Privacy Policy

Last updated: October 1, 2026

Who we are and what this policy covers

This Privacy Policy explains how Nidaa AI, Inc. ("Nidaa", "we", "us") collects, uses, shares and protects personal data when you use the Nida'a platform, including our website at nidaa.ai and our dashboard at app.nidaa.ai (the "Service"). By using the Service you agree to this policy.

We act as a controller for the personal data of people who register for and use the Service (our customers and their team members). When customers use the Service to message their own contacts, we act as a processor: we handle contact and message data only on the customer's instructions, and the customer decides why and how it is used. The customer is responsible for having a lawful basis, including opt-in consent, to message its contacts.

What information we collect

The information we collect depends on how you use the Service.

• Information you give us: your name, email address, password (stored as a hash), business name, role, billing details and the messages you send to our support team.
• Customer content you add: contacts (names, phone numbers, usernames and attributes you upload), contact groups, message templates and campaigns.
• Information from the channels you connect: for each connected channel (such as WhatsApp, Instagram, Facebook Messenger or Telegram), account, page or bot identifiers, phone number IDs, display names, quality ratings where provided, the access tokens that you provide or authorize, and the messages, replies, delivery status and read status exchanged through the Service.
• Information collected automatically: IP address, device and browser information, log data, API usage and the cookies needed to keep you signed in.

How we use information and why

We use information for the purposes below. Where the law requires a legal basis, the basis is shown for each purpose.

• To provide and operate the Service, including sending your campaigns and showing delivery results. Basis: performance of our contract with you.
• To create and manage your account and authenticate you. Basis: performance of our contract with you.
• To provide customer support and send service notices. Basis: performance of our contract and our legitimate interests.
• To secure the Service, detect abuse and prevent fraud. Basis: our legitimate interests.
• To maintain and improve the Service. Basis: our legitimate interests.
• To comply with legal obligations. Basis: legal obligation.

Where we handle contact and message data as a processor, the purposes are set by the customer. We do not use that data for our own purposes, and we do not use it for advertising. Where we rely on your consent, you can withdraw it at any time.

How we share information

We share personal data only in these cases:

• With the channel providers you connect, such as Meta (WhatsApp, Instagram, Facebook Messenger) and Telegram, to connect your accounts and deliver the messages you ask us to send.
• With service providers that help us run the Service, such as hosting, email delivery and logging and monitoring providers. They process data only for us and under written agreements.
• With authorities and advisers, when required by law or to protect rights, safety and security.
• With a successor, in a merger, acquisition or sale of assets, with notice to you.
• With your team members, according to the roles you assign in your account.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Connected channels and third-party platforms

The Service connects to messaging and social platforms such as WhatsApp, Instagram and Facebook Messenger (Meta), Telegram, and others we add over time. When you connect a channel, including through a provider's own sign-in or onboarding flow such as Meta's Embedded Signup, we receive the identifiers and access tokens needed to send and receive messages and manage that channel on your behalf. We use them only to provide the Service to you. Messages and content are delivered through the provider, which processes data under its own terms and privacy policy. You can disconnect a channel at any time, and you can revoke our access in that provider's settings.

International transfers

We and our providers may process data in countries other than your own. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect data transferred across borders.

How long we keep information

We keep personal data while your account is active and as long as needed to provide the Service. When you delete your data from your account, we delete it as described on our Data Deletion page. We may keep limited data where the law requires it, such as billing and tax records, or where needed to resolve disputes and keep the Service secure.

How to manage and delete your information

You can update your profile in your account settings. You can also delete or suspend your account from your account settings, with the option to delete your data as well. The steps are on our Data Deletion page.

Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data.
• Restrict or object to our processing of your data.
• Receive your data in a portable format.
• Withdraw your consent where we rely on it.

You can delete your account and data yourself from your account settings. To exercise your other rights, contact us using the details below. If your data was uploaded by one of our customers, we may refer your request to that customer. We do not discriminate against you for exercising your rights. You may also complain to your local data protection authority.

Security

We use technical and organizational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords and API keys, and access controls. No system is completely secure. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If we learn that we have, we delete it.

Cookies

We use only the cookies needed to sign you in and keep the Service working. We do not use advertising cookies.

Changes to this policy

We may update this policy. We will post the new version here with a new date and notify you of material changes before they take effect.

Contact us

Nidaa AI, Inc. For questions about this policy or to exercise your rights, email:

Email: info@nidaa.ai