Privacy Policy

This privacy notice explains how Talentlyx (operator of the RafeeqWhatsApp automation platform) collects, uses, shares, retains, and protects personal data. It is written to align with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulations issued by the Saudi Data and AI Authority (SDAIA).

1. Who we are (the Controller)

Talentlyx — Riyadh, Kingdom of Saudi Arabia.
Data Protection Officer: Zaid Siddique.
Contact: zaid@talentlyx.com · +966 55 353 2798.

2. What personal data we process

• Account data (workspace member email, name, hashed password, role).
• WhatsApp conversation data (phone number, message text, attached media, timestamps).
• Lead records derived from inbound conversations (status, score, notes).
• Knowledge-base files uploaded by the workspace owner.
• Usage telemetry (rate-limit counters, API usage counts) to operate and bill the service.
• Calendar booking details when a customer books a meeting via the AI.
• Billing data when the workspace pays for the service.

3. Why we process it (purposes & lawful basis)

• To deliver the WhatsApp automation service to the workspace owner — contractual basis.
• To reply to messages a customer initiates with a workspace — legitimate interest, justified by the customer's own initiation of contact.
• To send transactional messages, invites, and DSR acknowledgements — contractual and legitimate interest.
• To detect abuse, prevent fraud, and secure the platform — legitimate interest.
• To send marketing or non-transactional outreach — only with separate opt-in consent.

4. Who we share data with (sub-processors)

We use the following sub-processors. All transfers outside the Kingdom rely on signed Data Processing Agreements and contractual safeguards.

• Cloud database, file storage & authentication provider — database, file storage, authentication. United States and European Union.
• Vercel — application hosting. United States.
• Twilio — WhatsApp Business API ingress and egress. United States.
• AI language-model provider — large-language-model completion, embeddings, and voice transcription. United States. Inputs covered by a zero-data-retention enterprise agreement.
• Pinecone — vector retrieval for the knowledge base. United States.
• Composio — OAuth proxy for Google Calendar. United States.
• Geidea — payment processing. Saudi Arabia (in-Kingdom).

5. Cross-border transfers

Some of the sub-processors listed above are located outside the Kingdom of Saudi Arabia. We rely on signed Data Processing Agreements, Standard Contractual Clauses (or equivalent), encryption in transit (TLS 1.2+), and encryption at rest. Where a sub-processor offers a zero-data-retention option (e.g. our AI language-model provider), we adopt it.

6. How long we keep data (retention)

• Account records: lifetime of the workspace plus 30 days, unless an erasure request is fulfilled earlier.
• WhatsApp messages: default 12 months from delivery. Workspaces with documented legal-basis needs may extend this.
• Lead records: while the lead is active or 24 months of dormancy, whichever is longer.
• Billing & tax records: 6 years (ZATCA requirement).
• Audit and compliance logs: 5 years.
• Backups: rolling 30-day retention.

7. Your rights (PDPL Art. 4)

You have the right to:

• Be informed of how we process your personal data.
• Access the personal data we hold about you.
• Receive a portable copy of your data.
• Have inaccurate data corrected.
• Have your data deleted, subject to overriding legal obligations (e.g. tax records).
• Withdraw consent at any time, where consent is the lawful basis.
• Object to processing for marketing.
• File a complaint with the Saudi Data and AI Authority (SDAIA).

To exercise any of these rights, contact our Data Protection Officer at zaid@talentlyx.com. We will respond within thirty (30) days. We do not delete or modify data automatically in response to dashboard actions — every request is reviewed by the DPO before action is taken, so accidental loss of your data is prevented.

8. AI processing

Inbound WhatsApp messages are processed by a large language model to generate replies. We do not use customer messages to train any AI model. We do not make automated decisions that produce a legal effect on you. See our Data Protection Impact Assessment for detail (available on request).

9. Security

The platform applies workspace-isolated access controls, database-level security rules, encrypted transport (TLS 1.2+), signed short-lived Storage URLs, role-based access control, prompt- injection detection, per-endpoint rate limits, and Twilio signature validation on all inbound webhooks. Detail is published in our privacy and security overview.

10. Cookies

The dashboard uses a small number of strictly-necessary cookies for authentication and language preference. We do not currently deploy third-party analytics or advertising cookies on the dashboard.

11. Changes to this notice

We will update this page when our processing changes. Material changes will be communicated to workspace owners by email at least fourteen (14) days before they take effect.

12. Complaints

You may file a complaint with the Saudi Data and AI Authority (SDAIA) at sdaia.gov.sa.