رافد AI (Rafid AI) is a cloud-based AI customer-service and conversation management platform operated by IraqSoft.

Website: https://rafid.md-soft.app

This policy applies to platform customers (businesses using Rafid AI), their staff, and end users who message those businesses via WhatsApp, Instagram, Messenger, or other connected channels.

End users do not create Rafid AI accounts. Their data is processed on behalf of the business customer using the platform.

We collect the following data to provide the service:

• Customer accounts: name, email, login credentials, and agent settings.
• Meta connection data: WhatsApp Business Account (WABA) and phone IDs, Facebook Page IDs and names, Instagram user IDs and usernames, encrypted tokens, and granted permissions.
• End-user data: messages (text, images, audio, video, documents, location) and limited profiles (e.g. WhatsApp display name, Messenger name, Instagram name/username).
• CRM data: contacts, notes, ratings, and conversation history.

When connecting Meta channels, the business customer grants the following permissions:

• WhatsApp: whatsapp_business_management, whatsapp_business_messaging, business_management
• Messenger: pages_show_list, pages_messaging, pages_manage_metadata, pages_read_engagement, business_management
• Instagram: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments

We use data solely to provide the service, including:

• Sending and receiving messages through connected Meta channels.
• Generating AI replies and enabling human agents to manage conversations.
• Managing contacts, conversation history, and ratings.
• Spam protection, error handling, and notifications.

We do not sell your personal data and we do not use it for targeted advertising.

We may share data with the following parties only as needed to provide the service:

• Meta (Facebook / Instagram / WhatsApp): to send and receive messages via the Graph API.
• OpenAI: when the customer configures their own OpenAI API key for AI reply generation.
• Email services, webhooks, or custom tools: when configured by the customer.

We retain conversation and contact data while the customer account remains active. When Meta is disconnected, encrypted tokens are cleared and webhooks are unsubscribed. Secrets (such as Meta and OpenAI tokens) are encrypted at rest using AES-256-GCM.

We use HTTPS for all communications, verify Meta webhook signatures, and store secrets encrypted. While no system is perfectly secure, we apply reasonable measures to protect data.

Business customers can disconnect Meta integrations (WhatsApp, Instagram, Messenger) and request data deletion in two ways:

• Customer profile (customer portal): via the Disconnect option in the customer's profile settings.
• Admin: via the Disconnect button in agent settings (admin customer form).

Disconnecting revokes tokens, unsubscribes webhooks, and stops new data collection from Meta.

If you are an end user and wish to have your conversation data deleted, please contact the business you messaged directly, or email us at info@iraq-soft.com and we will coordinate with the relevant customer.

The service is not directed at children under 13, and we do not knowingly collect data from them.

We may update this policy from time to time. Changes will be posted on this page with an updated date.

For privacy inquiries, contact us at info@iraq-soft.com.