SadaBot is a customer-messaging and support product from CODE NUTS. It lets a business receive and answer messages from its own customers across WhatsApp, Facebook Messenger, Instagram, Telegram and a chat widget the business embeds on its website, with replies drafted automatically from content that business has provided.
This policy explains what personal data SadaBot handles, why, who it is shared with, how long it is kept, and how to have it deleted.
1. Two different roles — please read this first
CODE NUTS holds two different responsibilities, and which one applies determines who you should contact about your data.
We are the controller of business account data
When a business subscribes to SadaBot, we decide how we handle that business's own account information — the people who sign in, their contact details, and the subscription record. For this data, CODE NUTS is the data controller and you can contact us directly.
We are a processor for end-customer conversation data
When someone messages a business through SadaBot, that conversation belongs to the business. It decides why it is collected, what is stored against a contact, and when it is deleted. We handle it only on that business's instructions, to provide the service to them. For that data the business is the controller and CODE NUTS is the processor.
Practically: each business controls its own customers' data. If you are an end customer who messaged a business, the business's own privacy policy governs that conversation. If you send us a deletion or access request about it, we do not decide it ourselves — we route it to the business you were messaging and help them carry it out (see section 12).
2. What data we handle
2.1 Business account data (we are the controller)
- Name, email address, and optionally a mobile number and profile picture, for each user who signs in.
- Authentication data: a hashed password, two-factor settings, and passkey credentials where used.
- The organisation's name, language preference, team structure, roles and permissions.
- Subscription and plan data, and usage counters used for billing and quotas. Card payments are handled by our payment processor; we do not receive or store full card numbers.
- Security and audit records: sign-in activity, and a log of administrative actions taken in the account.
2.2 End-customer conversation data (we are the processor)
- Message content — the text of messages sent and received, in both directions, including replies drafted by the service and notes written by the business's agents.
- Media attached to messages — images, video, audio and voice notes, documents and stickers.
- Profile names as supplied by the messaging platform, and usernames or handles where the platform provides them.
- Channel user identifiers — the identifier the platform uses for you: a WhatsApp phone-number identifier (or a username-based identifier where WhatsApp no longer shares the number), a Messenger page-scoped ID, an Instagram-scoped ID, a Telegram chat ID, or a randomly generated visitor ID for the website widget.
- Phone numbers and email addresses, where the platform provides them, where you supply them in a conversation or a contact form, or where the business adds them itself.
- Contact details the business records about you — for example company, job title, city, address, notes, tags, and its own sales-stage labels.
- Conversation metadata — timestamps, which channel was used, delivery and read status, message reactions, ratings and any feedback comment you leave, and whether a human agent took over.
- Business knowledge content — documents, spreadsheets, web pages and text the business uploads so replies can be grounded in its own material. This is the business's content and may contain personal data it has chosen to include.
2.3 Technical logs
We keep short-lived technical logs to operate the service and diagnose faults. These record identifiers and event shapes — for example a message ID, a channel identifier, an event type and a timing — and are deliberately built so that message content is not written to them. They are retained for a limited period and deleted automatically (section 10).
3. Where the data comes from
- WhatsApp, through the WhatsApp Business Platform, when you message a business's WhatsApp number.
- Facebook Messenger, when you message a business's Facebook Page.
- Instagram, when you send a direct message to a business's Instagram account.
- Telegram, through the Telegram Bot API, when you message a business's bot.
- The website chat widget the business embeds on its own site.
- The business itself, when it types in or imports contact details, or uploads knowledge content.
- Our payment processor, for subscription and payment status (business accounts only).
Messages reach us because you chose to contact a business on a channel it operates. We do not buy contact lists, and we do not obtain your data from data brokers.
4. Why we handle it
- To deliver the service — receive, route, store and display messages, and send the business's replies back to you on the same channel.
- To draft replies automatically — see section 5.
- To hand over to a human — so an agent at the business can take over a conversation and see its history.
- To give the business reporting about its own conversations and response quality.
- To bill and meter the business's subscription and enforce plan limits.
- To keep the service secure — prevent abuse and unauthorised access, and investigate incidents.
- To comply with law and with the rules of the messaging platforms we connect to.
Where data-protection law requires a legal basis, we rely on: performance of a contract (with the subscribing business); our and the business's legitimate interests in operating and securing a support service; consent where the law requires it, including the consent the business must obtain before sending you marketing messages; and compliance with legal obligations. For end-customer conversation data, the business determines the legal basis and we act on its instructions.
5. Automated reply drafting (AI)
To draft a reply, the service sends the relevant part of the conversation and matching extracts from the business's own knowledge content to an AI provider, which returns suggested text. Some processing also converts the business's content into numerical representations so relevant passages can be found.
- Replies are generated from the business's own material. They can still be wrong or incomplete, and they are not professional advice.
- A business can switch automated replies off, and you can ask to speak to a human at any time in the conversation.
- No decision that has a legal or similarly significant effect on you is made automatically by the service.
On training. We do not sell personal data, we run no advertising, and we do not train our own models on your data. For processing done on our own accounts, AI providers process it under their own terms, and we select the plans and settings under which customer data is not used for the provider's own model training. We cannot control a provider's terms; if one changes materially we will update our Sub-processors page.
When a business uses its own AI provider account. A business can connect its own account with an AI provider, using its own API key, and choose which provider and model power its AI features, such as drafting replies and summarising conversations. In that case the provider processes that business's conversation data under the business's own agreement with that provider, not under ours: the business chose the provider and holds the account, and the terms of that agreement, including how the provider may use the data, are the ones that apply. We send the content to the provider on the business's instruction, and we do not select the plan or its settings. If you are an end customer, the business you messaged can tell you which provider it uses.
6. Who we share it with
We share personal data only with the service providers needed to run the service, only to the extent needed, and under contracts that require them to protect it. They fall into four groups: infrastructure and email delivery, the messaging platforms the messages travel over, AI providers, and our payment processor.
Each provider is named on our Sub-processors page, kept separately so the list stays current without amending this policy. Which AI provider is involved depends on the provider selected for the business.
We do not sell personal data. We do not use it for advertising, ad targeting or profiling, we do not share it with advertising networks, and we do not use one business's data for the benefit of another. Each business's data is kept separated from every other business's in the service.
7. Legal disclosure
We may disclose personal data where we are required to do so by law, or in response to a valid request from a public authority — for example a court order, a lawful demand from a regulator, or a law-enforcement request that meets the requirements of applicable law. We may also disclose it where necessary to establish, exercise or defend a legal claim, or to protect the rights, safety or property of a person.
We assess each request and disclose only what it actually requires. Where the data belongs to a subscribing business, we will notify that business before or as soon as reasonably practicable after disclosing, unless we are legally prohibited from telling them — for example where a court order forbids notice.
8. Business transfers
If CODE NUTS is involved in a merger, acquisition, reorganisation or sale of all or part of its assets, personal data may be transferred to the acquiring or successor entity as part of that transaction. Any such recipient remains bound by this policy, or by a policy at least as protective, until you are told otherwise.
We will give affected businesses prior notice of a transfer of this kind, so they can exercise the rights available to them — including closing the account and having its data deleted — before the transfer takes effect.
9. Where the data is processed
We are based in Egypt. Some of the providers named on our Sub-processors page process data outside Egypt, including in the United States and the European Union. Where such a transfer is subject to data-protection law, we rely on the safeguards that law provides, such as standard contractual clauses in our agreements with those providers.
10. How long we keep it
- Conversation and contact data: kept while the subscribing business's account is active, and until that business deletes it. A business can delete individual messages, contacts and conversations in the product at any time.
- Business account data: kept while the account is open.
- After an account is closed: we delete the account's data, including conversation content and media, within 90 days — except records we are required to keep by law, such as billing and tax records.
- Technical logs: deleted automatically on a short cycle — diagnostic logs within about 14 days, channel event logs within about 21 days, and execution traces within about 30 days.
- Backups: deleted data may persist briefly in encrypted backups until those backups age out on their normal cycle.
11. How we protect it
- Traffic to and from the service is encrypted in transit (HTTPS/TLS).
- Access tokens, platform credentials and other secrets are encrypted at rest and are never displayed back once saved.
- Incoming messages from the messaging platforms are cryptographically verified, so a third party cannot inject messages into a business's inbox.
- Every business's data is isolated at the query level, and access within a business is limited by role.
- Files exchanged in conversations are stored privately and served only through unguessable, single-purpose links.
No service can promise perfect security, but if a breach affects your personal data we will notify the subscribing business and the relevant authority as required by law.
12. Your rights, and how to request deletion
Subject to applicable law, you can ask to access your data, correct it, have it deleted, object to or restrict its use, receive a copy in a portable form, or withdraw consent you have given. Exercising these rights is free, and we will not treat you differently for it.
If you messaged a business through SadaBot (end customers)
That business is the controller of your conversation, so the fastest route is to ask the business directly — you can reply in the same chat. If you prefer, write to us at support@sadabot.com and tell us which business you were messaging and on which channel. We will route your request to that business and assist them in carrying it out. We will not delete or disclose a business's conversation records on our own initiative, because they are not ours to decide about — but we will not ignore your request either.
If you use SadaBot on behalf of a business
You can update your own profile in the product, and an administrator of your organisation can remove users and delete contacts and conversations. To close an account and have its data deleted, write to support@sadabot.com.
We aim to respond to any request within 30 days. We may need to verify who you are before we act, and we will explain if a legal exception prevents us from doing what you asked. If you are not satisfied with our response, you can complain to your local data-protection authority.
13. Children's privacy
SadaBot is a business tool. The service is not directed to anyone under the age of 16, and we do not knowingly collect personal data from anyone under 16.
If you are a parent or guardian and believe a child under 16 has provided personal data through the service, write to support@sadabot.com and we will act to have it removed. Where the data sits in a business's conversation records, that business is the controller, so we will route your request to it and assist them in removing the data promptly.
14. Cookies and local storage
- This policy page sets no cookies and makes no third-party requests.
- The signed-in product uses a session cookie to keep a user logged in, and stores small preferences such as light or dark mode. These are necessary for the product to work; we do not use advertising or tracking cookies.
- The website chat widget stores a conversation identifier in your browser's local storage so your chat is still there if you reload the page. Clearing your browser storage ends that link.
15. Changes to this policy
If we change this policy we will update the date at the top of this page, and for significant changes we will notify subscribing businesses. The current version is always published at this address. Our list of sub-processors is maintained separately, on the Sub-processors page, and carries its own date.
16. Contact us
For any question about this policy, or to exercise a right described in section 12, email support@sadabot.com. Our full legal identity and registered address are set out immediately below.