Privacy Policy
GAWDA Bot helps businesses answer their customers on Facebook Messenger, Instagram, WhatsApp, Telegram and their website from one place, with chatbots, a shared inbox, AI assistants, broadcasts and reports. This policy explains what data the service handles, why, who it is shared with, how long it is kept, and how you can have it deleted.
1. Who we are
GAWDA Bot is operated by GAWDA ("we", "us"). Address: 44 Mohamed Ahmed Mahmoud. You can reach us about privacy at info@gawda.net.
2. Our role
- For our account holders (the businesses and their team members who sign up), we decide how their account data is used, so we are the data controller.
- For the people who message those businesses (their customers), the business decides why and how their conversations are handled. The business is the controller and we process that data on the business's behalf and on its instructions, as its service provider (processor).
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, phone number, password (stored hashed), company name, language, time zone, team members and their roles | You, when you register or are invited |
| Billing data | Package, payment history, invoices. Card details are entered on the payment provider's page and are not stored by us | You and our payment providers |
| Connected channels | Page, Instagram and WhatsApp account identifiers and names, and the access tokens that let the service act for you | Meta, Telegram, when you connect a channel |
| Conversation data | Messages, comments and media sent to or from the business, sender name and profile picture, platform user ID, phone number or WhatsApp user ID, labels, notes, form answers, bookings and orders | The business's customers, through the connected channels |
| Usage and device data | IP address, browser type, pages visited in the dashboard, log-in times, error logs | Collected automatically when you use the dashboard |
4. Data we receive from Meta platforms
When a business connects a Facebook Page, an Instagram professional account or a WhatsApp Business account, it grants the service specific permissions. We use each one only for the feature the business turned on:
| Platform | What we receive | What it is used for |
|---|---|---|
| Facebook Pages & Messenger | Page name and ID, messages and attachments sent to the Page, comments on the Page's posts, the sender's name, profile picture and Page-scoped ID, Page and post insights, leads from the Page's lead forms | Showing and answering messages and comments, running the chatbots the business built, publishing and scheduling the business's posts, Page reports |
| Account name and ID, direct messages, comments and mentions, the sender's username and Instagram-scoped ID, account and media insights | Showing and answering messages and comments, automations, publishing posts, Instagram reports | |
| WhatsApp Business Platform | The business phone number and account details, messages and media the business receives, the customer's profile name and phone number or WhatsApp business-scoped user ID, delivery and read statuses, message template status and quality information | Showing and answering conversations, chatbots, sending the template messages and broadcasts the business creates, delivery reports |
| Ads (only if connected) | Ad account names, campaigns and their results, the ad a conversation started from | Ad reports and showing which ad a customer came from |
Businesses are responsible for getting their customers' permission before sending them WhatsApp messages, and for using templates and broadcasts only as WhatsApp allows.
5. Data we receive from Google
Some features use a Google account. Each one asks for its own permission, only when you use that feature, and we use it only for that feature:
| Feature | Permission and what we receive | What it is used for |
|---|---|---|
| Sign in with Google | Your name, email address and profile picture (userinfo.email, userinfo.profile) | Creating your account and signing you in |
| Google Sheets | Permission to read and edit Google Sheets spreadsheets (spreadsheets, drive.file), and the email address of the connected Google account. We only open the spreadsheets the service creates for you and the ones you add to it yourself; we do not browse your other Google Drive files | Creating the spreadsheets you ask for, connecting a spreadsheet you add, and adding rows to them, for example new leads, orders or form answers |
| YouTube | Your channel name and ID, your videos and their comments, and permission to reply to, moderate and delete comments and to manage your videos (youtube.force-ssl) | Showing your channel's comments in the inbox, replying to them, the comment automations you set up, and video reports |
| Google Calendar | Permission to add, change and delete events on the calendar you connect (calendar.events), to see only when that calendar is busy or free (calendar.freebusy), and the email address of the connected Google account. We only change the events the service creates for your bookings, and we do not read the titles or details of your other events | Adding each appointment the AI assistant books to your calendar, moving or removing it with the appointment, and not offering customers times you are already busy |
The YouTube features use YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy explains how Google handles your data.
The access tokens and the data each feature needs are stored on our servers and are not shared, except with the AI provider when you turn on an AI feature for YouTube comments (section 7). You can disconnect a Google account in the dashboard at any time, and you can remove our access from your Google account at myaccount.google.com/permissions. When you disconnect a YouTube channel, our access stops at once and the data recorded for it is deleted when the archive period you choose ends, or right away if you choose to delete it. Spreadsheets we created stay in your own Google Drive.
6. How we use data
- To provide the service: receiving and sending messages, running chatbots and automations, the shared inbox, assigning conversations to team members, bookings, broadcasts, scheduled posts and reports.
- To keep accounts safe: logging in, checking that requests really come from Meta, preventing abuse and fixing errors.
- To bill and support you: packages, payments, invoices, answering support requests.
- To tell you about your account: service notices, balance and security alerts. Marketing emails only with your consent, and you can unsubscribe at any time.
- To meet legal obligations.
The legal bases we rely on are performance of our contract with the business, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations.
7. AI features
If a business turns on the AI assistant, conversation summaries or other AI features, the text needed for that task (for example, the customer's latest message, recent conversation history and the business's own knowledge files) is sent to the AI provider the business or platform selected, such as OpenAI, Anthropic, Google or OpenRouter, and the answer is returned to the conversation. These providers process the data to produce the answer. Some providers may keep requests for a limited time under their own terms, for example to prevent abuse. AI features are optional and the business can turn them off at any time. AI answers are marked as such in the inbox.
9. How long we keep data
- Account and conversation data is kept while the account is active, so the business keeps its history.
- When a business disconnects a channel, its data is kept archived so it can be reconnected later, unless the business asks us to delete it.
- When an account is deleted, or deletion is requested (section 10), we delete or anonymise the related data within 30 days. Copies in backups are overwritten within a further 60 days.
- Billing records are kept for as long as tax and accounting law requires.
- Files customers send (images, voice notes, documents) are kept with the conversation they belong to and deleted with it.
10. Deleting your data
If you have a GAWDA Bot account
- To remove one channel, open it in the dashboard and choose Disconnect.
- To delete your whole account and all its data, email info@gawda.net from the email address on the account with the subject "Data deletion request".
- We confirm by email and complete the deletion within 30 days.
If you used "Log in with Facebook" or connected Facebook or Instagram
- On Facebook, open Settings & privacy → Settings → Apps and websites (on Instagram: Settings → Website permissions → Apps and websites).
- Remove GAWDA Bot. Meta then sends us a deletion request automatically.
- We delete the data we received about you through that connection and give Meta a confirmation code and a link where you can check the status of the deletion.
If you signed in with Google or connected Google Sheets, Google Calendar or YouTube
- Disconnect the Google account or YouTube channel in the dashboard, or open myaccount.google.com/permissions and remove GAWDA Bot.
- Our access stops at once. To have the data we received through it deleted, email us as above; we complete it within 30 days.
If you messaged a business that uses GAWDA Bot
Your conversation belongs to that business. Ask the business directly to delete it. You can also email us at info@gawda.net with the business name and your phone number or profile name, and we will pass the request to the business and help it complete it.
11. Your rights
Depending on where you live (including under the GDPR and Egypt's Personal Data Protection Law No. 151 of 2020), you can ask to access the data we hold about you, correct it, delete it, get a copy in a portable format, restrict or object to its use, and withdraw consent you gave. Email info@gawda.net. We answer within 30 days and may ask you to confirm your identity first. You can also complain to your data protection authority.
12. Security
The service runs over encrypted HTTPS connections. Passwords are stored hashed, access tokens are kept on our servers with restricted access, team members only see the channels their role allows, and every message notification from Meta is checked with Meta's signature before it is accepted. No system is completely secure; if a breach affects your data, we will tell you and the authorities as the law requires.
13. International transfers
Our servers and some of our service providers may be in countries other than yours. When data leaves your country, we rely on safeguards the law recognises, such as the provider's standard contractual clauses.
15. Children
The service is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
16. Changes to this policy
When we change this policy, we update the date at the top. If the change is significant, we tell account holders by email or in the dashboard before it takes effect.