Privacy Policy

1. Our Role: Data Controller vs. Data Processor

To ensure transparency and strict compliance under global data protection laws (including the EU General Data Protection Regulation and the California Consumer Privacy Act), QualifAI operates in two distinct legal capacities depending on the nature of the interaction:

• QualifAI as a Data Controller: We act as the Data Controller for the personal and corporate account details of our direct B2B Clients, marketing agencies, and website visitors who register for workspaces, configure integrations, or manage subscriptions on app.qualifai.io.
• QualifAI as a Data Processor (Service Provider): When End-Users click on a Client's Meta advertisement (Click-to-WhatsApp) and message a Client's connected WhatsApp Business Account, QualifAI processes those messages, contact records, and extracted qualification attributes strictly on behalf of and under the instructions of the respective Client (who serves as the Data Controller).

2. Information We Collect

We collect and process structured categories of data required to provision multi-tenant workspaces, ingest Meta Cloud API webhooks, and execute autonomous lead qualification workflows.

3. How We Use Information

We use the collected information strictly for the following operational and contractual purposes:

1. Autonomous Lead Qualification: Ingesting inbound WhatsApp messages via Meta Cloud API webhooks, debouncing rapid message bursts in temporary cache buffers, and generating contextual replies grounded in the Client's specific Meta Ad offer and verified Knowledge Base (RAG).
2. Populating the Client CRM & Live Inbox: Structuring extracted lead attributes (such as budget, location, and buying intent) into the Client's visual CRM pipeline on app.qualifai.io and alerting human sales representatives when an escalation or human handoff is triggered.
3. Ad Attribution & Optimization (Meta CAPI): Where configured by the Client, transmitting offline conversion or lead progression events back to the Meta Conversions API (CAPI) so the Client can optimize their paid advertising performance.
4. Platform Administration & Security: Authenticating users, enforcing multi-tenant data isolation, monitoring conversation quotas, verifying webhook cryptographic signatures (X-Hub-Signature-256), and preventing unauthorized access or abuse.

4. Artificial Intelligence & Third-Party Sub-Processors

To deliver low-latency conversational responses, QualifAI utilizes enterprise Large Language Models (LLMs) and cloud infrastructure providers (including OpenAI, Anthropic, Google Cloud, PostgreSQL with pgvector, and Redis):

• No Public Model Training on Your Data: Data transmitted to third-party AI inference APIs—including WhatsApp message transcripts, Meta Ad context, and Client RAG documents—is processed strictly via zero-training commercial APIs. Neither QualifAI nor our LLM sub-processors use Client or End-User data to train foundation AI models.
• Strict Multi-Tenant Isolation: Every Business workspace operates within logically isolated database records and vector namespaces (business_id and tenant_id scoping) so that one Client's knowledge base or lead data can never be accessed by another tenant.
• No Sale of Personal or Business Data: We never sell, rent, or trade Client lists, WhatsApp phone numbers, or conversation logs to third parties, advertisers, or data brokers.

5. Compliance with Meta Platform Terms

QualifAI's use of information received from Meta APIs (including the WhatsApp Business Cloud API, Meta Graph API, and Facebook Login for Business) adheres strictly to the Meta Platform Terms and Developer Policies:

• System User Access Tokens obtained via Meta Embedded Signup are used solely to configure webhooks, send and receive authorized WhatsApp messages (whatsapp_business_messaging), and manage the specific WABA assets explicitly authorized by the Client (whatsapp_business_management).
• We do not use Meta Platform Data to build independent cross-merchant user profiles, conduct unauthorized surveillance, or send unsolicited promotional messages outside Meta's permitted 24-hour customer service or 72-hour Click-to-WhatsApp conversation windows.

6. Data Security & Encryption

We implement industry-standard technical and organizational safeguards designed to protect sensitive business credentials and customer communications:

• Credential Encryption at Rest: All Meta System User Access Tokens and third-party API keys are encrypted at rest using AES-GCM encryption prior to database persistence.
• Encryption in Transit: All network traffic across qualifai.io, app.qualifai.io, and api.qualifai.io is encrypted via TLS 1.2/1.3.
• Webhook Verification & Ephemeral Caching: Every incoming Meta webhook payload is cryptographically validated using HMAC-SHA256 (X-Hub-Signature-256), and temporary Redis message debouncing buffers expire automatically within seconds of turn execution.

7. Data Retention & User Data Deletion Instructions

We retain Client account data and lead records for as long as the Client's account remains active or as needed to provide the Services. Temporary message debouncing caches in Redis are purged immediately after turn execution. Upon account termination, all associated tenant workspaces, WABA tokens, vector embeddings, and conversation logs are permanently deleted within 30 days, unless statutory retention is required by law.

8. Your Privacy Rights (GDPR, CCPA & Global Standards)

Depending on your jurisdiction, you have the statutory right to access a copy of the personal data we hold about you, request rectification of inaccurate or incomplete data, request erasure (“Right to be Forgotten”) of your personal information, object to or restrict certain processing activities (including automated profiling), and request data portability in a structured, machine-readable format (CSV/JSON). To exercise any of these rights, please contact us at privacy@qualifai.io.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect architectural updates, new platform features, or regulatory changes. When we make material changes, we will update the “Last Updated” date at the top of this policy and notify registered Clients via email or an administrative notice on app.qualifai.io.

10. Contact Us

If you have questions about this Privacy Policy, our data handling practices, or our Meta API integrations, please contact our privacy and compliance team: