سياسة الخصوصيةPrivacy policy

Mudheef (مضيف) is an AI sales and support assistant for online stores. This policy explains the data Mudheef handles for three groups: stores that use Mudheef and their team members, shoppers who chat with a store through Mudheef, and visitors to this website.

For shoppers' data, the store is the controller: it decided to add the chat to its website, and it decides what the chat is for and which features it turns on. Mudheef is a processor: it handles that data on the store's behalf, only to run the service the store asked for. The store's own privacy policy therefore also applies to you.

For store accounts and visitors to this website, Mudheef is responsible for the data.

In every chat

• Your messages and the replies from the AI assistant and the store's team: to answer you, and so the store's team can read the chat and take it over when needed.
• A random visitor id and a random secret that the chat creates in your browser: so your chat stays yours, and no other visitor can read it or write into it. We store only a hash of the secret, never the secret itself.
• The page you're on (its address and title), the pages you viewed in this store, and what's in your cart (products, quantities and cart value): so the assistant can answer about what you're looking at, and the store can see where shoppers need help. The chat doesn't send pages such as your account, your orders or checkout, and the record of pages you viewed is deleted after 30 days.
• Your approximate location (country, city and rough coordinates) as our hosting provider estimates it from your connection, and your language: for the store's view of who is on its site now, and to reply in your language. We don't store your IP address; we keep a salted hash of it, used only to limit how many messages and new chats can come from one connection.
• Your rating of an answer or of the team's service, and any comment you add.

When you choose to give us something

• Contact details: a phone number or email if you write one when asking for the team (optional), or a WhatsApp number if you agree to order and cart reminders: so the team can get back to you, or send you what you agreed to.
• Order lookups: an order number and the email on that order. We check them against the store's orders so you only ever see your own. If they match, the email may be saved on your contact record with the store.
• Photos and PDFs you send (up to 4 MB), such as a receipt or a photo of a damaged item: for the store's team.
• What you type before sending, only after you've asked for a person: the team sees your message as you type so they can answer sooner, and the chat tells you so.
• A view of your page, if the store's team asks to see the page in front of you. The chat asks you first, and nothing starts until you agree. The team sees a copy of the page with every field value removed, plus your scrolling and pointer, and never what you type. Taking control is a separate request: the team can scroll the page, click on it or move you to another page of the same store only if the chat asks you a second time and you agree. The team never types for you, and control never works on password, card, payment, phone or address fields or on checkout pages. You can stop at any time, and it stops if you leave the page or go quiet for a short while. We note only when control started and ended, not what was on the page. The copy of the page is deleted when sharing ends, and it is never recorded.

When the store connects other services

• WhatsApp, Instagram, Messenger and Telegram: your messages there and the id that channel gives you: so we can reply in the same chat.
• The store's platform (such as Shopify, Salla, Zid or WooCommerce): orders and carts, including the products, amounts, and the name, email and phone on them: to answer order questions, to send cart and cash-on-delivery messages if the store turns them on, and to count the sales the chat helped with.
• Messages the store starts (cart reminders and broadcasts) go only to people who agreed to receive them. We keep a record of that consent and of every message sent, and we stop the messages if you reply with a word like STOP or «إيقاف».

• The store account: the store's name, website address, platform, currency and plan, and the settings it chooses (greeting, colours, opening hours, rules and team member names), with a history of every settings change so it can be undone.
• Signing up: when a store signs itself up, we keep the store's name, its owner's name and email address, the store's website if given, its platform and its currency. We send a 6-digit code to that email through Resend. The person who signs up becomes the store's owner with their own login, and can later sign in with a code sent to their email.
• Sign-in: a store signs in to the dashboard with a login key, and we store only a hash of it; the same goes for API keys. The owner can give each team member their own login, and then we keep their name, role, who added them, and when they were added, first signed in and last used the dashboard, and their email address if the owner adds one, so they can sign in with a code sent to it and get their sign-in link there. Sign-in codes, email codes and logins are stored only as hashes; there are no passwords, and no phone number is asked for. A removed member's name stays on what they wrote, and is deleted with the store.
• The store's content: products, policies and help articles, and pages of the store's website if the store runs the shop analysis: so the assistant can answer from them.
• Connections to other services: the access tokens and secrets a store gives us to connect its platform and tools, stored encrypted.
• The team's work: team replies, internal notes, labels, test questions and ratings of answers.
• Usage: the number of AI conversations and the cost of each AI request: for plan limits, and to protect the store from unusual use.

The store's chat

The chat sets no cookies. It uses your browser's storage:

• Local storage (kept until you clear it): the visitor id, the secret, the language you chose, and whether you agreed to WhatsApp reminders.
• Session storage (cleared when you close the tab): the conversation id, the messages on screen, whether you're waiting for the team, the team member's name, the last reply you received, whether an automatic welcome message was shown, the last cart sent, and a two-second marker when the team sends you to another page after you allowed control.

The first time the chat opens, your browser loads fonts from Google Fonts. If the store turns on "pixel events", the chat sends events such as opening the chat or asking for the team to the analytics tools already on the store's page (such as the Google tag, Meta Pixel and TikTok Pixel). Those are the store's own tools, under its policy.

This website and the dashboard

• This website keeps the language you chose in local storage and loads fonts from Google Fonts. It has no analytics or advertising tools.
• The dashboard keeps the login key in session storage until the tab is closed, and display preferences (language, sort order, alerts and the team member's name) in local storage.
• When Mudheef is installed from Zid, we set one short-lived cookie to check the install request, and delete it once the install is done.

We don't sell personal data, and we don't share it for advertising. The parties below receive data only to run the service.

Always, to run the service

Only when the store connects them

Each one receives only what it needs to do its job:

• Store platforms: Shopify, Salla, Zid and WooCommerce: products, orders and carts.
• Chat channels: Meta (WhatsApp Business, Instagram and Messenger) and Telegram: messages to and from the shopper. WhatsApp messages pass through Meta's service (the WhatsApp Cloud API) on the store's own number, and Meta's own policies apply to what passes through it.
• Email and SMS: Resend, SendGrid, Taqnyat and Unifonic: the message and the recipient's address.
• Team alerts: Slack, Microsoft Teams, Discord and Telegram, and WhatsApp from the store's own number to its team's phones: an alert that a shopper wants the team, which may include their question and the contact details they wrote.
• Voice notes turned into text: OpenAI or ElevenLabs, only if the store turns voice notes on: the recording of a voice note the shopper sends on WhatsApp, so its words can be written down and the assistant can answer them.
• Help desks and CRM: Zendesk, Freshdesk and HubSpot: the conversation and contact details.
• Marketing and analytics: Klaviyo, Mailchimp, Google Analytics 4 and Google Sheets: events and contact details, as the store sets up.
• Couriers: Aramex, DHL, Naqel and SMSA: the tracking number, to look up a shipment's status.
• The store's own systems, through the webhooks and API keys the store sets up. If a store connects its own order-status address, the order number and email you give are sent to that store's own system.

We may also disclose data where the law requires us to.

The service runs on Vercel's servers in Frankfurt, Germany, and the database is with Neon, also in Frankfurt. Anthropic processes messages on its own servers, mostly in the United States, to write the replies. This means data is processed and stored outside Saudi Arabia and the Gulf.

We delete a chat 12 months after its last message. It goes whole: the shopper's messages, the assistant's and the team's replies, the team's notes, requests passed to the team, photos and files, ratings, and the messages sent in it. A chat with a message newer than 12 months stays whole.

We also delete the record of a visitor who hasn't been seen for 12 months and has no chat left: their visitor id, the hash of their secret, their approximate location and language, their "view your page" records, and what they clicked. Counts of messages and chats older than 12 months are deleted for every shopper, WhatsApp shoppers included. All of this is checked every day.

A store can delete any chat or contact sooner, at any time, and we delete data on request.

What's kept longer, and why

• Contacts (name, email, phone, tags and notes): they're the store's customer list, so they stay until the store deletes them or someone asks for them to be deleted.
• Consents and stops: proof that a shopper agreed to messages or asked them to stop, so they stay until that shopper's data is deleted.
• Orders and what was in them, the answer to a cash-on-delivery question, and carts' products and amounts: they're the store's sales numbers. Who a cart belonged to is cleared after 90 days, as the next list says.
• The record of messages the store sent outside a chat (cart reminders, broadcasts, order updates and cash-on-delivery questions): proof of what was sent, and to whom.
• The store's settings, products, help articles and test questions: while the store uses Mudheef.
• The record of privacy actions (who downloaded or deleted data, when, and how many rows), with nothing about shoppers.

The dashboard's numbers for chats, answers and requests to the team cover the last 365 days at most, so deleting older chats doesn't change them. Sales numbers come from orders, which stay.

These are deleted even sooner, automatically:

• Answers kept for a short time to reply faster: after 6 hours.
• The record of pages a shopper viewed: anything older than 30 days, checked every day.
• The phone number, email and name on a cart, and its checkout link: 90 days after the cart was last active. The cart's products and amounts stay, without who it was.
• The copy of a page in "view your page": when sharing ends.
• The text of the store's web pages read by the shop analysis: when the analysis ends.
• Finished background tasks, and consent requests the shopper never confirmed: after 30 days.
• Email codes: the sign-up form's details are cleared when the code is used, or soon after it ends (it works for 15 minutes); the hashes of the code, the email and the network address, kept for the usage limits, are deleted after 3 days.
• The hash of the network address kept with each counted chat, for the limit on new chats from one connection: after 2 days.

If you're a store's shopper

Depending on the law that applies to you, such as Saudi Arabia's Personal Data Protection Law, you may have the right to know how your data is used, to get a copy of it, to have it corrected or deleted, and to withdraw your consent. Make your request to the store you shopped with: it's responsible for your data, and we carry out what it asks.

• The full steps are on the data deletion page.
• For Shopify stores, the deletion request Shopify sends reaches us automatically, and we delete your contact details, chats, the team's replies and notes, requests passed to the team, attachments, carts, messages, consents and the orders linked to you.
• Any store can also find, download and delete your data from its dashboard, by your email or phone number.
• We find your data through your email or phone number. If you chatted without giving either, we can't link that chat to you.
• Also for Shopify stores, when Shopify sends your request for a copy of your data, we gather what we hold about you, and the store downloads it from its dashboard.
• To stop WhatsApp messages you agreed to, reply with a word like STOP or «إيقاف».

If you're a store

• When you remove the Mudheef app from Shopify, Salla or Zid, we delete all of your store's data. That includes all of your shoppers' data. Only three things are kept, for 30 days, so that installing again keeps working: your store's id, its chat key (the one in your store's chat code) and your plan, with its Shopify billing dates if you pay through Shopify: when your paid month ends, and when a test charge began. Nothing about shoppers or people is kept, and these three are deleted after 30 days. If you install Mudheef again within that time, the chat on your store works again with the same key and plan; your chats, contacts and settings don't come back.
• You can download your chats as a CSV file from the dashboard.
• From the dashboard, the store owner can also download all of the store's data as one file (login keys and other secrets are left out) and delete the store with everything Mudheef holds for it.

• Each store kept apart: the database itself keeps each store's data apart with row-level security: the chat and the dashboard work through a database role that can only see the store it's serving. An automated test checks this.
• Encrypted secrets: access tokens for store platforms and the secrets of connected services are stored encrypted, and the encryption key is only in the server's settings.
• Hashes instead of keys: for dashboard login keys, API keys and shoppers' chat secrets, we store only a hash.
• No IP addresses: we store only a salted hash.
• Checked senders: messages from Shopify, Salla, Zid, WhatsApp and the other services are accepted only with a valid signature or shared secret.
• Checks before the AI: shoppers' messages and the store's text are checked for hidden instructions before they reach the model.
• Usage limits: limits on messages per visitor, per network address and per store, and a daily and monthly cap on each store's AI cost.
• Telling the store about a breach: if we learn that someone reached a store's data without permission, we tell the store without undue delay and within 48 hours of learning, so it can do what the law requires of it.

The assistant's replies are written by AI and always carry the label "AI assistant". When someone from the store's team replies, their name and "Store team" are shown. The assistant answers from the store's information, and it can be wrong. It never changes an order by itself: return, exchange, cancellation and address-change requests go to the store's team, and the team decides.

We don't use shoppers' chats to train AI models. A store can copy a question from a chat into its own test questions, and each night the AI reads the chats that went badly to suggest improvements the store approves or rejects. That stays within the store's own account.

Mudheef is a service for businesses. It isn't aimed at children, and we don't knowingly collect children's data. Each store decides who its shop is for, and applies its own policy to younger shoppers. A store that sells to minors is responsible for getting a parent's or guardian's consent, and Mudheef doesn't check shoppers' ages.

If we change this policy, we update this page and the "last updated" date at the top. If a change affects how shoppers' data is used, we tell stores before it takes effect.

If you're a store's shopper, contact the store you shopped with first.

You can also complain to the data protection authority in your country; in Saudi Arabia that is the Saudi Data and AI Authority (SDAIA).