Privacy Policy

Last updated: 2026

Shafrah ("Shafrah", "we", "us") provides an AI-powered WhatsApp assistant that businesses use to communicate with their customers. This Privacy Policy explains what information we process, why we process it, and the choices you have.

When a business uses Shafrah AI, we act as a processor handling messages on that business's behalf; the business decides why and how its customers' data is used.

Who we are

Shafrah · شفرة is a software company based in Qatar, founded in 2024. We operate the Shafrah AI WhatsApp assistant. You can reach us at:

Information we process

When you message a business that uses Shafrah AI on WhatsApp, we process the information needed to receive your message, understand it, and reply on the business's behalf:

  • WhatsApp messages you send — text messages and voice notes.
  • Your WhatsApp phone number and WhatsApp profile name.
  • The content you share in the conversation (questions, requests, and similar information).
  • Meeting and booking details you provide — for example your name, the service you want, and a preferred date or time.
  • Basic technical metadata from WhatsApp, such as message timestamps and delivery status.

How we use your information

We process this information only to operate the assistant on behalf of the business you contacted. Specifically:

  • To receive and understand your messages, including transcribing voice notes into text.
  • To generate and send relevant replies on the business's behalf.
  • To book or schedule the meetings and appointments you request.
  • To keep the conversation history so the business can follow up with you.

Service providers (sub-processors)

To deliver the service we share the minimum data necessary with trusted providers. Each provider may process your data only to perform its part of the service:

  • Meta / WhatsApp (WhatsApp Cloud API) — to receive and send messages on WhatsApp.
  • OpenAI — to transcribe voice notes into text.
  • OpenRouter — to generate AI replies.
  • ElevenLabs — to generate voice responses.

Each provider handles data under its own terms and security commitments.

Lawful basis

We process data to perform the service requested by you and by the business you contacted, and to support the legitimate interest of running a reliable customer-service assistant. Where applicable law requires it, processing is based on your consent, which you may withdraw at any time.

Data retention

We keep conversation data only as long as needed to provide the service and to comply with legal obligations. The business that uses Shafrah AI controls its own retention preferences; when data is no longer needed it is deleted or anonymized.

Data security

We use technical and organizational measures to protect your data, including encrypted connections (TLS), access controls, and strict tenant isolation so each business's data is kept separate.

We do not sell your data

We do not sell your personal data, and we do not use your conversations to advertise to you.

Your rights

Subject to applicable law, you may request to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data.
  • Object to or restrict certain processing.

To exercise these rights, contact the business you messaged, or reach us using the details below.

Data deletion

You can ask for your data to be deleted at any time. See our Data Deletion Instructions for the steps and the timeframe.

Children

Shafrah AI is intended for business communications and is not directed at children below the age required by applicable local law.

Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page.

Governing law

This Privacy Policy is governed by the laws of the State of Qatar.

Contact

For privacy questions or requests, contact us: