Privacy policy

Who is responsible for your data

Personal accounts: Hamada is the controller of your data — the party that decides why and how it is processed.

Business accounts: the business (our customer) is the controller of its own customers’ data — such as WhatsApp and widget conversations, contact details and orders — and Hamada is a processor that handles it on the business’s behalf and on its instructions only. If you are a customer of a business that uses Hamada, contact that business first about your data; we will help it answer you.

You can reach our data protection officer at privacy@hamada.ai.

What we collect

• Account data: name, mobile number, email, photo if you add one, preferred language and dialect, and how you sign in (an SMS code, a Google or Apple account, or Telegram) with the identifier that sign-in provider sends us.
• Content: the messages you send the assistants and their replies, voice notes and their transcripts, voice calls in the app (what is said is kept as text in the conversation), files and images and the text read from them, reminders, tasks and approvals.
• The assistant’s memory: what the assistant keeps in order to remember you (its notes, skills and session history) in your account’s own workspace.
• Business data: the business profile and knowledge (documents, notes, website pages and the Google Drive folders the business picks), customers and their conversations, the team and its permissions, and records (quotes, invoices, orders, tasks).
• A business’s customers: when you message a business on WhatsApp, its widget or an assistant link, we process for that business your name and phone number or channel identifier, your messages and attachments, and the dialect inferred from them.
• Connected apps: if you connect Google Calendar, Google Drive or an app from the apps list (such as Notion or Asana), we keep their access tokens encrypted and read only what your request needs. Google Calendar and Google Drive are read-only.
• Subscription and payments: plan, subscription, credits and their history, usage and invoices. Card details are entered with the payment provider directly; we keep only the card brand, last four digits and expiry, to show you and to renew automatically.
• Enterprise requests: name, company, mobile or email, team size and your message, when you send the "Contact us" form.
• Technical data: error and performance logs (with message content and sign-in data removed), the log of sensitive actions with the IP address, your devices’ notification tokens, and cookies (see "Cookies and analytics").

Why we use it, and on what legal basis

We process data for these purposes only, each on a basis the Personal Data Protection Law recognises:

• Providing the service you asked for — running the assistants, answering customers, reminders, files, calls and connected apps (performing our contract).
• Invoicing, tax and accounting records (legal obligation).
• Security, preventing fraud and abuse, fixing faults and improving the service (our legitimate interest, which does not override your rights and freedoms).
• Transferring data to providers outside Egypt (your explicit consent at sign-up, with the safeguards in "Transfers outside Egypt").
• Analytics and marketing tools on the website (your consent in the cookie settings, which you can withdraw at any time).
• Contacting you about your account, your subscription and changes to this policy. We send marketing messages only with your consent.

We never sell your data, never use your content to train AI models, and never use it for advertising.

AI and automated decisions

Replies are written by an AI model chosen for each assistant. To write a reply we send the model provider your message and only the conversation context, assistant memory and relevant business knowledge it needs.

An assistant may search the web to answer you; the search terms or the page address then reach the search provider, not your whole conversation.

Hamada makes no automated decisions about you with legal or similarly significant effects. Anything that sends, pays, deletes or books waits for your approval (or that of the approver the business set) before it happens.

Who processes your data with us (sub-processors)

We use specific providers; each receives only what its role needs, under contracts that bind it to protect the data and not to use it for its own purposes:

• Fly.io — hosting in data centres in Europe: servers, the database, each account’s separate workspace and its backups.
• An S3-compatible object storage provider (such as Tigris or Cloudflare R2): uploaded files and voice notes.
• OpenRouter and the model providers it routes to, depending on the chosen model (such as Anthropic, OpenAI, Google and others): messages and the context needed to write the reply.
• Anthropic: the models we use from it directly. If a business adds its own Anthropic key, its assistants’ messages go to Anthropic under the business’s account and its own terms with Anthropic.
• ElevenLabs: spoken replies, voice-note transcription and live voice calls in the app.
• Meta (WhatsApp Business Platform): WhatsApp messages between a business and its customers, and connecting the business’s number.
• Telegram: if you talk to the assistant on Telegram.
• Google: Google sign-in, Google Calendar and Google Drive if you connect them, and Android notification delivery.
• Apple: Sign in with Apple and iPhone notification delivery.
• Expo: sending mobile app notifications to Apple and Google.
• Twilio: sending the sign-in code by SMS.
• An email delivery provider: notifications and account emails.
• Paymob, Fawry and Stripe: payments and automatic renewals.
• Sentry: technical error tracking (with message content and sign-in data removed).
• The web search providers our system allows, and no others (Exa, Parallel, Firecrawl, Keenable): the search terms and pages an assistant asks for.
• We currently use no third-party analytics or marketing tools on the website.

Apps you connect yourself (such as Notion, Asana or Calendly) are not our sub-processors: your relationship with them is direct and under their terms, and we pass them only what an assistant asks for on your instruction.

We announce any material addition to this list on this page before it applies.

Transfers outside Egypt

Data is stored in the European Union (Fly.io, Europe), and some providers — such as model providers — process it in the United States or other countries. These are transfers of data outside the Arab Republic of Egypt.

We make them with your explicit consent, under the licences and permits issued by the Personal Data Protection Center, with data processing agreements with every provider, encryption in transit and at rest, and only the minimum needed.

How we protect your data

• Every account has its own separate runtime (its own container and storage volume) that no other customer can reach, and every database read is confined to its owner’s data.
• Messages, transcripts, records and access tokens are encrypted with a key per account, on top of the hosting provider’s disk encryption, and every connection is encrypted (HTTPS).
• Assistants can connect only to destinations set in advance: the AI models, our own tools and the search providers listed above.
• Uploaded files are scanned for malware before they are used.
• Anything that sends, pays, deletes or books waits for your approval first.
• Our team’s access to data is limited to what is needed and recorded in a tamper-evident log.

How long we keep data

• For as long as your account is active, unless you delete something yourself.
• When you ask to delete the account or the business: everything stops at once, and you have 30 days to change your mind. Then the data is deleted for good: we destroy the encryption key (so encrypted data can never be read), delete the assistant’s workspace, the files and the records, and disconnect connected apps.
• Backups: database backups expire within 10 days at most, and assistant workspace snapshots within 14 days. They are restored only to recover from a fault, and every completed deletion is then applied again.
• "Download my data" copies are deleted 24 hours after they are ready.
• Invoices and payment records: for the period Egyptian tax and accounting law requires, without extra personal details.
• The log of actions (who did what, when): kept for security, including the record that a deletion happened.
• Enterprise requests: while needed to get back to you; you can ask us to delete them at any time.
• Your cookie choice: six months, then we ask again.

Your rights

The law gives you the right to know and access the data we hold about you, get a copy, correct or update it, delete it, limit its processing to a specific scope, object to it, withdraw your consent at any time, be told of any breach affecting it, and complain to the Personal Data Protection Center.

• A copy of your data: Account → "Your data" → "Download my data" (a zip with your account, conversations, files, invoices and the assistant’s memory). Businesses: Settings → Billing → "Business data".
• Correction: edit your name, language and details on the Account page, or write to us for anything else.
• Deletion: Account → "Delete my account", or the business settings for owners. Details on the "Data deletion" page.
• Objection and withdrawing consent: "Cookie settings" for analytics and marketing tools, or write to us about any other processing.

For any other request, write to privacy@hamada.ai. We may ask you to prove who you are first, and we answer free of charge within the period the law sets.

Children

Accounts are for people aged 18 or over only; the service is not meant for anyone younger, and we do not knowingly collect their data. If we learn an account belongs to a minor, we delete it. Businesses must not use Hamada to collect children’s data without their parents’ consent.

Cookies and analytics

Necessary cookies, always on: your sign-in session (a secure cookie the page cannot read), the site language, and your cookie choice.

We currently use no third-party analytics or marketing tools.

We never send these tools your messages, file names, phone number, email or account identifiers. They do not run inside conversations or on pages with identifiers in their address, nor in the widget and assistant links. Session-recording tools (Microsoft Clarity, Hotjar and PostHog recording) run only on the public pages of the website, with text masked.

Google’s tools start with everything denied (Google Consent Mode) and change only with your choice.

You can change your choice at any time from "Cookie settings" here or at the bottom of every page.

Breach notification

If a security breach affects personal data, we notify the Personal Data Protection Center within 72 hours of becoming aware of it, and tell the people affected without delay what happened, what we did and what they can do. For business accounts we tell the business without delay so it can inform its customers.

Changes and contact

We may update this policy. The version and effective date are at the top of the page and the list of changes at the bottom, and we tell you in the app or by email before any material change.

Responsible party: the company operating Hamada.

Contact: privacy@hamada.ai for privacy and data, support@hamada.ai for support.