Privacy Policy

Effective date: October 17, 2026

Jawab ("Jawab", "we", "us") is an AI-powered customer messaging platform operated by Agent Lab, Iraq. Businesses ("Customers") use Jawab to receive and reply to messages from their own clients ("End Users") on Facebook Messenger, Instagram, WhatsApp and other channels. This policy explains what personal data we process, why, who we share it with, and the choices available to you.

1. Our role

For End Users (people who message a business that uses Jawab), the business is the party that decides how your data is used, and Jawab processes that data on the business's behalf. If you have a question about a specific business, you may contact that business directly or contact us using the details below and we will assist.

For Customers (businesses and their staff who hold a Jawab account), Jawab decides how account data is used, as described in this policy.

2. Data we collect

2.1 Data received from Meta platforms (Facebook, Instagram, WhatsApp)

When a business connects a Facebook Page, Instagram professional account or WhatsApp Business number to Jawab, we receive through the official Meta APIs:

• Page, Instagram account and WhatsApp number identifiers and the access tokens the business grants us.
• The platform-scoped ID of each person who messages or comments, and the public profile name where the platform provides it. For WhatsApp, this includes the sender's phone number.
• The content of messages and comments sent to the business, including text, images, voice notes and other attachments, and the replies sent by the business or its assistant.
• Message metadata such as timestamps and delivery status.

We only receive conversations that End Users start with a business, or comments posted on that business's own Page or account. We do not access your personal timeline, friends list or private messages with anyone other than the connected business.

2.2 Data provided during a conversation

End Users may choose to share details such as their name, phone number, delivery address, order details or appointment preferences so the business can complete a request.

2.3 Customer account data

Business name and type, the name, email address and phone number of account users, login credentials (stored as secure hashes), product, service and pricing information, documents the business uploads for the assistant to answer from, settings, and subscription records.

2.4 Technical data

IP address, browser and device information, push-notification tokens for the dashboard app, and error and security logs.

3. How we use data

• To receive messages and comments and to generate and send replies on the business's behalf, including AI-drafted replies.
• To transcribe voice notes and read attachments so they can be answered.
• To record orders, bookings and customer details that the business manages in its dashboard.
• To hand a conversation over to a human staff member when needed, and to notify staff of new messages.
• To operate, secure, troubleshoot and improve the reliability of the service.
• To manage Customer accounts, subscriptions and support.
• To comply with legal obligations and platform policies.

Each assistant is limited to the business that configured it. Data from one business is never used to answer the clients of another business.

4. AI processing

To draft replies, transcribe audio and search a business's documents, message content is sent to third-party AI model providers acting as our sub-processors. Content is sent only for the purpose of serving that conversation. We do not use End User conversations to train AI models, and we select providers whose API terms do not permit them to train on data submitted through their APIs.

5. Sharing

We do not sell or rent personal data. We share it only with:

• The business you are communicating with, through its Jawab dashboard.
• Meta Platforms, to deliver messages through Messenger, Instagram and WhatsApp.
• Service providers who process data on our instructions:

• Authorities, where required by applicable law or to protect the rights and safety of users and the public.

These providers may store data in data centres outside Iraq. We rely on their contractual and security commitments to protect it.

6. Retention

Conversation and customer data is kept for as long as the business keeps its Jawab account active and the data in its dashboard, so the business can follow up on orders and enquiries. When a business disconnects a channel or closes its account, or when a valid deletion request is received, the related data is deleted from our live systems within 30 days and is removed from backups as they expire on their normal rotation cycle. Limited records may be kept longer where the law requires it.

7. Security

Data is encrypted in transit (HTTPS/TLS). Platform access tokens are encrypted at rest. Access to each business's data is restricted to that business's authorised users and is enforced at the database level. Passwords are stored as salted hashes, and administrative actions are logged.

8. Your rights and choices

You may request access to, correction of, or deletion of your personal data, or object to its processing. End Users may also simply stop messaging a business at any time. To request deletion, follow the steps on our Data Deletion page. We respond to verified requests within 30 days.

9. Children

Jawab is a business tool and is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided data through a business conversation, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. Significant changes will be communicated to Customers through the dashboard.

11. Contact

Agent Lab — Jawab
Iraq
WhatsApp: +964 773 781 2200