Privacy Policy

Rudood is a customer service automation platform powered by advanced AI models from OpenAI (such as GPT-4o mini). The platform operates through a Meta Business application integrated with Meta Business APIs, enabling it to receive and automatically respond to messages across: • WhatsApp Business (WhatsApp Business Platform) • Instagram (Instagram Messaging API) • Facebook Messenger (Messenger Platform) When you connect your account to Rudood, you grant us access to your customers' conversations on these platforms for the purpose of responding automatically on your behalf.

a) Business owner data (client): • Full name, email address, phone number • Business name and information • Product details, pricing, and policies you provide for AI training • Account and subscription data b) Your customers' data (end users): • Messages sent by your customers via WhatsApp, Instagram, or Messenger • Conversation identifiers (User IDs) linked to Meta platforms • Message timestamps • We do not collect personal data of end users beyond what they voluntarily share in conversation c) Usage data: • Message statistics and response times • Technical information (IP, browser, device type) for security purposes

We use collected data for specific purposes only: • Operating the AI-powered auto-reply service on your behalf • Training and fine-tuning the AI model on your business specifics (products, tone, policies) • Processing incoming messages via Meta APIs and sending responses • Improving response quality and platform performance • Sending technical notifications and service updates • Providing technical support when needed We do not use your customers' conversations for any marketing or commercial purpose outside the agreed service scope.

Rudood is integrated with the Meta Business Platform and operates in accordance with Meta's terms of use and policies, including: • Meta Platform Terms (Meta Developer Data Policy) • WhatsApp Business Policy • Messenger Platform Terms of Service • Instagram Messaging API requirements We comply with the following restrictions imposed by Meta: • We do not use user data for targeted advertising purposes • We do not sell or share user data with any third party for commercial purposes • We restrict access to conversation data to our staff and technical systems only • We retain data only for the duration necessary to operate the service Data processing via Meta is also subject to Meta's Privacy Policy available at: https://www.facebook.com/policy

We do not sell or rent your data. We share data only in these cases: • Technical service providers: OpenAI (for language processing and AI), and our certified hosting and cloud process automation providers — all committed to not using your data for purposes outside the service scope • Meta Platforms: We exchange messages with Meta platforms (WhatsApp / Instagram / Messenger) within the authorized technical integration framework • Legal authorities: When legally required by court order or official government request • With your explicit prior consent in any other case

We implement multi-layered security measures: • Full data encryption in transit (TLS 1.3) and at rest (AES-256) • Access control based on the principle of least privilege • Isolation of each client's data from others in independent environments • Regular security reviews and penetration testing • Encrypted and regular backups • Audit logs for all data access operations • Data is processed and hosted on private, independent self-managed cloud servers (VPS) to ensure the highest levels of control and isolation of customer data

• Account data: retained as long as your account is active • Conversation logs: stored for 12 months by default, extendable or reducible by request • Training data: deleted or cleaned upon subscription cancellation Upon account closure: • Conversation data is deleted within 30 business days • Training data is deleted within 60 business days • We retain what is legally required (e.g., invoices) per regulatory requirements You may request immediate deletion of your data at any time via email. In accordance with Meta's policies, users may request complete erasure of their data by contacting us via email, and the request will be fulfilled within a maximum of 30 days.

You have the right to: • Access: Obtain a copy of the personal data we hold about you • Rectification: Correct any inaccurate information • Erasure: Request deletion of your data ("right to be forgotten"), subject to legal requirements • Restriction: Object to the use of your data for certain purposes • Portability: Receive your data in a machine-readable format • Withdrawal of consent: Revoke Meta account access permissions at any time To exercise any of these rights, contact us at: privacy@rudood.app

Our services are directed exclusively to businesses and adults (18 years of age and older). We do not knowingly collect data from minors. If we discover that a minor's data was accidentally collected, we will delete it immediately and notify the guardian if possible.

We may update this policy to reflect legal or technical changes. Upon update: • We will notify you via your registered email at least 30 days before material changes take effect • We will display a clear notice in the dashboard • We will archive previous versions of the policy Your continued use of the service after an update constitutes acceptance of the revised policy.

This policy is governed by and interpreted in accordance with the laws and legislation in force in the State of Palestine. In the event of any dispute, jurisdiction shall lie with the Palestinian courts.

For any questions, inquiries, or complaints related to your privacy: 📧 Email: privacy@rudood.app 💬 WhatsApp: Contact us through the website 🌐 Website: rudood.app We are committed to responding to all privacy-related inquiries within 72 business hours.