Privacy Policy

§1 Who We Are

AnbarTech, trading as Anbar, operates the Anbar platform at anbar.tech. We act as a data controller for account and billing data, and as a data processor for customer conversation data submitted by our business subscribers.

§2 Data We Collect

• Account data: name, email, company name, billing details
• Usage data: login timestamps, features used, page views, API calls
• Conversation data: messages and files you process through connected channels (WhatsApp, email, etc.) — you control and own this data
• Technical data: IP address, browser type, device info, error logs
• Communications: support emails and feedback you send us

§3 Legal Basis for Processing

• Contract performance: processing necessary to deliver the Service
• Legitimate interests: fraud prevention, security, product improvement
• Legal obligation: compliance with applicable laws
• Consent: marketing communications (opt-in, can withdraw at any time)

§4 How We Use Your Data

• Provide, maintain, and improve the Service
• Send transactional emails (OTP, receipts, alerts)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Analyze aggregated, anonymized usage patterns to improve features

We do not sell your personal data. We do not use your data for behavioral advertising.

§5 Data Sharing

We share data only with trusted service providers under binding data-processing agreements:

• Cloud infrastructure: hosting and storage providers
• Payment processors: Paddle (global), Tap Payments (Gulf) — receive only necessary billing data
• Error monitoring: Sentry (anonymized stack traces)
• AI processing: Groq (conversation AI) — under DPA

We do not share data with third parties for their own marketing purposes.

§6 Data Retention

• Account data: subscription duration + 90 days after cancellation
• Conversation data: subscription duration + 30 days, unless earlier deletion is requested
• Billing records: 7 years (financial regulations)
• Security logs: 12 months

§7 Data Security

AES-256 encryption at rest and TLS 1.2+ in transit. Access restricted to authorized personnel with multi-factor authentication. Regular security reviews and vulnerability assessments.

§8 Data Breach Notification

In the event of a personal data breach, Anbar will notify affected subscribers and the relevant supervisory authority within 72 hours, in accordance with PDPL, PDPPL, KVKK, and GDPR requirements.

§9 Your Rights

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (subject to legal retention requirements)
• Portability — receive data in a machine-readable format
• Restriction — restrict processing in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise any right: superadmin@anbar.tech. We respond within 30 days.

§10 International Data Transfers

Where data is transferred outside your country, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and equivalent mechanisms under applicable local law.

§11 Cookies

We use essential cookies for session management and authentication. Limited technical cookies from third-party services may be used for error monitoring and platform reliability — not for advertising or behavioral tracking.

§12 Contact & Complaints

Privacy inquiries: superadmin@anbar.tech

You may lodge a complaint with your local data-protection authority: NDMO (Saudi Arabia), UAE Data Office, KVKK Authority (Turkey), or your national EU supervisory authority.