Privacy Policy

1. Two kinds of data, two roles

Swalfy is a business tool. Two different people's data passes through it: yours, if you run a business using Swalfy (we call you the client), and your customers', when they message your WhatsApp number.

For your own account and billing data, Al Daim Digital Ltd is the data controller — we decide how it is used, under this policy. For the messages your customers send to your WhatsApp number, your business is the data controller, and Swalfy acts as your data processor: we handle that data only to run the service for you, on your instructions, and never for our own purposes. If you are a client, you are responsible for having your own lawful basis and your own privacy notice for the customers who message you.

2. What we collect

From you, our client: your name, email address, business name, and the language you work in; your WhatsApp Business number and connection details, obtained through Meta's Embedded Signup; anything you upload to train Swalfy (price lists, menus, exported chats, website links); your business hours and services; your calendar feed link and any Google Calendar connection you set up (see 5. Calendar features); and billing details (handled by Stripe, see below).

From your customers, when they message your WhatsApp number: the content of their messages, in text or as a voice note; their WhatsApp phone number; message timestamps; and, where Swalfy detects it, the language they are writing or speaking in.

We also process ordinary technical data (IP address, browser and device type) when anyone uses swalfy.com or the dashboard.

3. Voice notes

When a customer sends a voice note, the audio is sent directly to Google Gemini to convert it into text and, if needed, translate it, so Swalfy can understand and reply to it. We do not store the recording itself — it is never written to our systems. We keep only the text transcript, so the conversation makes sense in your inbox.

4. What Swalfy does with a message

Swalfy reads each message to work out what the customer wants, draft a reply in the language they used, and, where relevant, propose or confirm an appointment or record the customer as a lead. Every conversation is given a simple outcome label (such as booked, lead, answered, or needs you) so you can see at a glance what happened.

We use this data only to run the service for your business. We do not use your customers' messages for advertising, we do not sell it, and we do not mix it with any other client's data.

5. Calendar features (optional)

If you turn them on, Swalfy can put your bookings into a calendar you already use. Both work the same way: each booking becomes an event showing the service and the time. Your customers' names, phone numbers, and messages are never included — open Swalfy to see who booked.

Calendar feed. Swalfy gives you a private link you can add to Google Calendar, Apple Calendar, or any calendar app. Anyone who has that link can see your booking times, so keep it to yourself. If it ever gets out, you can make a new link from Settings at any time, and the old one stops working immediately.

Google Calendar sync. If you connect your Google account, Swalfy writes each booking into your own Google Calendar (your primary calendar) within seconds. Google asks you to allow Swalfy to see and change events on your calendars; Swalfy only ever adds its own bookings and does not read your other appointments. Turning the connection off stops Swalfy writing new bookings, but does not remove events it already wrote — those are your own calendar entries now, not ours to delete. To remove Swalfy's access at Google as well, use the connected-apps settings in your Google account.

6. Who we share it with

We use trusted service providers (sub-processors) who only handle data on our instructions:

• Meta Platforms (WhatsApp Cloud API) — carries every message to and from your customers.
• Cloudflare — hosts the service, our database, and file storage.
• Google — converts voice notes to text and translates them (Gemini), and, only if you connect it, writes your bookings to your Google Calendar.
• OpenRouter — routes the AI model calls that understand messages and draft replies.
• Stripe — processes your subscription payment; we do not see or store your full card details.
• Resend — sends account and notification emails.

We share personal data with authorities only where the law requires it.

7. Where your data goes

Our providers operate internationally, including in the United States. Where data leaves the UK, we rely on the provider's own safeguards (such as UK adequacy regulations or Standard Contractual Clauses) to protect it.

8. Storage and security

Conversations, messages, and business data are stored on Cloudflare's infrastructure, kept separate between clients (per-tenant isolation) so one business cannot see another's data. Data is encrypted in transit and at rest. No system is completely secure, but we design deletion and access controls to be real, working features, not an afterthought.

9. How long we keep data

We keep your account and conversation data for as long as your account is active. There is currently no automatic expiry on chat data: it is kept until you delete your account, or ask us to delete specific data (see below). If you cancel your subscription, your data is not automatically erased — delete your workspace if you want it removed.

10. Deletion

You can permanently delete your entire Swalfy workspace at any time from Settings → Delete workspace in your dashboard. This erases every conversation, message, appointment, lead, your WhatsApp connection, your calendar feed link, and any Google Calendar connection. It cannot be undone, and we do not keep a backup of it afterwards.

If you had connected Google Calendar, deletion removes our stored access to it, so we can no longer write to it — but it does not delete the booking events already written into your Google Calendar. Those live in your own Google account, not ours, and deleting your Swalfy workspace is not the same as asking Google to delete entries from your personal calendar. Remove them there directly if you want them gone.

We keep a short record that a deletion happened (the business name, the date, and a scrambled version of the requester's email) so we can prove compliance if asked; this record contains none of your customers' data. We also keep what the law requires us to keep, such as billing records connected to payments already made.

If you are a customer of a business that uses Swalfy and you want your own messages deleted, please ask that business directly, since they control that data. You can also email us at hello@swalfy.com with the business name and your WhatsApp number, and we will locate and delete your conversation data within 30 days. See our Data Deletion Instructions for the full steps.

11. Your rights

You can ask to access, correct, delete, or receive a copy of the personal data we hold about you, and object to how we use it. Email hello@swalfy.com. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

12. Children

Swalfy is a business tool for adults running a company. It is not directed at children, and we do not knowingly collect data from children.

13. Changes and contact

We may update this policy. We will change the date above and, for significant changes, tell clients by email. For any privacy question, email hello@swalfy.com.

Al Daim Digital Ltd is registered in England and Wales, company number 17327688, Oxford, United Kingdom.