Mahlolaالعربية

Privacy Policy

Last updated: 16 September 2026

This policy explains how Mahlola collects, uses and protects data when you use our website and services: building websites for businesses and running a smart WhatsApp assistant on their behalf.

Service provider: أحمد عدنان محمدحسين الصحاف — Licence / registration no.: FL-832599910.

Data we collect

  • Trial request details: your business name, your name, mobile number, business type, city, Instagram account if you add one, and when you agreed to be contacted.
  • Business details: what you enter in the setup form, such as services, prices, opening hours, address, logo and photos. These are shown publicly on your business website.
  • Your customers' conversations: when your customers message the assistant's number, we process their messages, names, numbers and booking requests to run the service on your behalf.
  • Limited technical data needed to run and protect the website, such as error logs.
  • Public business information: for businesses we may offer our service to, we collect their business name, district, public Instagram account and links to their public posts from public sources on the internet, and may prepare a private sample website that shows those posts through Instagram's official embed (the photos aren't copied). We don't collect personal phone numbers this way. The sample is deleted automatically if it isn't activated within 14 days, and the business can ask us to delete its information at any time.

How we use it

  • Setting up your website, running the assistant, replying to your customers and booking appointments.
  • Contacting you about your trial and subscription, based on your consent.
  • Sending the business owner assistant performance summaries and alerts about interested customers.
  • Improving the service and protecting it from abuse.

We don't sell your data, and we don't use your customers' conversations for advertising.

Service providers and where data is stored

We rely on trusted providers to run the service, and data may be processed or stored outside the Kingdom of Saudi Arabia:

  • Supabase — database and photo storage (servers in Frankfurt, Germany).
  • Vercel — website hosting.
  • Anthropic (Claude) — AI processing to write the assistant's replies and to translate your website details between Arabic and English.
  • Meta (WhatsApp Business) and our WhatsApp connection provider — to send and receive WhatsApp messages.
  • Resend — internal email alerts to our team when a new request arrives.

Data is encrypted in transit, and these providers only access what they need to deliver the service.

Retention

We keep data for as long as you use the service. If you don't continue after the trial or you cancel, you can ask us to delete your business data and conversations, and we will do so within a reasonable time unless a regulation requires us to keep it.

Your rights and deleting your data

Under the Saudi Personal Data Protection Law, you have the right to:

  • Know what data we hold about you and receive a copy of it.
  • Correct or update your data (you can edit your business details directly from your setup link).
  • Ask us to delete your data.
  • Withdraw your consent to be contacted at any time.

To request deletion: contact us using the details below from your registered mobile number or email and mention your business name. We verify the request, delete your business data, conversations and photos within 30 days, and let you know once it's done.

Security

Data is encrypted in transit, access is limited to our servers and a password-protected dashboard, and permissions block public access to the database.

Contact us

For any question or request about your data:

Changes

We may update this policy from time to time and will publish the updated version on this page with its date. If the Arabic and English versions differ, the Arabic version prevails.