Privacy Policy

We are committed to compliance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), applicable international regulations, and all third-party platform requirements including Meta's Developer Platform Terms.

We do not process any personal data without obtaining the explicit consent of the data subject, except in cases permitted under the Saudi Personal Data Protection Law (PDPL) where consent is not required.

2.1 Information You Provide Directly

• Account Information: name, email address, phone number, company details, billing information.
• Profile Information: business profile details, preferences, settings.
• Communication Content: messages, files, images, and other content you send through our platform.
• Support Information: information provided when contacting customer support.

2.2 Information Collected Automatically

• Usage Data: platform usage patterns, feature utilization, session duration.
• Device Information: IP address, browser type, operating system, device identifiers.
• Log Data: access logs, error logs, performance metrics.
• Cookies and Tracking: session cookies, preference cookies, analytics cookies.

2.3 Meta Platform Data (Facebook, Instagram, WhatsApp)

In compliance with Meta's Developer Platform Terms, we collect and process:

• WhatsApp Business API: message content, contact information, delivery status, user identifiers.
• Facebook Messenger: page interactions, message content, user identifiers, profile information.
• Instagram Business: direct message content, profile interactions, user identifiers.
• Meta User Data: profile information, photos, videos, location information (where permitted), communications between users, payment information, device information.
• Restricted Platform Data: data that can reasonably identify particular users or devices, accessed through specific permissions.

We process Meta Platform Data only as permitted under Meta's Developer Platform Terms and in accordance with the purposes clearly described in this privacy policy.

3.1 Platform Operations

• Facilitate message delivery across all channels.
• Maintain conversation history and analytics.
• Provide unified inbox functionality.
• Enable automation and chatbot features.
• Generate performance reports and insights.

3.2 Business Purposes

• Account management and billing.
• Customer support and technical assistance.
• Platform improvements and new feature development.
• Security monitoring and fraud prevention.
• Legal compliance and regulatory requirements.

The platform may use automated analytics tools or artificial intelligence algorithms to improve service quality and user experience, without making any automated decisions that produce legal or significant effects on users without human involvement.

3.3 Communication

• Service announcements and updates.
• Technical notifications and alerts.
• Marketing communications (with consent).
• Support and troubleshooting assistance.

In strict compliance with Meta's Developer Platform Terms, we do not and will not:

• Process Platform Data to discriminate based on race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical condition, or other protected categories.
• Use Platform Data for eligibility determinations regarding housing, employment, insurance, education, credit, government benefits, or immigration status.
• Process Platform Data for surveillance purposes, law enforcement, or national security.
• Sell, license, or purchase Meta Platform Data.
• Process Platform Data without valid user consent to build or augment user profiles.
• Attempt to decode, reverse-engineer, or re-identify anonymized Platform Data.
• Change core functionality without Meta's approval through App Review.
• Process Platform Data for purposes other than those specified in Meta's Developer Documentation.

5.1 Meta Platform Data Sharing

Meta Platform Data may only be shared in the following limited circumstances:

• With our authorized Service Providers who have agreed in writing to process data solely at our direction.
• When required by applicable law or regulation (with proper documentation retained).
• When users expressly direct or consent to sharing for specified purposes.
• With other third parties for non-Restricted Platform Data only, with contractual prohibitions against Terms violations.

5.2 Third-Party Service Providers

• Cloud hosting and infrastructure (AWS, Google Cloud, Microsoft Azure).
• Payment processing and billing.
• Analytics and performance monitoring.
• Email delivery services.
• Customer support tools.

5.3 Platform Integrations

• Meta (WhatsApp/Facebook/Instagram): as required for message delivery and platform compliance.
• Apple Messages for Business: for business chat functionality.
• Email Providers: for email routing and delivery.
• API Partners: for enhanced functionality and integrations.

5.4 Legal Requirements

We may disclose information when required by legal process or court orders, government investigations, regulatory compliance, protection of rights, property, or safety, or prevention of fraud or illegal activities.

5.5 Business Transfers

Information may be transferred in connection with mergers, acquisitions, or asset sales, with appropriate notice to users.

6.1 Security Measures

• End-to-end encryption for supported channels.
• TLS encryption for data transmission.
• Multi-factor authentication.
• Regular security audits and penetration testing.
• Access controls and employee training.
• Incident response procedures.

6.2 Data Storage

• Secure data centers with physical security controls.
• Regular backups and disaster recovery procedures.
• Data retention policies and secure deletion.
• Geographic data residency options.

Data is stored within data centers located in the Kingdom of Saudi Arabia to ensure compliance with local data protection requirements. International hosting options may be provided to clients upon request, subject to applicable legal and regulatory safeguards.

7.1 Access and Control

• View and download your data.
• Update account information and preferences.
• Export conversation history.
• Delete specific conversations or data.

7.2 Communication Preferences

• Opt-out of marketing communications.
• Control notification settings.
• Manage cookie preferences.
• Customize privacy settings.

7.3 Data Subject Rights (where applicable)

• Data portability.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten").
• Restriction of processing.
• Object to processing.
• Withdraw consent.

The company commits to processing any data subject request related to their rights within thirty (30) days from the date of receipt, unless otherwise required by applicable laws or regulations.

8.1 General Retention Periods

• Account Data: retained while account is active plus 3 years.
• Message Content: retained per customer settings (default 2 years).
• Analytics Data: aggregated data retained for 5 years.
• Log Data: retained for 1 year for security and troubleshooting.

8.2 Meta Platform Data Retention

In compliance with Meta's Developer Platform Terms, we will delete Meta Platform Data:

• Upon user request through our accessible deletion mechanism.
• When retention is no longer necessary for legitimate business purposes.
• When we cease operating services through which the data was acquired.
• Upon Meta's request for user protection.
• When a user no longer has an account with us (unless data is properly aggregated/anonymized).
• When required by applicable law.
• Within 28 days if Platform APIs/features are unused.

8.3 Deletion Process

• Secure deletion using industry-standard methods.
• Backup purging within 90 days of deletion request.
• Third-party data removal coordination.

For users outside our primary operating jurisdiction:

• Data may be transferred to countries with different privacy laws.
• Appropriate safeguards implemented (Standard Contractual Clauses, adequacy decisions).
• Right to request information about transfer mechanisms.

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal information from individuals below this age threshold.

Our platform may contain links to third-party services. We are not responsible for the privacy practices of these external services.

We may update this Privacy Policy periodically. Material changes will be communicated through:

• Platform notifications.
• Email announcements.
• Website posting with prominent notice.

Users will be notified of any material updates to this Privacy Policy at least seven (7) days prior to their effective date through official communication channels.

13.1 Kingdom of Saudi Arabia (PDPL)

As a Saudi-based company, we comply with the Personal Data Protection Law:

• Lawful basis for data processing.
• Data subject rights including access, rectification, and deletion.
• Data localization requirements where applicable.
• Breach notification to the Saudi Data and AI Authority (SDAIA).

This policy is subject to the supervision of the Saudi Data and Artificial Intelligence Authority (SDAIA), which is the competent authority responsible for enforcing the Saudi PDPL.

13.2 European Union (GDPR)

• Legal basis for processing.
• Data Protection Officer contact information.
• Right to lodge complaints with supervisory authorities.

13.3 Other Jurisdictions

• California (CCPA/CPRA).
• Canada (PIPEDA).
• Australia (Privacy Act).
• Brazil (LGPD).

Andromeda Information Technology Co

Data Protection Officer:
Email: [email protected]
Phone: +966 920 012 888
Address: Dalmar Center, Imam Saud bin Abdulaziz bin Mohammed Road, King Fahd District, Riyadh, Kingdom of Saudi Arabia

General Inquiries:
Email: [email protected]
Phone: +966 920 012 888

Meta Platform Compliance:
Email: [email protected]

• Platform: the DutiesBook™ omnichannel communication system.
• Personal Information: information that identifies or relates to an individual.
• Processing: any operation performed on personal information.
• Meta Platform Data: data obtained from Meta's platforms (WhatsApp, Facebook, Instagram).
• Restricted Platform Data: Meta Platform Data that can identify particular users or devices.
• Third-Party Services: external platforms and APIs integrated with our service.

This Privacy Policy is governed by the laws of the Kingdom of Saudi Arabia and is subject to change. Users are encouraged to review this policy regularly for updates. Andromeda Information Technology Co affirms its full commitment to all applicable Saudi data protection regulations and maintains documented records of all processing activities in accordance with SDAIA requirements.