Privacy Policy

Information you give us

When you create an account we store your name, email address and a hashed password. If you are invited to an organisation, we store which organisation you belong to and your role in it.

We store the content you create in Rawi Social: draft and published posts, captions, scheduled times, uploaded media, and saved replies.

We also store the business information you give us: your business description, your written business answers, your product catalogue, your brand profile, the Finance entries and receipts you add, and the sales you record.

Photos and videos you upload or generate are stored at web addresses that are long and random but public: anyone who has the exact address can open the file without signing in. This is how Meta fetches them when we publish to Facebook and Instagram, because it cannot sign in to Rawi Social. We never publish a list of these addresses. Finance receipts are stored separately and are never public.

Information from connected social accounts

When you connect a Facebook Page or Instagram professional account, Meta gives us an access token for that account. We store it so we can act on your behalf, and we use it only for the features described here.

When you connect a TikTok account, TikTok gives us an access token and a refresh token, which we store for the same purpose. From TikTok we receive your account's display name, username and profile picture, so you can tell which account you are posting to. We do not receive your TikTok password.

When you connect a WhatsApp Business number, Meta gives us access to that number's messages. We receive the messages your customers send to it, their phone numbers and profile names, and the replies sent from it. If the number stays on the WhatsApp Business app, we also receive the contacts and message history that Meta lets the app share once when you connect it, and the messages you type on your phone, so the inbox shows the whole conversation. We never publish posts to WhatsApp. If you use broadcasts, we send the WhatsApp message templates you choose, through Meta, to the people you select: customers who have messaged your number and phone numbers you upload. From an upload we keep each number, the name beside it and up to ten other columns you choose to import with it, such as a city or an order number, to fill in the templates. For each upload we record who confirmed that the people on it agreed to hear from you, and when. We keep the delivery status Meta reports for each message. If someone replies STOP or asks WhatsApp to stop your marketing messages, we record it and never include them in a broadcast from that number again; we keep that record even if you disconnect the number, so the choice is respected if you reconnect, and delete it only if you ask us to delete your Rawi Social account entirely. Templates you write in Rawi are sent to Meta for review. A STOP found in the conversation history we import when you connect a number counts too, and is recorded with the time the person sent it. When WhatsApp reports a stop for your business account as a whole rather than for one number, or for a number that another Rawi Social workspace also uses, we record it only in a workspace that already has a conversation or a contact with that person, so a number they gave one business is never copied into another business's records.

Publishing: we send the posts and comments you create in Rawi Social to the accounts you connected. For TikTok this means we upload the video you selected and the caption, audience and interaction settings you chose in Rawi Social.

Removing posts: when you delete a post in Rawi Social that has already been published, we also remove it from the Facebook Page or Instagram account it was posted to.

Moderating comments: when you hide, unhide or delete a comment in the Rawi Social inbox, we make the same change on the Facebook Page or Instagram account where it was posted.

Your TikTok posts: we retrieve the videos already published on your connected TikTok account — their descriptions, cover images, links and view, like, comment and share counts — so your published work appears alongside what you have scheduled.

Inbox: we retrieve Messenger, Instagram and WhatsApp conversations, message content, comments on your posts, and the names and profile pictures of the people who wrote them, so you can read and answer them in one place.

Analytics: we retrieve performance insights for your accounts and for the posts published through them, such as reach, views and engagement.

Advertising: if you connect an ad account, we read the ad accounts, Pages and Instagram accounts your Meta login gives us access to, and your campaigns and their results, such as spend, reach and clicks. We create, change, pause and delete the campaigns, ad sets, ads and creatives you build in Rawi Social, which spend money from your ad account once you turn them on.

Competitors: if you choose to follow other businesses' Instagram accounts, we use your connected Instagram account to read their public profile and recent posts through Instagram's official Business Discovery feature: name, username, profile picture, bio, website, follower count, and each post's caption, link, date and like and comment counts. Instagram offers this only for business and creator accounts, never for personal ones. We store it for your organisation alone, so you can compare your account with theirs. We also send the cover images of the best-performing recent posts of up to five accounts you track to the photo-describing model, to describe their visual style, such as the setting, light and framing. We keep only that text description, never a copy of the photo or video, and we delete it after 90 days. It is never used to show their product or brand. Apart from that, we do not download their photos or videos unless you choose Create a post, choose to use them and confirm you have the owner's permission, which copies that post's photos and videos into your Media library and records who in your organisation confirmed it, and when. Choosing to use a post's caption puts it into your new post and records the same confirmation.

You can also save other businesses' ads you find in Meta's Ad Library: the link, and if you choose, a screenshot and the ad's text. Rawi never opens the link. It keeps what you save privately for your organisation, and deletes it when you remove the ad or stop following that account.

If you connect a Shopify or WooCommerce store, we import your products, including names, descriptions, prices, options, stock levels, whether each is for sale, images and links, every 15 minutes, so the inbox can answer questions about them. For Shopify, we store the client ID and secret of the app you create in your store, and the access token we obtain with them. For WooCommerce, we store the consumer key and secret you create in your store, and a secret we generate to check that its notifications really come from it. We ask your store to notify us when one of your products changes or is deleted, and we use each notification only to learn which product to read again. When a customer asks about one of your products, we also read its current price and stock from your store at that moment, so the drafted reply is up to date. Disconnecting the store deletes these credentials and asks your store to stop notifying us, and your products stay in your catalogue as ordinary products you can edit or delete.

We request only the permissions these features need. We do not read your personal Facebook profile, your friends, your private messages as a consumer, or anything belonging to accounts you have not connected, other than the public business information described under Competitors. On TikTok we do not read your For You feed, the accounts you follow, or your direct messages.

How we use it

To provide the features above, to keep your account secure, and to diagnose faults.

We do not sell your data. We do not share platform data with third parties for their own purposes. We do not use your content or your customers' messages to train machine-learning models.

AI features and the providers that run them

Rawi Social uses AI models in these features: drafting replies to customer messages and comments in the inbox; transcribing voice notes and describing photos that customers send, so a draft can answer them; suggesting which product in your catalogue a customer's words refer to; writing post captions and adapting a post for each platform; writing ad copy; and the Competitors assistant features described below. The inbox features, and product suggestions for customers' words your catalogue could not match, run on their own when a customer message arrives. The rest run only when someone in your organisation uses them.

An AI draft is a suggestion. Nothing the AI writes is sent to a customer, published or submitted as an ad until someone in your organisation chooses to send, publish or submit it, with one exception: automatic replies. They are off until your organisation turns them on. When they are on, Rawi Social may reply to a customer outside your team hours without a person reading the reply first; if you have not set team hours, it may reply at any hour. Inside your team hours, drafts wait for a person. An automatic reply may answer a greeting or a thank-you; answer a question about a product in your catalogue when Rawi Social's own code, not the AI, has decided whether that product is available; ask which product or option the customer means when their words match several, using a list built by code from your catalogue; or send your holding reply, a fixed text you can edit. It may also be the AI's own draft, sent without a person reading it first. That draft is written from what the AI receives, described below, including your written business answers, and it can state something nobody gave it, such as a delivery time or a discount. When Rawi Social sends your holding reply it flags the conversation for your team, and it does the same when it sends the AI's own draft, unless the customer was only being polite. A reply based on your written business answers, such as delivery details or opening hours, is never sent automatically as a checked answer; it can go out only as the AI's own draft. Automatic replies are sent only in private messages, unless you have separately allowed them on public comments, where they only reply to greetings and thanks and answer product questions. Once someone in your organisation replies in a conversation, including from Meta's own apps or your phone, Rawi Social stops replying automatically there until someone hands the conversation back or closes it. Automatic replies are limited to 10 per conversation and to your organisation's daily limit.

What the AI receives depends on the feature. A reply draft sends the customer's message and the earlier messages in that conversation, your business description, the titles of your business answers and the text of the one chosen, and the name, price and availability of the products the customer is asking about. A voice note or photo is sent as the file itself. A product suggestion sends the customer's words and message and the names of the products in your catalogue. Captions and ad copy send what you typed and details Rawi adds from your workspace, such as your business description, your products' names and descriptions, and your brand's name, voice and rules. Image and video generation, which is not offered in the app at present, would send a prompt and, if a starting image were chosen, that image from your Media library.

Competitors' assistant features — finding competitors, What's working and the caption Create a post writes — send your business details and the public Instagram information of the accounts involved to an AI model. What's working and Create a post use the provider that writes Rawi's text, as described below. What's working can also be asked for one account you follow; it sends that account's post captions, post types, times and engagement figures, and the text of ads you saved for it, to the same provider. Create a post can also start from an ad you saved; it sends that ad's text to the same provider. Screenshots are never sent. Finding competitors always goes to OpenRouter, which also searches the public web for businesses like yours through Exa. It sends your type of business and its description, the kinds of products you sell, your time zone, your own Instagram username and bio, and the accounts already in your Competitors list.

AI agents: When a member of your workspace asks the AI assistant a question about your workspace, Rawi reads the records needed to answer it — for example scheduled posts, post performance, inbox conversation previews, the recent messages of one customer's conversation when a member asks about that customer, follow-ups, your catalogue, ad campaign results, competitor figures, broadcast results, sales and, for the Owner, finance figures — and sends those records to the AI provider together with the question. Rawi only reads records the asking member's role can already see, never changes anything to answer a question, and does not keep the records it sent; the answer is saved in the conversation.

These companies process that content for us. Which of them handles a text feature — reply drafts, product suggestions, captions, ad copy, the text of What's working and Create a post, and the AI agents' answers — depends on how the platform is set up, and can differ from one feature to another.

Anthropic: the company that makes the Claude models. It writes the text features when the platform uses it for them.

OpenRouter: a service that passes each request to a company that runs the model chosen for the task: the model's maker, or a cloud service that hosts the model for it. Which model each task uses is set in our platform settings and can change. On the date at the top of this page it is Anthropic's Claude for text and a Google model for voice notes and photos. OpenRouter can write the text features in place of Anthropic. It transcribes voice notes and describes photos. If image and video generation is switched on, it generates them with models from companies such as Google, OpenAI, ByteDance, Kuaishou and Alibaba. It also runs the web search for finding competitors.

Exa: the web-search service OpenRouter uses. It receives the searches that finding competitors makes for businesses like yours.

Higgsfield: generates images and videos when the platform is set up to use it instead of OpenRouter.

OpenAI: can write the text features directly if the platform is set up that way. It is also one of the companies OpenRouter can forward requests to.

We may change which of these providers a feature uses. The platform can also keep a fallback provider for outages: if the provider in use runs out of credit or stops answering, text requests are sent to a second provider instead — Anthropic or OpenRouter, whichever the platform has set aside for this — until the first one is answering again. The same prompts and content, including your customers' messages, may therefore be processed by either of them. Voice notes and photos have no fallback. If we start using an AI provider that is not named here, we will add it to this section.

Each provider processes this content to return a result to Rawi Social — a draft, a transcript, a description, search results, an image or a video — and handles it under its own API terms and privacy policy. We send each provider only what the feature needs, and never your password or your social accounts' access tokens.

Searching your catalogue for the product a customer means uses a model that runs on our own servers, and sends nothing to an outside provider. Only when that search finds no match is an outside model asked to suggest a product, as described above, and no suggestion changes your catalogue until you approve it.

Who can see it

Members of your organisation in Rawi Social can see that organisation's content, connected accounts and conversations, according to their role.

We use service providers to run the product — hosting, storage, email delivery and payment processing. They process data on our instructions and may not use it for their own purposes. The AI providers that process content for Rawi Social's AI features are named, with how they handle it, under "AI features and the providers that run them".

Payments are handled by Stripe. We send Stripe your organisation's name, the owner's email address and our reference for your organisation. You enter card details on Stripe's own page, and we never see or store them. We keep the record of what you were charged, which Stripe sends back to us.

We may disclose data if the law requires it.

Your public link-in-bio page

If you create a link-in-bio page and publish it, that page is public: anyone who knows its address can open it, without signing in and without being a member of your organisation. It shows the heading, description, picture and links you put on it. Unpublish it at any time from Settings, and the address stops serving it immediately.

We count how many times each link on that page is tapped. The count is a daily total per link and nothing else. We do not store anything that identifies a visitor: no IP address, no cookie, no device or browser identifier, no per-visitor row, and no record of the order one person tapped things in. A tap adds one to a number, and that number is all that is kept.

How long we keep it

We keep your account and content while your account is open.

Disconnecting a social account stops all further collection from it immediately and deletes the stored access token for that account. Disconnecting a store deletes its credentials; the products imported from it stay in your catalogue until you delete them.

When a customer asks a business question that none of your written answers covers, we keep the wording of the question so that you can write the answer, with the phone numbers and email addresses we can recognise removed, and no record of who asked it. It is deleted 90 days after a customer last asked it, or 90 days after you answer or dismiss it, and straight away if you disconnect the account it arrived through.

When data is deleted it is removed from our live systems promptly and from backups as those backups age out.

Deleting your data

You can disconnect any social account at any time from the Accounts screen, and you can ask us to delete your Rawi Social account entirely.

Disconnecting an account permanently deletes the inbox it brought with it: the conversations and messages retrieved from that account, along with any drafts, follow-ups, automatic replies and team notes belonging to them, and the business questions its customers asked that none of your answers covered. This cannot be undone, and reconnecting the account does not bring them back. Your posts, campaigns, analytics, product catalogue and saved replies are not affected. Disconnecting a WhatsApp number also deletes its broadcast contacts, its contact imports and its broadcasts, with each broadcast's per-recipient results, and cancels any broadcast still running. Opt-out records are kept, so a person who asked to stop is still respected if you reconnect the number. When you ask us to delete your Rawi Social account, we delete them too, together with the broadcast contacts, contact imports, broadcasts and per-recipient results of every number.

A sale you record from a conversation keeps the customer's name or number only while that conversation is stored. When disconnecting an account deletes the conversation, the sale forgets the customer and the link to the conversation, and keeps what was sold, for how much and on which day, because those are your own records.

Removing an account from Competitors permanently deletes the follower history, posts, style descriptions, saved ads and their screenshots, and the What's working summary we stored for it. Photos and videos you copied with Create a post stay in your Media library until you delete them there, and the record of who confirmed permission is kept.

You can also request deletion through Facebook or Instagram. When you remove Rawi Social from your Facebook settings, Meta notifies us and we delete the data associated with that account; we give you a confirmation code and a status page where you can check the request. For TikTok, revoke Rawi Social's access in the TikTok app under Settings and privacy, then Security and permissions, then Manage app permissions — and disconnect the account in Rawi Social to delete the data we hold for it. To ask us directly, email aomarab@outlook.com.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to aomarab@outlook.com and we will respond.

Security

Traffic is encrypted in transit. Access tokens and store credentials are stored encrypted, and passwords are stored only as a one-way hash. Access to production systems is limited to people who need it.

Changes

If we change this policy materially we will update the date at the top of this page and, where the change affects you, tell you in the product.

Contact

Zaina Omar for Online Selling, a Sole Establishment licensed in Dubai, United Arab Emirates under commercial licence no. 1596159.

For any privacy question or request: aomarab@outlook.com.