Privacy Policy
What personal data we collect, why, how long we keep it, and your rights. In plain language.
Last updated:
In short
- We follow the European privacy standard (GDPR) everywhere we work, and Lebanon’s Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data.
- Chats handled by our assistants are kept 90 days, then deleted. You can ask for earlier deletion.
- We never sell personal data, never use it for advertising, and never use it to train AI models.
- Each business’s data is kept separate. Nothing is shared between businesses.
- Our main database is in Frankfurt, Germany (EU).
This is a summary. The full policy below is what applies.
The full policy
Open any part to read it.
Who we are
Baladi Labs builds AI, chatbots and digital services for businesses and governments.
Baladi Labs is not yet registered as a company. Until it is, Baladi Labs is the trading name of its founder, based in Lebanon, who is responsible for the personal data described here.
For anything about privacy, write to [email protected] or message us on WhatsApp (coming soon).
Who this policy is about
- Visitors to baladilabs.com.
- People who contact us by email, WhatsApp, our website or social media.
- Business customers: the businesses that buy our services, and the people at those businesses.
- People who try our demo assistant.
- People who chat with a business that uses our assistant. For them, see “If you chat with a business that uses our assistant” first.
What we collect, why, and on what legal basis
| Who | What we collect | Why | Legal basis (GDPR terms) |
|---|---|---|---|
| Website visitors | Basic technical data: IP address, browser type, pages visited, time | To run the website safely and fix problems | Our legitimate interest in a working, secure website |
| People who contact us | Name, phone, email, company, your message | To answer you and, if you ask, send you an offer | Your request (steps before a contract); our legitimate interest |
| Business customers | Contact person’s name, phone, email; business name, address, tax number; plan, invoices and payments | To provide the service, invoice, and keep accounting records | The contract; legal duties (accounting and tax) |
| Demo users | Phone number, WhatsApp name, messages to the demo | To run the demo and improve it | Our legitimate interest in showing and improving our product |
| People who chat with a business that uses our assistant | Phone number, WhatsApp name, messages, booking details | To answer you for that business | The business decides (see “If you chat with a business that uses our assistant”) |
We do not ask for sensitive data such as health information or ID numbers, and we ask our customers not to collect it.
If you chat with a business that uses our assistant
The business is in charge of your data. When you message a restaurant, shop or other business that uses an assistant built by Baladi Labs, that business decides how your messages are used (it is the “controller”). Baladi Labs only handles them for the business (we are its “processor”), under a written data agreement.
What happens to your messages:
- they pass through WhatsApp (Meta) and our WhatsApp connection provider to our system;
- our AI provider (a paid business plan that does not use your data for training) reads the conversation to write a reply, using only that business’s information;
- they are stored in our database in Frankfurt, Germany, where only that business and our team can see them;
- they are deleted after 90 days, or sooner if you or the business ask.
We use your number only to reply to you for that business. We never use it to contact you for anyone else, and we never share it with other businesses.
To see, correct or delete your data, you can ask the business, or ask us directly at [email protected]. We will work with the business to answer you.
How long we keep data
| Data | How long |
|---|---|
| Chats handled by an assistant (for businesses and for the demo) | 90 days, then deleted automatically |
| Bookings and leads captured by an assistant | 90 days after they are created, or until the booking date if that is later |
| Data of a business that stops using our service | Deleted within 30 days after the service ends, unless a law requires us to keep it. The business can ask for a copy first. |
| Messages and emails between you and Baladi Labs | As long as needed to answer you, and at most 2 years after our last contact |
| Business customer records, invoices and payments | As long as the law requires for accounting and tax |
| Website technical logs | 30 days |
| Backups | Overwritten within 30 days |
Who we share data with
We share data only with the providers who help us run our services, and only what they need:
| Provider | What for | Where |
|---|---|---|
| Messaging platform: Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages | Meta data centres |
| Our WhatsApp connection provider (USA) | Connecting WhatsApp to our system | United States and other countries |
| Our AI provider (paid business plan, no training on your data) | Writing replies | Countries where the provider has facilities |
| Our database host (database in Frankfurt, Germany) | Storing data | European Union |
| Our email provider | To be confirmed | |
| Our website host | Running the website | To be confirmed |
The full list of our providers, with their names, is in our client data agreement and is available on request at [email protected].
We may also share data if the law or a court requires it, or to protect people’s safety or our legal rights. We never sell personal data.
Data that leaves your country
Our main database is in the EU. Some of our providers handle data in other countries, including the United States. Where the GDPR applies, we use legal safeguards for these transfers, such as the EU Standard Contractual Clauses.
How we protect data
Encryption in transit and at rest, separate access for each business, two-step login for our team, signed messages between our systems, logged access, and regular backups.
No system is perfectly secure. If a breach affects your data, we will tell the business concerned (or you, if you are our customer) quickly, and the authorities where the law requires.
Your rights
You can ask us to:
- see the personal data we hold about you;
- correct it if it is wrong;
- delete it;
- stop or limit how we use it, or object to it (for example, to marketing);
- give you a copy in a common format, or send it to someone else;
- withdraw your consent, where we rely on consent.
Write to [email protected]. We answer within 30 days, usually much sooner. We may need to check who you are first.
If you are not happy with our answer:
- In the EU, you can complain to your national data protection authority.
- In Lebanon, there is no separate data protection authority; you can go to the competent courts.
- Elsewhere, you can contact your local data protection authority if there is one.
Cookies
Our website does not use cookies, advertising or trackers. It remembers your language and your light or dark mode choice only in your own browser. Its fonts are stored on our own website, so your browser does not connect to any outside service to show them.
If we add analytics later, we will update this section and ask for consent where the law requires.
Children
Our services are meant for businesses and adults. We do not knowingly collect children’s data. If you think a child has sent us personal data, tell us and we will delete it.
AI and automatic decisions
Our assistants use AI to write replies. They do not make decisions that have legal or similarly important effects on you. A person at the business can always take over the chat.
Changes
We may update this policy. We will change the date at the top and, for important changes, show a notice on our website or tell our business customers directly.