Privacy Policy

Business users: people who sign up for Aref and manage a workspace (owners, managers and staff).

End customers: people who message a business that uses Aref. For their data, the business is the controller and Aref processes it on the business’s behalf and instructions.

Account data: name, email address, mobile number (so our team can contact you about your account — never shown to your customers), password (stored only as a one-way hash), company name, business type, language and time-zone preferences.

Google Sign-In: if you choose “Continue with Google”, we receive your Google account’s email address, whether it is verified, your name and profile picture (scopes: openid, email, profile). We use them only to create or sign in to your Aref account.

Google Sheets: only if a business user chooses to connect Google, we access the spreadsheets that user selects (scope: spreadsheets) to read the rows the user asked Aref to use and to add new leads to the leads sheet Aref creates in the user’s Drive. We also use the drive.file scope, which covers only files Aref itself created, to check whether that leads sheet still exists (for example, if the user deleted it) so we can create a new one.

Connected channels: when a business connects a Facebook Page, Instagram account, WhatsApp number, Telegram bot or TikTok account, we store the access tokens the platform issues and the ID of the Facebook account that made the connection and receive the messages, comments, sender names/IDs, phone numbers (WhatsApp) and media sent to that business.

Business content: knowledge the business uploads (text, files, images, website pages), agent instructions, contacts, bookings, payment requests, store and business data the business connects.

Usage and technical data: pages visited inside the app, actions taken (audit log), IP address, browser type, and error logs, used to run, secure and improve the service.

If you sign up through a partner's link (?ref=), we keep the partner's code in a cookie for 30 days and link it to your account at signup to calculate their share.

Support messages: if you write to us from "Support" we keep your name, email, phone (if given), your message and IP address, to answer you and stop spam.

Hotel public booking pages: a guest booking on a hotel's Aref booking page gives their name, mobile number (email optional) and stay dates — this data belongs to the hotel and goes to it; we use the email only to send the booking confirmation, and may check the booking isn't automated with Cloudflare Turnstile.

To provide the service: receive customer messages, generate and send replies on the business’s behalf, show conversations to the business’s team, and run the features the business turns on (bookings, payments, campaigns, reports, alerts).

To secure the service: authentication, fraud and abuse prevention, monitoring and troubleshooting.

To keep replies accurate and support the business: a small number of Aref administrators may read the business’s conversations with its customers and the agent’s replies, read-only, to improve the agent and resolve problems. Every view is written to the account’s activity log with the person and the time.

To communicate with business users: service emails such as password resets, alerts, weekly reports (which can be turned off) and billing notices. If you stop partway through setting up (email not confirmed, no page connected, or the agent hasn't answered yet), our team may email you or text your mobile to help you finish.

We do not sell personal data, we do not use it for advertising, and we do not use end-customer conversations or Google user data to train AI models.

Aref’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Google user data is used only to provide the features the user asked for (signing in, reading the linked spreadsheet, writing leads to it). It is not transferred to third parties except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with notice to users; it is not used for advertising; and no human reads it unless the user gives explicit permission, it is needed for security or legal reasons, or it is aggregated and anonymized for internal operations.

Aref does not use or retain Google Workspace data (such as Google Sheets content) to develop, improve or train generalized AI and/or ML models — neither our own models nor any third party's. When a user asks the data assistant a question, only the part needed to answer that user's own question is sent to the AI model provider, under API terms that prohibit the provider from using it for training. Sheet data is stored only to show it to, and answer questions for, the same user, and is deleted when they remove the sheet, disconnect their account or request deletion of their data.

You can disconnect Google Sheets from inside Aref at any time and revoke Aref’s access at myaccount.google.com/permissions.

AI model providers (for example OpenAI, Anthropic or Google Gemini, as configured) receive the text or images needed to generate a reply, through their business APIs under their data-processing terms.

Messaging platforms (Meta for Facebook/Instagram/WhatsApp, Telegram, TikTok) receive the replies we send on the business’s behalf.

Payment processors (Paymob and Stripe) process payments; we do not store card numbers.

Cloudflare Turnstile checks that a real person (not a robot) is signing up with an email address; it sees your browser and IP address for that check only. We then email you a link to confirm your address.

When you choose a password we check it against known data breaches through the Have I Been Pwned service: only the first 5 characters of the password's hash are sent — the password itself and your email never leave us.

Our SMS provider (SMS Smart Egypt) receives only the account owner's mobile number and the message text, when our team texts them about their account.

Hosting, email delivery and infrastructure providers that run the service for us.

Authorities, when required by law or to protect rights and safety. We never share data with other Aref customers.

A partner who referred your account sees your business name shortened (first letters only), your signup date, whether you are a paying customer, and their share of your payments — nothing else and no conversations.

We keep account and business data while the workspace is active. Disconnecting a channel deletes its access tokens immediately and removes Aref’s permission from the Facebook or TikTok account that connected it (when no other live channel uses that account); conversations stay until the business deletes them or the account.

When an account is deleted we delete its data within 30 days; encrypted backups are overwritten within 14 days after that. We may keep limited records longer where the law requires (for example invoices).

All traffic uses HTTPS. Access tokens and integration credentials are encrypted at rest, passwords are hashed, every workspace’s data is isolated from other workspaces, and staff access is limited, logged and protected by two-step verification (authenticator app).

You can access and update your account data in the app, disconnect any channel or Google account, turn off optional features and emails, and ask us to delete your account and data (see the Data Deletion page).

End customers who want their data accessed or deleted can contact the business they messaged, or email us and we will forward the request and help the business act on it.

Aref is a business service and is not directed to children under 16. We do not knowingly collect their data from business users.

Our servers and some service providers may be located outside your country. We use providers with appropriate safeguards for international transfers.

We will post changes on this page and update the date above; significant changes will be notified by email or in the app.