Privacy policy
LAAFI gives businesses an assistant that answers their customers on WhatsApp and Telegram. This page explains what data we handle, why, who we share it with, how long we keep it and how to have it deleted.
Who is who
- Subscribers are the business owners who create an account.
- Customers are people who message a business through WhatsApp or Telegram.
For customers' messages, the business decides why the data is collected: to answer its customer and handle the order. We process it on the business's behalf to run the assistant.
The data we handle
- Subscribers: name, email, phone, password (kept only as a hash), business details (name, type, address, hours, payment numbers), catalog, prices, uploaded photos and videos, orders and bookings, reviews, help requests, proof of payment for our subscription fees.
- Check before going live: before activating an account, we ask for a photo of your ID, a selfie holding it and, if you wish, proof of your business (a photo, a screenshot or a link). Our team compares them with the name of the holder of your payment numbers. They are used only for that and stay private: nobody but our team sees them.
- Customers: phone number or Telegram identifier, the name shown by the app, messages, photos sent in the chat, delivery address, order or booking details, payment screenshots, ratings and comments.
- Problem report: if you report a business, your phone number, your message, the receipt code and any screenshot you attach. We copy into it the facts of the order (items, amount, payment reference) and the payment screenshot sent to the seller, because those are erased sooner on their side. They are used only to look into the report.
- Contact form: the name, email and message you write. They are used only to answer you.
- Technical: error logs, which may contain a customer's phone number.
Why we use it
- To run the assistant: reply, search the catalog, record orders, check payments, send reminders and reports.
- To alert the business owner about important events.
- To bill the subscription and provide support.
- To protect the service: message rate limits, blocking abuse.
- To meet our legal obligations.
We do not sell personal data and do not use it for advertising. We do not train AI models with this data.
Artificial intelligence
Replies are produced by AI models: Google Gemini first, then Mistral, Groq or OpenRouter if Gemini does not answer, and Anthropic Claude last. Messages customers send are passed to whichever one answers. Images go only to Google or Anthropic. Images are used only to match a product or to read a payment screenshot. The assistant never confirms a payment on its own unless the business owner turned that option on.
Who we share it with
- Supabase: database and file storage.
- Render: hosting of the service.
- Google: the Gemini AI model (text and images).
- Mistral AI, Groq and OpenRouter: backup AI models (text only).
- Anthropic: the Claude AI model (text and images).
- Meta: WhatsApp Business Platform.
- Telegram: messaging.
- Resend: sending emails, when that feature is enabled.
Each receives only what its function needs. Some of these providers are located outside Cameroon, so data may be processed abroad. We may also disclose data when the law requires it.
How long we keep it
- Search photos sent by customers: 24 hours.
- Contact form messages: not saved in our database; they arrive in the team's messaging, which deletes them once the request is handled or on your request.
- Payment screenshots: 30 days.
- ID, selfie and business proof: as long as the account is open, so we can answer in a dispute or a fraud case, then erased with the account.
- Problem reports: while the case is open, then 180 days after it is closed, with their files. You can ask for earlier erasure (see "Your rights").
- Conversation history: 30 days.
- Orders, bookings, reviews, catalog: as long as the business's account is open.
- Deleted account: closed immediately, then erased 30 days later. Only our billing records (amount, plan, date) remain, without personal details, for accounting.
- Technical logs: for troubleshooting, then erased with the account.
Cookies
The public site uses no cookies and no analytics. The dashboard keeps only what it needs to work. Details: cookies and local storage.
Security
Connections are encrypted (HTTPS). Each business sees only its own data. Passwords are hashed, login attempts are limited and incoming WhatsApp calls are verified by signature. No system is perfect: if you think an account is compromised, write to us right away.
Your rights
You may ask for access to your data, its correction, its export or its deletion.
- Subscribers: Settings, "Download my data" and then "Delete my account".
- Customers: write to us with the number you wrote from, or ask the business concerned. Details on the Data deletion page.
We answer within 30 days.
Children
The service is for adult business owners. It is not intended for anyone under 18, and we do not create accounts for them. A business's customers may write without us knowing their age: we do not try to find out the age of minors and we use their messages for nothing but answering. If you are a parent or guardian and your child wrote to a business that uses LAAFI, write to us and we will erase their data.
Changes
If this policy changes, we update this page and its date, and we tell subscribers in their dashboard about important changes.
Contact
Write to us at contact@laafiapp.com.