سياسة الخصوصية

Gahez AI Agent ("Gahez", "we") provides software that lets a business connect its own messaging channels and have an AI agent reply to that business's customers. The business that connects a channel is the data controller for its customer conversations. Gahez acts as a data processor on that business's behalf.

• Account data. The business name, your name, your email address, and a hashed password. Passwords are stored as bcrypt hashes and are never recoverable.
• Channel credentials. Access tokens issued by Meta when you connect a Facebook Page, Instagram account, or WhatsApp Business number. These are encrypted at rest with AES-256-GCM and are used only to receive and send messages on the channel you connected.
• Conversation content. Messages your customers send to your connected channels, the replies produced by the agent or by your team, and the sender's public profile name and picture as provided by Meta.
• Contact details volunteered by customers. When a customer states a name, phone number, or email inside a conversation, the agent records it so your team can follow up.
• Operational logs. Webhook delivery records and error traces. Access tokens and passwords are redacted from all logs.

• To deliver messages to your channel and generate replies on your behalf.
• To send conversation text to Anthropic's Claude API, our AI sub-processor, so that a reply can be generated. Anthropic does not train its models on this content.
• To show you an inbox, your leads, and basic usage statistics.
• To detect abuse, debug failures, and keep the service running.

We do not sell personal data, we do not use it for advertising, and we do not use one business's data to serve another. Each business's data is isolated by tenant and every query is scoped to that tenant.

• Meta Platforms — to receive and send messages on the channels you connect.
• Anthropic — to generate agent replies from conversation content.
• Our hosting provider — to run the servers and databases that store this data.
• Authorities — only where we are legally required to do so.

Conversations and leads are retained while your account is active, so that your team has history and context. When you delete a channel, its access tokens, conversations, messages, and leads are deleted with it. When you delete your account, everything belonging to your business is deleted within 30 days. Backups are purged on their own rolling schedule, not longer than 90 days.

You can access, correct, export, or delete your data from the dashboard, or by writing to us. If one of your customers asks you to delete their conversation, you can delete it from the inbox, or ask us and we will action it. Anyone who used Facebook Login with Gahez can also trigger deletion from Facebook directly, and our callback removes the connected channel and everything under it. See our data deletion page.

Channel access tokens are encrypted at rest with AES-256-GCM. All traffic runs over HTTPS. Every webhook we accept is verified against its X-Hub-Signature-256 HMAC before it is processed. Tenant data is isolated at the query layer, and secrets are redacted from logs. No system is perfectly secure, and we will notify affected businesses without undue delay if a breach occurs.

Questions about this policy, or a data request: privacy@gahez.space.