Privacy & Data Protection Policy

CustBot Enterprise AI Agent Platform • Last Updated: October 2026

Zero Model Training Guarantee

We strictly commit that CustBot does NOT use or share your business data, knowledge bases, or customer conversation logs to train or refine any foundation AI models (such as OpenAI or Anthropic). Your data remains strictly isolated, encrypted, and your exclusive proprietary asset.

1

1. Scope & Regulatory Compliance

This Privacy Policy applies to all services and systems provided by CustBot ('the Platform', 'we', or 'us'). CustBot complies with leading global and regional data protection frameworks, including the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL), GCC regulatory frameworks, and the European General Data Protection Regulation (GDPR).

2

2. Categories of Data We Process

A. Business Account Data

Company name, commercial registration, admin profile (name, corporate email, phone), billing contacts, and subscription tiers.

B. Connected Channel Credentials

Encrypted API tokens and webhooks for WhatsApp (Meta Cloud API / Evolution), Instagram, Facebook Messenger, Telegram, and VoIP telephony.

C. Conversation & Voice Transcripts

Inbound and outbound messages, STT-transcribed voice audio, end-user inquiries, and session states strictly to deliver automated resolutions.

D. Knowledge Bases & Documents

PDF manuals, store product catalogs, FAQ repositories, and support docs indexed exclusively for your tenant's dedicated vector namespace.

3

3. Multi-Tenant Isolation & Encryption

CustBot enforces rigorous multi-tenant architectural boundaries ensuring absolute cross-tenant isolation:

  • Database RLS: PostgreSQL Row-Level Security with transactional tenant context verification.
  • Vector DB Isolation: Strictly isolated vector collections and namespaces per tenant.
  • Military-Grade Encryption: All external tokens and API keys are encrypted at rest using AES-256 / Fernet, with TLS 1.3 enforcing all transport in transit.
4

4. Authorized Third-Party Sub-processors

To deliver high-availability agentic workflows, CustBot partners strictly with certified global infrastructure providers bound by enterprise Data Processing Agreements (DPAs):

  • Payment Gateways: Moyasar (السعودية/الخليج), Paddle (عالمياً), Paymob (مصر/شمال أفريقيا).
  • Enterprise LLM Routers: Anthropic Claude, OpenAI, DeepSeek (عبر قنوات API مشفرة دون حفظ البيانات للتدريب).
  • Voice & Telephony: Deepgram Nova-2 (STT), ElevenLabs (TTS), Twilio (Telephony).
5

5. User Data Erasure & Meta Platform Compliance

In strict compliance with Meta Platform Policies and global data privacy acts, tenants and end-users may execute full data erasure via:

Execution Methods:

  1. Self-Serve Disconnection: Navigate to Channel Settings -> click 'Disconnect & Erase Data' to immediately purge webhooks, credentials, and associated conversation buffers.
  2. Formal Account Deletion: Email [email protected] with your Tenant ID; all data will be permanently wiped within 48 business hours with an automated confirmation receipt.
6

6. Immutable Audit Logs & Integrity

To safeguard corporate governance and provide auditable integrity, CustBot logs all agentic tool invocations, confidence checkpoints, and human handoffs to append-only, tamper-proof audit stores. These records provide definitive operational transparency for enterprise compliance.

7. Data Protection Officer (DPO) Contact

For regulatory inquiries, Data Subject Access Requests (DSAR), or compliance verification, contact our dedicated Data Protection Office:

Email: [email protected]Support: [email protected]