Privacy Policy

This policy covers website visitors, SalemAI account holders, employees of businesses using the service, and people who message those businesses or comment on their posts.

ORDES determines the purposes of processing for registration, account administration, billing and support. When a business connects its channels or uploads customer information, that business determines how the information is used, authorizes its staff and configures automation; SalemAI processes it to provide the functions chosen by the business. The business is responsible for the lawfulness of the data it supplies, informing its customers and obtaining necessary consents. If you communicated with a business through SalemAI, you may contact that business or us; we can help identify the workspace relevant to your request.

Account and business information: name, email, telephone number, company details, workspace members and their roles; information supplied for subscriptions or invoices, including business billing details, amounts, payment identifiers and payment status. SalemAI account passwords are stored as hashes.

Information you enter or upload: support requests, messages, contact details, inquiries, deals, orders, appointments, notes, documents and knowledge-base materials. If meeting recording and transcription features are used, uploaded audio and resulting transcripts are processed. The information depends on the enabled features and what you provide.

Technical information: session identifiers, IP addresses and browser information in requests and security logs, operation times and results, errors, connected channels and quota usage. If you enable push notifications, we store the browser notification subscription information.

Instagram: connecting a professional account through Meta provides the account identifier, username and profile information made available by the API, an access token and permission information. Depending on available and enabled features, processing may include post identifiers and details, comment text and identifiers, information about commenters, Direct messages, participant identifiers, message timestamps and available attachment metadata. These support the inbox, replies, comment rules and linking an inquiry to a CRM contact.

WhatsApp Business: connecting through Meta involves business account and phone number identifiers, the displayed number, an access token and connection information. Messaging involves message identifiers, the correspondent’s phone number or identifier, available profile name, text, button replies, timestamps and technical message information. Webhook events may also contain delivery status and attachment metadata; receiving an event does not mean every attachment type is supported by a particular feature.

Access is limited to connected business accounts, the permissions granted through Meta and the functions enabled. Connecting an account does not give SalemAI access to all of a user’s private conversations. Facebook, Instagram and WhatsApp passwords are entered on the relevant platform, not provided to SalemAI.

When WhatsApp is connected through Twilio, messages also pass through Twilio. Delivery involves sender and recipient WhatsApp addresses, content, available metadata and message statuses, Twilio identifiers, and connected phone number and account information. Connection credentials allow the service to call Twilio APIs. Connecting through Twilio does not grant access to private conversations outside the connected business channel.

We use information for sign-in and access administration, the dashboard and connections, receiving and sending messages, bots and human agents, comment handling and configured replies, contact and conversation history, CRM, orders and appointments. It also supports search, inquiry analysis, summaries and statistics selected by the business, subscription and quota accounting, support, troubleshooting and abuse prevention.

Campaigns and other outbound messages are allowed only within available functions, platform permissions and the required recipient consents. Businesses must respect opt-outs. A comment on a post is not, by itself, consent to unlimited marketing messages. One business’s contacts and conversations are not provided to other SalemAI customers for their campaigns.

An authorized business representative connects Instagram and WhatsApp through Meta’s authorization process. SalemAI receives tokens and permissions for the selected functions; Meta’s approval of the application does not replace permission from the account owner.

You can disconnect a channel in SalemAI and revoke application permissions in the relevant Meta account settings. Functions dependent on revoked access stop working. Disconnecting a channel does not automatically erase previously stored messages, contacts or CRM records. To request their deletion, follow section 11.

Twilio connections also use sender and webhook settings in Twilio. To stop event delivery, disconnect the SalemAI channel and the relevant connection settings in Twilio. Revoking Meta permissions or disconnecting Twilio does not replace a request to delete stored data.

SalemAI uses OpenAI APIs for AI features. Depending on the task, the provider may receive the request or message text, portions of conversation history needed for a response, business instructions, selected knowledge-base materials and workspace context. Audio recordings or documents may be transmitted when speech or document recognition is used. Processing includes generating replies, semantic search, extracting information, transcription and summaries.

Message content is processed for the functions selected by the business. The AI provider’s processing and retention conditions depend on the service and its configuration; you can ask us about the providers involved. Do not upload information that cannot be sent to an external provider for the selected task. Businesses should inform customers about automation and provide a way to reach a person when needed.

Conversations and workspace information are available to authorized business members within their access rights. Technical providers process data to operate the service: Meta for connected Instagram and WhatsApp accounts, OpenAI for AI features, Resend for service emails, and Halyk/ePay when that payment method is used. The information transmitted depends on the operation, such as an email address and message content for delivery, or payment information for processing.

The application and database are hosted using Hyper Cloud infrastructure (Hyper Cloud Solutions LLP), which processes information when providing hosting services. If a business separately connects Telegram, Wazzup or another external integration, information needed for that integration is transmitted according to the business’s settings. Those services have their own terms and policies. We do not sell data received through Meta or the contents of customer conversations. Information may be disclosed to public authorities where an applicable lawful requirement exists.

Using international providers may involve processing outside the user’s country. Contact info@salemai.kz for a provider list, available processing-location information and conditions relevant to a particular connection. This policy does not state that all data or all copies are located in a single country.

Twilio is an additional messaging and processing provider for WhatsApp channels connected through Twilio. Its involvement depends on the chosen connection method; Twilio’s own terms and privacy policy also govern its processing and retention.

The service uses authentication, workspace access controls and checks that data belongs to the relevant business. Configurations containing tokens for new channel connections are stored using separate encryption; SalemAI passwords are hashed. HTTPS is used for external API communication, and incoming Meta events are checked using their cryptographic signature.

The service needs access to conversations to display history, support human agents and run enabled AI functions. Messages stored and processed in SalemAI therefore should not be treated as inaccessible to the service operator and its processors. Do not send passwords, one-time codes, access tokens or full payment card details to support.

Account and workspace information is retained to provide the service. Messages, contacts, documents and CRM records form the business’s working history; there is no single automatic deletion period for all these categories. Some information can be deleted through the available dashboard controls; other categories or a complete set of data require a request. Deleting a conversation does not necessarily remove a linked contact, inquiry or deal.

Disconnecting a channel, deleting an account and deleting all related information are different actions. A request can also cover connection data, processed events, search indexes and related records; we clarify the scope when reviewing it. Certain financial, transaction, security or dispute records may need to be retained within applicable legal requirements. We will explain if this limits a request.

Request handling and deletion from backups or provider systems depend on the information and systems involved. Ask us about those periods when making a request. We do not promise immediate erasure of every copy or treat channel disconnection as confirmation of such erasure.

Cookies support sign-in sessions and site settings. Browser local storage may retain interface preferences, dismissed guidance and assistant history on that device. Meta authorization and other external services may use their own cookies when their pages are opened.

You can remove cookies and local data in your browser settings; this may sign you out and reset preferences. Clearing the browser does not erase information already stored on SalemAI servers or a connected platform. Sign out on shared devices and clear local data where appropriate.

To request information about processing, access to your data, correction, deletion or an end to processing based on consent, email info@salemai.kz. Include your SalemAI account email or the business you communicated with, the relevant Instagram account or WhatsApp number, and the nature of your request. Do not send your password or a verification code.

To prevent disclosure or deletion of someone else’s information, we may request proportionate verification of your connection to the account, business or conversation. If the request concerns information controlled by a customer business, we will coordinate with that business. We will explain the action taken or relevant limitations and reasons under applicable requirements. You can also send a marketing opt-out directly to the sending business.

Deleting information from SalemAI does not delete an Instagram or WhatsApp account or end the platform’s independent data processing. Detailed request instructions are available below.

We update this policy when service functions or processing practices change. The current version is published here with its update date. Where a change requires additional notice or consent, that is provided or requested through the appropriate process; publishing a policy does not itself replace required consent.

SalemAI operator: LIMITED LIABILITY PARTNERSHIP "ORDES" (ТОО «ORDES»). For questions about privacy, AI, connected providers, access or deletion, write to info@salemai.kz. You can use “SalemAI personal data” as the subject.