Privacy Policy

1. Information We Collect

• Account data: email address, name, profile info, and authentication identifiers (including Google account identifiers when you sign in with Google).
• Business profile: business name, industry, audience description, and other onboarding details you provide.
• CRM data: contacts, leads, and related notes you or your team upload or capture through the Service.
• WhatsApp / Meta integration data: phone-number IDs, WhatsApp Business Account IDs, verified display names, and access tokens (stored encrypted).
• Customer conversations: messages exchanged with your customers through connected channels, including WhatsApp.
• AI prompts and outputs: the prompts, inputs, and generated outputs (text, images, brand assets, sites, plans, replies) created through the Service.
• Generated content and websites: brand kits, logos, marketing content, and sites created or published under your account.
• Uploaded files: logos, images, and other assets you upload.
• Usage and device data: pages visited, features used, device and browser information, IP address, coarse location derived from IP.
• Billing metadata: subscription plan, status, environment, and Paddle identifiers (customer ID, subscription ID). Card details are handled and stored only by Paddle.
• Cookies and local storage: essential cookies and browser storage for authentication, session, language preference, and limited product analytics.

2. How We Use Your Information

We use your information to operate the Service, authenticate accounts, process subscriptions, deliver AI-generated outputs, route messages to and from your connected channels, provide customer support, prevent abuse and fraud, improve product quality, and communicate important updates.

3. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties. Ever.

4. Subprocessors and Service Providers

We share data only with subprocessors required to operate Arab Whale, and only to the extent necessary. Current categories include:

• Cloud hosting and database: Supabase / Lovable Cloud (hosting, database, authentication, storage).
• Edge network and DDoS protection: Cloudflare (including Turnstile bot protection on sign-in).
• AI model providers: the Lovable AI Gateway and its underlying model providers (currently including Google Gemini and OpenAI-compatible models) for AI generation.
• Messaging platforms: Meta Platforms (WhatsApp Cloud API, Facebook, Instagram) when you connect those channels.
• Payments and Merchant of Record: Paddle.com Market Limited.
• Identity providers: Google (only when you choose Google sign-in).
• Email delivery: our transactional email provider (for account, billing, and product emails).

Some of these providers process data outside your country, including in the United States and the European Union. Where required, we rely on standard contractual clauses or equivalent safeguards.

5. Payment Processing

All payments are processed by Paddle.com, our Merchant of Record. Paddle collects and processes your billing information under its own privacy terms. Learn more at paddle.com/legal/privacy.

6. Data Retention & Deletion

We retain your data for as long as your account is active. You can request deletion of your account from Settings, or by emailing support@arabwhale.com. On deletion, your personal data, CRM data, conversations, prompts, generated outputs, and uploaded assets are deleted or anonymized within 30 days, except where retention is required by law (for example, tax and invoicing records held by Paddle). Encrypted WhatsApp access tokens are deleted immediately when you disconnect the integration.

7. Your Rights

Depending on where you live, you have the right to access, correct, export, delete, or restrict processing of your personal data, and to object to certain processing. To exercise any of these rights, email support@arabwhale.com.

8. Security Measures

Security measures we actually implement include: TLS encryption in transit, database encryption at rest, row-level security so accounts can only read their own rows, per-user encryption of WhatsApp access tokens using AES-256-GCM, signed and idempotent payment webhooks, Cloudflare Turnstile bot protection on sign-in, and rate limiting on expensive endpoints. No system is perfectly secure and we make no claim to any certification not listed here.

9. Cookies and Local Storage

We use essential cookies and browser storage for authentication, session management, language preference, and Cloudflare Turnstile bot protection, plus limited product analytics.

10. Children

The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. AI Content

Prompts you submit and outputs you generate are processed by AI providers listed above. We do not knowingly use your prompts or generated content to train third-party foundation models; where a provider retains data for abuse monitoring under its own terms, that retention is limited to what the provider requires.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice.

11. Contact

Questions about privacy? Contact us at support@arabwhale.com.