Privacy Policy

1. Who we are and our role

Samaal is operated by Kiel (kiel.mv), based in the Republic of Maldives (“Kiel”, “we”, “us”). We play two different roles:

• Controller for the account information of people who sign up for or use Samaal (for example a business owner or support agent), and for the technical data needed to run and secure the service.
• Processor (service provider) for the content each business brings into its workspace: conversations, contacts, attachments, notes, tasks and records. The business that owns the workspace (the “Customer”) decides what is collected and why, and is responsible for having a lawful basis and for telling its own customers how their data is used. We process that content only on the Customer’s instructions and to provide the service.

If you messaged a business that uses Samaal, that business is responsible for your data. You can contact it directly, or contact us and we will help (see Data deletion).

2. Information we collect

2.1 Account and workspace information

• Name, email address and password (stored only as a one-way hash).
• Workspace name, time zone, business hours, team membership, roles and invitations.
• Settings and preferences, such as notification and AI settings.

2.2 Conversation and CRM content (processed for Customers)

• Messages sent and received through connected channels, including text, images, audio, video, documents, delivery and read status, and timestamps.
• Contact details of the people a business talks to: name, profile picture, phone number, email address, platform-specific user identifiers, and any details the business adds.
• Internal notes, tags, tasks, follow-ups, commitments, pipelines and records created by the business.
• AI-generated summaries, categories, priorities and suggestions about these conversations (see section 4).

2.3 Information from connected channels

When a business connects a channel, we receive the information needed to operate it. For example: Facebook Page IDs and names, Instagram professional account IDs and usernames, WhatsApp Business Account and phone number IDs, Telegram and Viber bot identifiers (and, if a business connects its Telegram bot to its Telegram Business account, that account’s private chats with customers), email mailbox addresses, and the access tokens that let Samaal send and receive messages on the business’s behalf. Section 5 covers Meta in detail and section 6 covers Google and Microsoft.

2.4 Website chat widget

When someone uses a business’s website chat, we collect the messages they send, any name or email address they choose to give, and a random visitor identifier stored in their browser so the conversation continues across page loads. We also receive the page address, IP address and browser information that every web request carries.

2.5 Integration credentials

Businesses may store their own API keys and app credentials (for example an OpenAI key or their own Meta, Google or Microsoft app). These are encrypted, can’t be read back through the interface, and are used only for that business’s workspace.

2.6 Technical and usage data

IP address, browser and device type, pages and features used, timestamps, error reports, and an audit log of security-relevant actions in a workspace (for example sign-ins, permission changes and data exports). We use this to operate, secure and troubleshoot the service.

3. How we use information

• To provide the service: deliver messages, show conversations in the shared inbox, sync mailboxes, run automations and send notifications.
• To provide the AI features a workspace has turned on (section 4).
• To create and secure accounts, verify email addresses, prevent abuse and fraud, and enforce workspace isolation.
• To provide support when you ask for it, and to send service messages such as security notices and changes to these policies.
• To measure usage against plan limits and to keep the service reliable.
• To comply with law and respond to valid legal requests.

We do not sell personal data. We do not use Customer content or data received from Meta, Google or Microsoft for advertising, to build advertising profiles, or for any purpose unrelated to providing Samaal to the business that connected it.

Where data protection laws require a legal basis, we rely on: performing our contract with you (providing the service), our legitimate interests (securing and improving the service, preventing abuse), your consent where we ask for it, and legal obligations.

4. AI features

Samaal can analyse conversations to suggest categories, priorities, summaries, tasks, follow-ups and reply drafts. To do this, conversation content is sent to OpenAI’s API, using either the platform’s OpenAI account or the business’s own API key. This can include messages received from WhatsApp, Messenger and Instagram.

• AI is available only once an OpenAI key is in place for the workspace. From then on it is on by default, and new incoming messages are analysed automatically shortly after they arrive. Team members can also ask for a reply draft at any time.
• Before text is sent, card numbers, bank account numbers (IBANs) and secrets such as passwords and API keys are automatically redacted.
• Each workspace can turn AI off entirely, or exclude specific channels from AI analysis, in Settings ▸ AI.
• AI suggestions need a team member’s approval by default. Messages to customers are never sent automatically by the AI.
• We do not use Customer content to train AI models. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models.
• We ask OpenAI not to store responses. OpenAI may keep API data for a limited time (normally up to 30 days) to detect abuse, under its own terms.

AI output can be inaccurate. Businesses should review suggestions before acting on them.

5. Data from Meta (WhatsApp, Messenger, Instagram)

When a business connects a Facebook Page, an Instagram professional account or a WhatsApp Business Account using “Continue with Facebook” or “Continue with Instagram”, Meta shares information with Samaal based on the permissions the business approves. This can include:

• The business’s basic profile and the Pages, Instagram accounts and WhatsApp accounts and phone numbers it chooses to share.
• Access tokens that let Samaal send and receive messages for those assets.
• Messages sent to and from those assets, together with the sender’s platform-specific ID and, where Meta provides them, their name, profile picture, and WhatsApp phone number.
• Message delivery, read and reaction events.

We use this data only to show conversations in the business’s inbox, let its team reply, keep contact records up to date, and provide the features the business has turned on (including AI features, if enabled). We do not sell it, use it for advertising, or share it with anyone except the service providers listed in section 7, and only as needed to provide the service. Access tokens are stored encrypted. We handle this data in line with Meta’s Platform Terms.

Data received from Meta for one business is available only inside that business’s workspace, to the team members it gives access. We do not combine it with other businesses’ data, share it between workspaces, or use it to build profiles of the people who message a business.

When a business disconnects an asset, we stop receiving its messages straight away and delete its access tokens. The conversations already in the inbox stay in the business’s workspace until the business deletes them, or asks us to, or the workspace is closed (section 9).

A business can disconnect an asset at any time in Settings ▸ Channels, or remove Samaal from its Facebook or Instagram settings. See Data deletion instructions.

6. Data from Google and Microsoft

When a business connects a Gmail or Outlook mailbox, Samaal receives permission to read and send email on that mailbox’s behalf. It reads new messages to show them as conversations, and sends the replies the team writes. Promotional and bulk email and automatic replies are skipped. Tokens are stored encrypted and refreshed automatically.

Samaal’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide and improve the user-facing email features of Samaal. It is not used for advertising, it is not sold, and people do not read it unless the user gives permission for a specific message, it is needed for security or to comply with law, or it is aggregated and anonymised for internal operations. We apply the same commitments to Microsoft data.

You can revoke access at any time by disconnecting the mailbox in Samaal, or from your Google Account permissions or Microsoft account app permissions.

7. How we share information

We share personal data only as described below.

Our service providers may use the data only to provide their service to us. Messaging platforms process messages under their own terms and privacy policies when they deliver them.

Within a workspace, content is visible to that workspace’s members according to the roles and visibility rules the business sets. Workspaces are isolated from each other at both the application and database level.

We may also disclose information if required by law or a valid legal request; to protect the rights, safety or property of our users, the public or Kiel; or to a successor in a merger, acquisition or sale of assets. In that last case this policy continues to apply, and we will give notice before data becomes subject to a different policy.

8. International transfers

We and our service providers may process data in countries other than yours, including countries where data protection laws differ. Where the law requires it, we use appropriate safeguards for these transfers, such as contractual protections.

9. How long we keep data

• Account information: kept while your account is active, and deleted within 90 days after you ask us to delete it, except where we must keep it longer by law.
• Workspace content (conversations, contacts, records): kept until the business deletes it, or until the workspace is closed. After closure it is deleted within 90 days. Businesses can also set their own retention rules in Settings ▸ Privacy.
• Raw webhook payloads received from messaging platforms: deleted after 30 days.
• Automation run history: deleted after 90 days.
• Failed background job records: deleted after 30 days.
• Server and security logs: kept for a limited period, as needed for security and troubleshooting.

Data in backups, if any exist, is deleted when those backups expire.

10. Security

• All traffic is encrypted in transit with TLS (HTTPS).
• Passwords are stored only as one-way hashes.
• Channel access tokens and integration credentials are encrypted at rest. Integration secrets use AES-256-GCM encryption bound to the workspace.
• Workspace data is isolated at both the application level and the database level (row-level security).
• Access is controlled by roles, and security-relevant actions are recorded in an audit log.
• Webhooks from messaging platforms are verified with their signatures before they are accepted.

No system is completely secure. If we become aware of a breach that affects your personal data, we will notify affected Customers and, where required, the relevant authorities, without undue delay.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal data, to object to processing, and to withdraw consent. You also have the right to complain to your local data protection authority.

• Samaal users: you can update your profile in the app. For other requests, email hello@kiel.mv.
• People who contacted a business: the business controls your data. Workspace admins can export or erase a contact’s data directly from the contact’s profile. If you can’t reach the business, contact us and we will help.

We respond to verified requests within 30 days.

12. Data deletion instructions

Full step-by-step instructions, and a status check for deletion requests, are on our User Data Deletion page.

If you are a business using Samaal

1. To stop Samaal from accessing a channel, open Settings ▸ Channels, select the channel and disconnect it.
2. To remove Samaal from Meta, go to Facebook Settings ▸ Business integrations (or Instagram Settings ▸ Website permissions ▸ Apps and websites), and remove Samaal. Meta then sends us a deletion request automatically: we disconnect the channels you authorised and delete their access tokens and your stored user ID, and you get a confirmation code to check the status.
3. To delete your account, your workspace and all of its data, including data received from Meta, email hello@kiel.mv from the email address on your account. Tell us the workspace name.

If you messaged a business that uses Samaal

1. Ask the business to delete your data. Its admins can erase a contact and all of their conversations in Samaal.
2. Or email hello@kiel.mv with the name of the business, the channel you used (for example WhatsApp, Messenger or Instagram) and the name, username or phone number you messaged from. We will work with the business to delete it.

We confirm deletion requests by email and complete them within 30 days, unless we must keep certain data by law. Messages already delivered on WhatsApp, Messenger or Instagram also remain on those platforms under Meta’s own policies.

13. Cookies and local storage

Samaal uses only what it needs to work. There are no advertising or third-party analytics cookies.

• Session cookie: keeps you signed in.
• XSRF-TOKEN cookie: protects forms and requests against cross-site request forgery.
• Local storage: remembers your selected workspace, unsent reply drafts and display preferences. On businesses’ websites, the chat widget stores a random visitor identifier and the conversation reference.

If you block these, you may not be able to sign in or use the chat widget.

14. Children

Samaal is a business tool. It is not directed at children, and you must be at least 18 to create an account. If you believe a child has given us personal data through an account, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here and update the date at the top. For material changes, we will notify account owners by email or in the app before the changes take effect.

16. Contact us

For questions, requests or complaints about privacy, email hello@kiel.mv. See also our Terms of Service.