1. Scope and who we are
This Privacy Policy explains how Sahor One Technologies, Inc. ("Sahor One", "we", "us" or "our") collects, uses, discloses, transfers, retains and protects personal data when you visit our websites, communicate with us, join a pilot, create an account, or use the Sahor One platform, applications, APIs, WhatsApp-enabled workflows and related services (collectively, the "Services").
Sahor One is a Delaware corporation serving business customers internationally, including in the United Arab Emirates and the wider GCC. This Policy is designed to address the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and, where applicable, the EU General Data Protection Regulation ("GDPR"), UK GDPR, DIFC Data Protection Law, ADGM Data Protection Regulations and other applicable privacy laws.
2. Our privacy roles
Our role depends on the context:
- Controller/business: We determine the purposes and means of processing for our website, sales, account administration, billing, security, service analytics, support and direct business communications.
- Processor/service provider: We generally process Customer Data, including end-customer and employee information placed in the Services by a customer, on that customer's documented instructions. The customer remains responsible for deciding why and how that data is used and for providing required notices and obtaining required consents.
Where required, our Data Processing Addendum ("DPA") forms part of the agreement with the customer.
3. Information we collect
Information you provide
- Account and identity information, such as name, work email, business phone number, job title, login credentials and profile settings.
- Business information, including business name, category, team size, locations, pricing, tax identifiers, bank or payout details and operational preferences.
- Sales, pilot and support information, including forms, emails, calls, meeting notes, feedback and troubleshooting records.
- Customer Content submitted to the Services, including contacts, leads, quotes, job records, schedules, invoices, files, photos, voice notes, messages, instructions and payment-status information.
Information from connected services
When an authorised user connects WhatsApp Business, Meta products, Google services, payment providers, calendars, email services or other integrations, we may receive identifiers, access tokens, configuration data, lead data, message content, metadata and other information permitted by the user's settings and the third party's policies.
Information collected automatically
- Device, browser, IP address, approximate location, operating system and language.
- Usage events, page views, feature interactions, error logs, security events and performance data.
- Cookie and similar-technology data, subject to applicable consent requirements.
AI feature data
Prompts, instructions, source content, generated drafts, ratings and safety signals may be processed to provide AI-assisted responses, summaries, extraction and workflow automation. We do not use Customer Content to train public general-purpose models unless the customer expressly opts in or a separate written agreement states otherwise.
Identity, business verification and biometric data
When a business activates payments, e-invoicing or other regulated features, we collect information to verify the business and the people who own or control it: trade licence and registration details, names, dates of birth, nationality, identity document images and data, a live facial image or short video for liveness and face matching, and screening results against sanctions, politically exposed person and adverse-media lists. Shufti Pro performs these checks as our service provider. Facial biometric data is used only to confirm that the person presenting a document is its holder, is processed with the individual’s consent where the law requires it, and is not used for any other purpose. We keep verification records for as long as anti-money-laundering and other legal obligations require, and then delete or anonymise them.
4. How we use information
- Provide, configure, secure, maintain and improve the Services.
- Authenticate users, administer accounts and provide customer support.
- Capture leads, organise conversations, schedule work, generate business records, facilitate invoicing and support payment workflows at a customer's direction.
- Operate AI-assisted features, including drafting, classification, extraction, translation and recommendations.
- Process subscriptions, promotional offers, billing, taxes and account credits.
- Monitor reliability, prevent fraud, abuse, spam and security incidents, and enforce our agreements.
- Communicate about service notices, product updates, pilots, events and relevant business offerings.
- Comply with law, lawful requests, audits, accounting and regulatory obligations.
- Create aggregated or de-identified insights that do not reasonably identify an individual or customer.
5. Legal bases
Where a law requires a legal basis, we rely on one or more of the following: performance of a contract; steps requested before entering a contract; compliance with legal obligations; our legitimate interests in operating, securing and improving a B2B platform; consent; protection of vital interests; and establishment, exercise or defence of legal claims.
You may withdraw consent at any time where consent is the basis, without affecting processing already carried out lawfully.
6. Customer Data and business responsibilities
Customers control the Customer Data they submit or connect to the Services. Customers must ensure that they have a lawful basis to collect, upload, use, message, record and disclose personal data, including appropriate WhatsApp or marketing opt-ins, employee notices and permissions for connected accounts.
We process Customer Data to deliver the Services, follow documented customer instructions, maintain security, meet legal obligations and perform other activities authorised by the agreement. Privacy requests concerning Customer Data should normally be directed first to the relevant customer. We will assist customers as required by applicable law and the DPA.
8. Payments and financial data
Payments and payouts may be processed by third-party payment providers. Sahor One generally receives transaction identifiers, status, amount, currency, payer or payee references and limited account details. We do not intentionally store complete payment-card numbers or card security codes.
Payment providers process data under their own privacy notices and regulatory obligations. Sahor One is not a bank or financial institution.
9. International transfers
We and our service providers may process data in the UAE, the United States and other countries where we or our providers operate. These countries may have different data-protection laws.
Where required, we use recognised transfer mechanisms and safeguards, such as contractual protections, data-processing agreements, European Commission Standard Contractual Clauses, UK transfer mechanisms, transfer assessments, access controls and encryption. We also apply UAE PDPL requirements for transfers outside the UAE where applicable.
10. Data retention and deletion
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain business and security records, resolve disputes and comply with legal, tax, accounting and regulatory obligations.
Customer Data is retained according to the subscription, Order Form and DPA. Following termination, data may remain available for a limited export or recovery period and may persist temporarily in encrypted backups before secure deletion. We may retain data that must be preserved for legal holds, fraud prevention or compliance.
11. Security
We use administrative, technical and organisational safeguards designed to protect personal data, including role-based access, authentication controls, encryption in transit, monitoring, logging, backups, vendor review and incident-response procedures. No system can be guaranteed completely secure.
Customers must protect credentials, use appropriate permissions, keep connected accounts secure and promptly report suspected compromise to security@sahorone.com.
12. Cookies and analytics
Our websites may use necessary cookies for security, preferences and core functionality, and may use analytics or marketing technologies where permitted. Where consent is required, non-essential technologies are activated only after consent.
You can manage cookies through the consent controls made available on the site and through your browser. Disabling necessary cookies may affect functionality.
On our public website, analytics is provided by Google Analytics and runs only after you accept analytics cookies. You can change that choice at any time through “Manage cookies” in the website footer.
13. Business communications
We may send service-related messages that are necessary to administer an account. We may also send product news, event invitations and business marketing where permitted. You may unsubscribe from marketing using the link in the message or by contacting us. Unsubscribing does not stop essential service communications.
14. Your privacy rights
Depending on your location and the applicable law, you may have rights to:
- be informed and obtain access to personal data;
- correct inaccurate or incomplete data;
- request deletion, restriction or cessation of processing;
- object to certain processing, including direct marketing;
- receive or transfer data in a structured, commonly used and machine-readable format;
- withdraw consent;
- request information about automated processing; and
- complain to a competent data-protection authority.
To exercise a right, email legal@sahorone.com. We may verify identity and authority before responding. Rights are subject to legal conditions, exceptions and the role in which we process the data.
15. AI and automated processing
The Services may use AI to draft replies, classify leads, extract information, translate text, suggest actions or automate workflows. AI output may be incomplete, inaccurate or inappropriate and should be reviewed by an authorised human before it is sent or relied upon.
We do not make decisions producing legal or similarly significant effects about individuals solely through automated processing unless this is expressly configured by a customer, lawfully permitted and subject to required safeguards.
16. Children
The Services are not directed to children and are intended for authorised business users who are at least 18 years old or otherwise legally capable of entering a business agreement. Customers must not submit children's data unless they have a lawful basis, appropriate authority and any required parental or guardian consent.
17. Changes to this Policy
We may update this Policy to reflect service, legal, regulatory or operational changes. We will post the revised version with an updated date and provide additional notice where required. Material changes do not apply retroactively where prohibited by law.
18. Contact and complaints
Sahor One Technologies, Inc.
For privacy rights, data concerns and privacy complaints: legal@sahorone.com
For general company enquiries: hello@sahorone.com
You may also lodge a complaint with the competent data-protection regulator in your jurisdiction. We encourage you to contact us first so we can try to resolve the concern promptly.