Privacy Policy
This policy explains what data Alonah collects, how it's used, and the choices you have — whether you're a business using Alonah, one of that business's customers messaging on WhatsApp, or a visitor to this website.
01. Who we are
Alonah is a product of Ciphers Lab, with offices in Miami, USA and Karachi, Pakistan. For most of the data described below, the business using Alonah (the "tenant") is the data controller for its own customers' data, and Ciphers Lab acts as a data processor on that business's behalf. For account and platform-level data (e.g. a business owner's own login), Ciphers Lab is the controller.
02. Information we collect
Business account data (name, email, phone, business details, billing info); customer conversation data (WhatsApp messages, voice notes and their transcriptions, phone call recordings and transcripts where voice is enabled, name and phone number); booking data (services, appointments, deposits, invoices); and website usage data (pages visited, general analytics) for visitors to this site.
03. How we use it
To operate the AI receptionist (answering messages, checking availability, booking appointments, collecting deposits), to give the business owner visibility into their own operations (dashboards, reports), to bill for the platform subscription, to send service communications (booking confirmations, reminders, account notices), and — only with a customer's prior opt-in where required — for marketing broadcasts a business sends to its own customer list.
04. Automated decision-making
Alonah's AI answers messages and can book, reschedule, or cancel an appointment automatically based on real-time availability. It's designed to hand off to a human staff member for anything sensitive, a complaint, or an explicit request to speak to a person — and staff can take over or reverse any AI action at any time from the business's dashboard.
05. Who we share data with
Sub-processors that help run the service: Twilio and/or Meta (WhatsApp Business API and voice), Stripe (payments — Alonah never stores full card numbers), OpenRouter (routes AI model calls for chat/vision/transcription/voice), Resend (transactional email), and MongoDB Atlas (database hosting). We do not sell personal data.
06. Data residency and security
Tenant data is hosted with GCC data residency (AWS Bahrain), aligned with UAE TDRA and Saudi NDMO expectations. BSP/API credentials are encrypted at rest and never re-displayed once saved. Access to the admin panel is role-based, with a full audit log of admin actions on sensitive data.
07. Data retention
The platform includes a configurable data-retention control for conversation data, disabled by default until a business (or Ciphers Lab, for platform-level data) sets an active retention period. [PLACEHOLDER] — a default retention period and schedule for each data category is a decision Ciphers Lab's legal/compliance team still needs to finalize and publish here.
08. Your rights
Depending on your location, you may have rights to access, correct, delete, or export your data, and to withdraw marketing consent at any time (reply STOP to any WhatsApp broadcast, or contact the business directly). Requests about a specific business's handling of your data should go to that business first; requests about Ciphers Lab's own platform-level data can be sent to info@cipherslab.com.
09. Contact
For privacy questions, reach us at info@cipherslab.com. [PLACEHOLDER] — a dedicated privacy@ contact address and (if applicable) a named data protection officer should be added here.