
• Hosting / infrastructure provider — the server on which SalmanBot and its database run.

We do not sell personal data, and we do not share End-Customer message content with any party other than those needed to operate the Service.

7 International Data Transfers

We operate from Palestine, and our sub-processors and hosting may be located outside your country — in particular, Anthropic, Meta, and our messaging infrastructure provider (Zernio) are based in the United States and process data on global infrastructure. This means personal data, including message content, may be transferred to and processed in countries other than your own. Where required, such transfers are covered by the safeguards our sub-processors implement (such as Standard Contractual Clauses and equivalent contractual and technical protections). Business Clients serving customers in the EU/UK should account for these transfers in their own privacy notice.

8 Data Retention

• On our server: we retain Business Client account data for as long as the subscription is active and as needed for legal, tax, and support purposes. We retain End-Customer conversation logs, orders, and appointment records for as long as needed to provide the Service to the Business Client, or until the Business Client instructs us to delete them or the subscription ends — after which the Business Client's data is deleted, unless retention is required by law.
• At Anthropic: message content sent to the Claude API is retained only for a short operational/safety window and then deleted (standard API log retention is limited to a few days; flagged content may be kept longer for trust-and-safety or legal reasons).
• At Meta/WhatsApp: messages passing through the WhatsApp Business Cloud API are stored by Meta only temporarily (generally deleted after about 30 days) as described in Meta's documentation.

End-Customers and Business Clients can request earlier deletion as described in Section 10.

9 Security Measures

We apply technical and organizational measures appropriate to the sensitivity of the data, including: encryption of data in transit (TLS/HTTPS) between WhatsApp, our server, and Anthropic; access controls and authentication limiting who can access the server and databases; protection and confidentiality of our API keys and credentials; a separate Service instance per Business Client so client data is kept apart; server hardening and monitoring; and staff access on a need-to-know basis. No system is perfectly secure, but we work to protect data against unauthorized access, loss, or misuse, and will notify affected parties and authorities of a breach where the law requires.

10 Data Subject Rights & Opt-Out

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, withdraw consent, and receive a copy (portability). You also have the right to lodge a complaint with a data-protection supervisory authority.

How to exercise rights

For End-Customer data, because we act on behalf of the Business Client, requests are usually directed to the business you were messaging; you may also contact us at info@sllmall.com and we will act on the Business Client's instructions or forward your request to them. Business Clients can contact us directly.

Opt-out / STOP

End-Customers can stop receiving messages from SalmanBot at any time by replying "STOP" (or "إيقاف", or asking to be removed) in the WhatsApp conversation. On such a request we will flag the number to stop automated messaging. Business Clients must honor these opt-outs, consistent with WhatsApp's rules.

11 Business Client Responsibilities

If you are a Business Client, you are the Controller of your End-Customers' personal data and are responsible for: (1) having a valid lawful basis and obtaining any required opt-in/consent from your customers before messaging them on WhatsApp, clearly naming your business; (2) maintaining your own published privacy policy informing your customers that an AI assistant may process their messages and that message content is sent to a third-party AI provider (Anthropic) to generate replies; (3) honoring opt-out/STOP requests and data-subject requests; and (4) using SalmanBot only for lawful, task-specific sales, ordering, appointment, and support purposes. These are also requirements of the WhatsApp Business Platform, and using the Service means you agree to meet them. We provide the tooling; compliance with consent and notice obligations toward your customers rests with you.

12 Children's Data

SalmanBot is a business tool and is not intended for use by children. We do not knowingly collect data from children under 16. Business Clients must not use the Service to knowingly process the data of children without the consent required by applicable law. If we learn that a child's data has been processed without a proper basis, we will delete it on request.

13 Cookies & Website Analytics

Our marketing website (sllmall.com and related pages) may use minimal cookies or basic analytics to keep the site working and understand traffic. This is separate from the SalmanBot messaging service, which does not rely on website cookies. Where required, we ask for consent to non-essential cookies.

14 Changes to This Policy

We may update this Privacy Policy as the Service or the law changes. We will post the updated version with a new effective date and, for material changes, notify Business Clients through the Service or by email. Continued use after an update means acceptance of the revised policy.

15 Contact & Complaints