Privacy Policy
This policy explains what data Alonah collects, how it's used, and the choices you have, whether you're a business using Alonah, one of that business's customers messaging on WhatsApp, or a visitor to this website.
01. Who we are
Alonah is a product of Ciphers Lab LLC, a limited liability company with its registered office at 3901 NW 79th Ave, Ste 245 #3613, Miami, FL 33166, USA, and an operating office in Karachi, Pakistan. "Alonah", "we", "us" and "our" in this policy refer to Ciphers Lab LLC. For most of the data described below, the business using Alonah (the "tenant") is the data controller for its own customers' data, and Ciphers Lab LLC acts as a data processor on that business's behalf. For account and platform-level data (e.g. a business owner's own login), Ciphers Lab LLC is the controller.
02. Information we collect
Business account data (name, email, phone, business details, billing info); customer conversation data (WhatsApp messages, voice notes and their transcriptions, phone call recordings and transcripts where voice is enabled, name and phone number); booking data (services, appointments, deposits, invoices); and website usage data (pages visited, general analytics) for visitors to this site.
03. Data we receive from Meta / WhatsApp
When a business connects its WhatsApp number to Alonah through Meta's Embedded Signup ("Continue with Facebook"), the business owner explicitly grants Alonah's Meta app access to their WhatsApp Business Account. Through that connection we receive and store: the WhatsApp Business Account (WABA) ID, the phone number ID and phone number, the business display name and profile, message templates and their approval status, and the content and metadata (timestamps, delivery and read status) of WhatsApp messages sent to and from that number. We use this data only to provide the Alonah service to that business, sending and receiving its WhatsApp messages, running its AI receptionist, and showing conversations in its dashboard. We request only the whatsapp_business_management and whatsapp_business_messaging permissions. We do not use Meta or WhatsApp data for advertising, we do not sell it, and we do not share it with anyone other than the sub-processors listed below that are needed to run the service. We do not access the business owner's personal Facebook profile, friends, or posts.
04. How we use it
To operate the AI receptionist (answering messages, checking availability, booking appointments, collecting deposits), to give the business owner visibility into their own operations (dashboards, reports), to bill for the platform subscription, to send service communications (booking confirmations, reminders, account notices), and (only with a customer's prior opt-in where required) for marketing broadcasts a business sends to its own customer list.
05. Automated decision-making
Alonah's AI answers messages and can book, reschedule, or cancel an appointment automatically based on real-time availability. It's designed to hand off to a human staff member for anything sensitive, a complaint, or an explicit request to speak to a person, and staff can take over or reverse any AI action at any time from the business's dashboard.
06. Who we share data with
Sub-processors that help run the service: Meta Platforms (WhatsApp Business Platform / Cloud API), Twilio (our WhatsApp Business Solution Provider, messaging and voice), Stripe and Tap Payments (payments. Alonah never stores full card numbers), OpenRouter (routes AI model calls for chat/vision/transcription/voice), Resend (transactional email), and MongoDB Atlas (database hosting). Each processes data only to provide its part of the service. We do not sell personal data, and we disclose data to public authorities only when legally required to do so.
07. Data residency and security
Tenant data is hosted with GCC data residency (AWS Bahrain), aligned with UAE TDRA and Saudi NDMO expectations. BSP/API credentials are encrypted at rest and never re-displayed once saved. Access to the admin panel is role-based, with a full audit log of admin actions on sensitive data.
08. Data retention
Account, business-configuration, and WhatsApp connection data (including WABA and phone number IDs) are kept for as long as the business's account is active. Conversation and booking data are kept while the account is active, or for a shorter period if the business sets one using the platform's data-retention control. When a business closes its account or disconnects WhatsApp and requests deletion, we delete the related data from our active systems within 30 days, and it is purged from backups within a further 60 days. Billing and invoice records are kept for as long as tax and accounting law requires (typically up to 7 years).
09. Your rights
Depending on your location, you may have rights to access, correct, delete, or export your data, and to withdraw marketing consent at any time (reply STOP to any WhatsApp broadcast, or contact the business directly). Requests about a specific business's handling of your data should go to that business first; requests about Ciphers Lab LLC's own platform-level data can be sent to info@cipherslab.com.
10. Deleting your data
You can ask us to delete your data at any time, including all data we received through Meta / WhatsApp. Step-by-step instructions are on our Data Deletion page: https://alonah.com/data-deletion
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed, and material changes will be communicated to active businesses before taking effect.
12. Contact
For privacy questions or requests, contact Ciphers Lab LLC at info@cipherslab.com, or by post at Ciphers Lab LLC, 3901 NW 79th Ave, Ste 245 #3613, Miami, FL 33166, USA.