Privacy Policy

1. Introduction & Scope

Welcome to Siraa Labs ("we", "our", "us"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use, process, and protect your information when you interact with our platform, AI automation models, website, and our communication tools, including our integrated WhatsApp and Instagram messaging automations.

By using our services or accessing our platform, you consent to the data practices described in this policy.

2. Data We Collect

Depending on whether you are a business user (Tenant) or an end-customer interacting with a tenant’s automated agent, we collect the following types of information:

3. How We Process Messaging Data (WhatsApp & Instagram)

Our communication automation components utilize third-party APIs (specifically Meta Cloud API for WhatsApp and Instagram Messaging API) to retrieve and send messages.

• AI Inference: Message contents are sent dynamically to our secure LLM integration layer (DeepSeek AI) to understand query intent, retrieve tenant-specific knowledge bases, and formulate replies.
• State & Context Retention: We store conversation histories (up to 10 previous messages) and state flags in our secure database to enable multi-turn dialog context and scheduling flows.
• Lead Scoring & Analytics: Chat logs are evaluated by our background AI analyzer to extract user intent, product interest, and schedule availability.

4. Data Sharing and Meta Integrations

We do not sell, rent, or trade your personal data. We share data only with service providers required to deliver our core services:

• Meta Platforms, Inc.: Message receipts, media payloads, and recipient identifiers are processed through Meta’s server infrastructure to power WhatsApp and Instagram endpoints.
• Instagram Login (Business): When a business connects Instagram, we request instagram_business_basic (account identity and media listing), instagram_business_manage_messages (send/receive DMs), instagram_business_manage_comments (comment webhooks, public comment replies, and Private Reply DMs for Comment-to-DM automation), and instagram_business_manage_insights (post and reel performance metrics in the portal Analytics view). We store the long-lived access token, Instagram business account ID, and username so the tenant can run AI messaging, keyword-based comment automation, and post analytics. We do not request publishing permissions.
• Supabase: Our database provider stores session logs, tenant configurations, and encrypted system tokens.

5. Data Security & Storage

All customer data is encrypted in transit and securely stored at rest. Access to tenant configurations is strictly restricted using service-role tokens. We retain message logs only as long as necessary to provide active automation, after which logs are archived or deleted based on tenant retention settings.

6. Your Rights & Data Control

You have the right to request access to your personal data, request corrections, or request deletion of your messaging history. See our public User Data Deletion Instructions page for Meta-compliant guidance. Business tenants manage deletions in the portal Privacy page.

7. Contact Us

If you have any questions or concerns regarding this Privacy Policy, please contact us at: