Skip to content
عاقلSign in

Privacy Policy: AQIL Self-Service

Last updated: 6 November 2026

This policy explains how AQIL processes personal data in AQIL Self-Service at agents.aqil.sa: the service where your business signs up by itself and AQIL builds it an AI agent that answers its customers on WhatsApp. AQIL’s other services on aqil.sa have their own policy there.

1. Data controller

  • The controller is AQIL Information Technology and Artificial Intelligence Company (شركة عاقل لتقنية المعلومات والذكاء الاصطناعي), Commercial Registration 7054517367, Kingdom of Saudi Arabia. Privacy contact: support@aqil.sa
  • AQIL is the controller of your account and business data: sign-up and sign-in, billing, and what you write in AQIL.
  • For the data of your business’s customers who message it on WhatsApp, your business is the controller, and AQIL processes it on your business’s behalf and only to provide the service to it (section 8).

2. Data we collect

  • At sign-up: your business name, your email, and your mobile number and its country. We email you a 6-digit sign-in code and a link to continue.
  • If you sign up or sign in with Google: your name and email from Google (section 7).
  • Your team: the email of each member you invite, and their name if they enter it when accepting.
  • Your business:
    • The website link, file or description you give us, and the business facts we extract from it: services and prices, hours and branches, contact numbers, frequently asked questions and policies.
    • From your website we keep the text of the pages we read (up to 8 pages) so your agent can answer from them, and we leave out any page that looks like a customer list.
    • We don’t keep the file itself or the description you wrote: we keep the file’s name and what we extracted from them.
  • What you write in AQIL: your agent’s instructions and their versions, your questions in “Try your agent” with your agent’s replies and what you taught it, what you ask the “Instructions assistant”, and your corrections in “Teach your agent”.
  • Linking WhatsApp: your business’s WhatsApp Business number, its account identifiers at Meta, and its access key.
  • Linking Salla: if you link your store, what the page “AQIL in your Salla store” describes (agents.aqil.sa/en/privacy/salla).
  • Billing:
    • Your plan, subscription, invoices and payments.
    • About your card: a token from the payment gateway that stands for it, its network, last four digits and expiry, and a fingerprint computed from them that does not hold the card number.
    • Your card details go from your browser straight to the payment gateway, and never pass through our servers.
  • How you use the site:
    • Your steps through the sign-up pages, your device type (phone, tablet or computer), your language, and where your visit came from when the link says so (such as a campaign name).
    • Your answers to the opening questions if you answer them, such as how you heard of AQIL and what you want from your agent.
    • An ad click identifier if you came from a Google, TikTok or Meta (Instagram) ad (section 10).
    • We don’t keep your IP address as it is, only a one-way fingerprint of it, and we don’t keep your browser type unless you came from a Meta ad (section 10).
  • What is required: when you sign up on our site, your business name, email and mobile number to create your account, your card to start the trial or subscription, and your business information to build your agent; without them we can’t provide these. Anything else you give us is optional.
  • Your business’s customers’ data on WhatsApp: section 8.

3. Sources of data

  • From you directly: when you sign up, fill in “Your business” and use your account.
  • From Google: your name and email, if you choose to sign up or sign in with it.
  • From Salla: if you started from your Salla store, your name and email from your account there, and what we read from your store if you link it.
  • From your business’s website: the public pages we read from the link you give us.
  • From Meta (WhatsApp): your business’s customers’ messages and their statuses, and the WhatsApp Business app’s earlier chats and contacts if you link it (section 8).
  • From the payment gateway: each payment’s result, and the token for your card with its network, last four digits and expiry.
  • Automatically, from your use: your device type, language and steps, and cookies (section 10).

4. Purposes of processing

  • To create your account, verify your email and sign you in.
  • To build your agent from your business facts, test it, and run it on WhatsApp to answer your business’s customers on its behalf.
  • The trial, subscription, renewal, invoices and receipts.
  • To write to you about your account: sign-in codes, invitations, receipts and alerts. We may send a limited reminder if you stop before your trial starts, and each reminder carries a link to stop them.
  • To support you and solve problems.
  • To protect the service: stopping automated sign-ups and abuse, usage limits, and an audit log of changes.
  • To measure and improve sign-up, and to learn which of our ads brought us customers.
  • To comply with applicable laws, including keeping invoices.
  • We don’t sell your data, and we don’t use it or your customers’ conversations to train AI models.

5. Legal basis for processing

  • Performing our agreement with you, or steps before it at your request: the account, the agent, billing and support.
  • Legal obligation: keeping invoices, and answering a valid legal request.
  • Legitimate interest: protecting the service and stopping abuse, improving the service, and measuring our ads.
  • Consent where the law requires it. You may withdraw it at any time, without affecting what came before.
  • For your business’s customers’ data (section 8), your business decides the basis for processing it, and we process it on its instructions.

6. Data sharing

  • We don’t sell your data, and we don’t give it to anyone to advertise with.
  • We share it with service providers who process it on our behalf, only to provide the service and only as much as each one needs:
    • Hosting and database: storing your data and signing you in, running and protecting the app on a global network, a check that stops automated sign-ups, opening your website’s pages to read them, and turning WhatsApp voice messages into text.
    • AI: a model that reads your website and file, builds and tests your agent, writes its replies to your customers, and runs the “Instructions assistant” and “Teach your agent”; and a backup model for the “Instructions assistant” and “Teach your agent” only, which doesn’t write WhatsApp replies. And a vision model that writes a text description of the photos your customers send on WhatsApp, so the agent understands them and replies.
    • Email: sending sign-in codes, invitations, receipts and alerts, including alerts to your team about your customers’ requests.
    • The payment gateway: saving your card and charging it.
    • Meta (WhatsApp): the WhatsApp channel, and linking your business’s number.
    • Salla: if you link your store.
    • Google: sign-up and sign-in if you choose it (section 7), and measuring visits and ads (section 10).
    • TikTok: measuring our ads (section 10).
    • Meta (Instagram): measuring our ads (section 10).
  • The AQIL team sees what it needs of your account and business data to support you and run the service.
  • We disclose data when a law, or a valid request from a competent authority, requires it.

7. Signing up and signing in with Google

  • “Continue with Google” is optional: you can sign up and sign in with your email and a code instead.
  • We ask Google for your name and email only. We don’t read your photo, and we don’t ask for your contacts, your files or anything else in your Google account.
  • We use them for one purpose: creating your AQIL account and signing you in to it. We check with Google that your email is verified; if it isn’t a Gmail or Google Workspace address, we continue with a code sent to your email.
  • We keep your name and email in your account while it exists, as with any sign-up, and we don’t keep your Google account identifier. To delete them, ask us to delete your account (section 14).
  • We don’t sell them, use them for ads, send them to any advertising platform, or give them to anyone except the service providers that run AQIL on our behalf (section 6), only as much as running it needs.
  • Our use of information received from Google adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • You can remove AQIL’s access in your Google account settings at any time; your AQIL account stays, and you sign in to it with an email code.

8. WhatsApp Business Platform data

  • Source: when your business links a WhatsApp Business number to AQIL, its data reaches us from Meta Platforms through the WhatsApp Business Platform.
  • What we process about your business’s customers:
    • The customer’s WhatsApp number, the name in their profile, and their WhatsApp identifier.
    • The text of their messages and your business’s replies, message and conversation identifiers, and delivery and read statuses.
    • Voice messages: we turn them into text so the agent can answer, and keep the text with the conversation. We don’t keep the audio.
    • Photos and documents: we keep a copy of the photos and documents your customers send (up to 10 MB) in AQIL’s storage, deleted with your business. A vision model writes a text description of each photo so the agent understands it; we keep the description with the conversation, with card and account numbers hidden. For voice messages and videos we keep only their reference, and show them from WhatsApp when you open them. A shared location is kept as text, and a shared contact by its name only.
    • Appointment requests and follow-ups, and what your business notes about the customer on their card.
    • If your business links its WhatsApp Business app to AQIL: its earlier chats in the app, up to 180 days, and the contacts saved in it with their names and numbers; we use the names only to name who messages your business.
    • If it links its Salla store: we send Salla the customer’s number or order number to find their order, and the agent says nothing about an order until it is sure the person asking owns it.
  • How we use it: to run your business’s inbox, for the agent to write replies from the business’s approved information, for appointment requests and follow-ups, to hand a conversation to a staff member with its context, and to alert your business’s team about requests with the customer’s name and number.
  • AI: an AI agent may reply to the customer in the business’s name, and hands them to a staff member if they ask. To write each reply, the AI model receives the conversation’s last 20 messages, the customer’s name, number and card, and what it needs of the business’s information. When you correct a reply in “Teach your agent”, the last 10 messages of that conversation reach the “Teach your agent” model, or the backup model if it doesn’t answer.
  • Each business’s data is its own: we use each business’s customers’ data for that business alone, we don’t sell it, and we don’t use it for ads.
  • Who sees it: your business’s team in the inbox, and the AQIL team assigned to your business, to support it and run the service.
  • Messages the business starts: the business must have its customer’s consent before it starts a conversation with a template message, under WhatsApp’s policies.
  • Stopping messages: if the customer sends “stop”, «إيقاف» or «إلغاء الاشتراك» as a message on its own, we send one confirmation, the agent stops in their conversation, and nothing more reaches them through AQIL unless the business turns their consent back on.
  • The rights of a business’s customer (access, correction or deletion): they contact the business itself, or write to us at support@aqil.sa and we work with the business on their request.

9. Transfers outside your country

  • We serve businesses from many countries, and we store and process data with cloud service providers and global networks (section 6) in several countries, including countries outside the Kingdom of Saudi Arabia.
  • We limit what we transfer to what the service needs, and rely on our providers’ contractual data-protection commitments and on the safeguards in section 11.

10. Cookies and analytics

  • Our essential cookies:
    • Your session, which keeps you signed in.
    • Binding the sign-in code to your browser, one hour.
    • The short steps of “Continue with Google”, 10 and 15 minutes.
    • Your language and display preference, one year.
    • Your account’s features, 7 days, and the “Add your mobile” prompt, 10 minutes.
    • If you came from Salla: linking your store, 7 days, and its link ticket, 10 minutes.
  • Measuring sign-up: a random identifier for your browser, 90 days, of which we keep only a fingerprint. Your browser also keeps, for a while, what you typed in the sign-up form and your answers to the opening questions, so you can pick up where you left off.
  • Ads: if you came from an ad we keep its click identifier: 90 days for Google and Meta ads, 28 days for TikTok ads. Our server reads it when you sign up and ties it to your business, then tells the platform of the ad you came from that you signed up, started your trial and made your first payment, with its amount, with no email, name or mobile number. For a Meta ad alone we also keep your browser type and send it with them, because Meta requires it. We load no Meta ad tool in your browser.
  • Analytics tools: on the home page and the sign-up page only, we use Google Analytics to count visits and where they came from, and the TikTok Pixel to measure our ads; each sets its own cookies. In Google Analytics we turned off Google signals and ad personalisation, and we strip everything from the page address it receives except the campaign parameters. They don’t run in your account or on the payment pages.
  • Other parties’ tools: the sign-up page loads a security check from our service provider that stops automated sign-ups, and the WhatsApp linking pages load Meta’s tool to link your number from its own window.
  • You control cookies in your browser settings; deleting the essential ones may stop you signing in.

11. Data protection

  • Each business’s data is isolated from every other inside the database itself, so a member of one business cannot read another’s data.
  • The keys for linking WhatsApp and Salla are kept encrypted in a secrets vault, and nobody sees them after they are entered.
  • We keep sign-in codes and IP addresses only as one-way fingerprints, and your card details never pass through our servers.
  • Every significant change is recorded in an audit log: who changed it and which fields changed, without their content.
  • Connections are encrypted, and the database is encrypted at rest.
  • Even so, no system on the internet is completely secure.

12. Retention and deletion

  • While your account exists we keep your account, business and agent data, your customers’ conversations and records, because they are the service itself. Cancelling your subscription doesn’t delete them: they stay until you ask us to delete them.
  • We delete automatically:
    • Sign-in code records after 30 days. The code itself works for 10 minutes.
    • Your answers to the opening questions 30 days after your trial starts or your first payment, or after your last activity if you didn’t get that far.
    • The pages you opened and your visits before you created your account, after 120 days.
    • “Try your agent” conversations after 30 days, once your business has left setup, except a question still waiting for your answer.
    • Ad click identifiers: after 35 days for TikTok ads, and after 90 days for Google and Meta ads, with the browser type kept for a Meta ad.
    • Your saved website pages: replaced by each newer read’s pages.
    • The WhatsApp Business app’s contacts: when its link ends.
    • Your card at the payment gateway: when your cancellation takes effect. We keep its fingerprint for one purpose only: one trial per card.
    • Salla data: as the page “AQIL in your Salla store” says.
  • The photos and documents your customers send, and the photos’ descriptions: while your business exists, deleted with it. We never keep voice messages and videos; we keep only a voice message’s text.
  • Invoices and payments we keep because the law requires us to. The audit log we keep; it holds identifiers and the names of the fields that changed, not their content.
  • When you ask us to delete your data, we delete it or make it anonymous, except what the law requires us to keep.

13. Your rights

  • To know how we process your data, which this policy sets out.
  • To access your data and obtain a copy of it.
  • To correct what is incomplete or inaccurate.
  • To ask for its deletion where the law doesn’t require us to keep it.
  • To withdraw your consent where consent is the basis for processing.
  • To complain to the competent data protection authority.
  • If you are a customer of a business that uses AQIL: section 8.

14. Requests and complaints

  • Write to us at support@aqil.sa from the email registered on your account, and say what you are asking for. To delete your account and data, use the subject “Data deletion request”.
  • We may ask you to prove your identity before we act on it, to protect your data.
  • We answer your request within 30 days.

15. Policy updates

  • We update this policy when what we process, or how, changes, and publish each update here with its date at the top of the page.
  • If we want to use your data, or what we receive from Google, for a new purpose this policy doesn’t mention, we ask for your consent first.