Privacy Policy
Last updated:
About this policy
This policy explains what personal data Spenai collects, why, who we share it with and the choices you have. Spenai is operated by AWSTREAMS DMCC (United Arab Emirates).
1. Who is responsible
For your own account data, AWSTREAMS DMCC is the controller.
When a business uses Spenai on its WhatsApp number, that business decides who is messaged and how long conversations are kept. For that conversation data, the business is the controller and we act as its processor. Questions about a conversation are best sent to the business you were talking to; we will help them answer.
2. What we collect
• Account data: name, email address, password (stored hashed), time zone, language and profile details you add.
• Conversation data: WhatsApp messages between the business and its customers, the customer's WhatsApp number and profile name, opt-in and opt-out status, the AI's draft replies, and hand-offs to the business's staff.
• Knowledge data: the documents and answers a business adds so the assistant can reply.
• Billing data: plan, billing address and tax ID if you give one. Card details go straight to Stripe.
• Technical data: IP address, device and browser type, and logs of requests and errors, which we use to secure and fix the service.
• Messages you send us, such as support emails.
3. Why we use it
• To provide the service: receive and answer WhatsApp messages for the business, draft replies with AI, and pass conversations to the business's staff (performance of our contract with you).
• To bill you and meet our tax and accounting duties (contract and legal obligation).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest in running a safe service).
• To tell you about important changes to the service or these policies (contract and legitimate interest).
4. What we don't do
We don't sell personal data, we don't use it for advertising, and we don't use your conversation data to train AI models.
5. Who we share it with
We use a small number of service providers, each bound by contract to use the data only to provide their service to us. The current list, with the data each one receives, is on our sub-processors page:
• Anthropic PBC: AI reply drafting and summarisation (US).
• Cohere Inc.: Text embeddings for retrieval (US/CA).
• Twilio SendGrid: Transactional email delivery (US).
• Meta Platforms (WhatsApp Business Platform): WhatsApp message delivery and receipt (US/EU).
• Stripe Payments Europe Ltd: Card payments and subscription billing (IE/US).
• Cloudflare, Inc.: DNS (Global edge; R2 EU).
• Contabo GmbH: Application servers and databases (hosting) (DE).
• Functional Software, Inc. (Sentry): Error monitoring (US/EU).
• Telegram FZ-LLC: Staff alert notifications (AE/Global).
6. International transfers
Your data is hosted in the European Union and may be processed in other countries where our providers operate, including the United States. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses. This includes transfers under the UAE Personal Data Protection Law.
7. How long we keep it
We keep account data while your account is active. Conversations are kept for as long as the business keeps its workspace or its retention setting allows. When a subscription ends, we pause your workspace for 90 days before anything is deleted, and we email you notice during that time. You can ask us to delete your account sooner at any time.
We keep invoices and payment records for as long as tax law requires. Server logs are kept for a short period for security.
8. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent you have given. Write to info@awstreams.com; we reply within 30 days. You can also complain to your local data-protection authority.
If a business messages you through Spenai, reply STOP at any time and it will not message you again.
9. Security
Data travels over encrypted connections, passwords are hashed, and access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.
10. Cookies
Spenai uses cookies that are needed to sign you in, keep your session secure and remember your settings. We don't use advertising cookies.
11. Children
Spenai is not meant for children under 18, and we don't knowingly collect their data.
12. Changes
If we make a material change, we will email account owners before it takes effect. The date at the top of this page shows when this policy last changed.
13. Contact
AWSTREAMS DMCC, Office 1308, 13th floor, Tiffany Tower, Cluster W, Dubai, United Arab Emirates. Email: info@awstreams.com.