EngageOps AI is a business-to-business customer engagement platform operated from Jordan. This policy explains which personal data the platform processes, in which role, for how long, and how to exercise your rights. It is written for three audiences: the businesses that use a workspace, the people who contact those businesses, and visitors of this website.
Who operates the service
The service "EngageOps AI" (the website engageopsai.com and the application at app.engageopsai.com) is operated by شركة افاق الاتمتة لحلول البرمجية / ذات مسؤولية محدودة, a limited liability company registered in Jordan under registration number 80575 (national establishment number 200211022), with its registered business location at Al Thuraya Complex, 3rd Floor, Abu Nseir, Amman, Jordan ("we", "us", the "Operator").
No data protection officer has been designated at this time. Questions about this policy go to the contact channel in the last section.
The Operator's name is registered in Arabic; the English pages reproduce it verbatim rather than translate it.
Our role: service provider or controller
A business customer is an organisation that holds a workspace on the platform. For the personal data its staff puts into the workspace or receives through its connected channels (its contacts, conversations, tickets, orders, notes and attachments), the business customer decides the purposes and means of processing. We process that data only to provide the service, on the business customer's instructions and under the agreement with it. In data protection terms the business customer is the controller and we act as its processor or service provider.
For the account data of workspace users (the staff the business customer invites) and for visitors of this website, we determine how the data is processed and act as the controller.
If you are a customer of a business that uses EngageOps AI, that business is your first point of contact for questions about your data. We help the business respond.
Data we process
| Category | Examples | Source |
|---|---|---|
| Workspace user accounts | Name, work e-mail address, a salted password hash (argon2id; the password itself is never stored), multi-factor authentication enrolment (encrypted), role and team membership, language preference | Entered by the user or the inviting administrator |
| Security and session records | Session identifiers (hashed), sign-in attempts, IP address, browser identification, time stamps, audit events of actions taken in the workspace | Generated when the application is used |
| Contacts of a business customer | Phone number (international format), display name, e-mail, tags, groups, custom attributes, consent and preference flags, internal notes written by staff | Entered by the business customer or created from an inbound message |
| Conversations and messages | WhatsApp message text, time stamps, direction, delivery status, the sender's phone number and WhatsApp profile name, assignment and internal notes | Received from or sent through the WhatsApp Business Platform; written by staff |
| Tickets, orders and vertical modules | Ticket subjects, descriptions and comments; order items, amounts and delivery address; education records where that module is used | Entered by the business customer's staff |
| Attachments | Files uploaded by staff (type-checked from their content, metadata such as EXIF removed, and held back from download until a scan step passes; a malware-scanning engine is not yet connected) | Uploaded by staff |
| Contact-center records | Agent extensions, queue membership, presence and call metadata produced by the built-in simulator. No telephony carrier is connected and call recording is disabled | Generated when the module is used |
| Website visitors | This website sets no cookies of its own and uses no analytics; Cloudflare may set technical cookies for security purposes. The edge server keeps a request log (IP address, browser identification, requested path, status) with query strings removed | Generated by the request |
Message content that is not text (images, documents, voice notes) is currently recorded as a message of an unsupported type without its content; the platform does not download media from WhatsApp.
WhatsApp and Meta
EngageOps AI connects a business customer's WhatsApp Business Account to the platform through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. and its affiliates ("Meta"). When a business customer connects a number, we receive webhook notifications from Meta about inbound messages and delivery status, and we send outbound messages and message templates through Meta's Graph API on the business customer's behalf.
Every inbound notification is checked against Meta's signature before it is accepted; unsigned or wrongly signed notifications are rejected and never stored. Access tokens for a connected account are stored encrypted and are used only for that business customer's account.
Meta processes WhatsApp messages under its own terms and privacy policy, which apply to the business customer's use of WhatsApp Business and to the WhatsApp users who message that business. We do not control Meta's processing. Business customers must have the right to use the WhatsApp Business Account they connect and must comply with the WhatsApp Business Terms, the WhatsApp Business Messaging Policy and the Meta Commerce Policy.
We do not sell personal data, we do not use message content for advertising, and we do not use business customers' data to train artificial intelligence models.
Purposes and legal grounds
- Providing the service to business customers under the agreement with them: receiving, storing and displaying conversations, routing them to staff, keeping tickets, contacts and records, running the automations and reports the business customer configures.
- Operating user accounts: authentication, multi-factor authentication, session management, invitations, password resets.
- Security and integrity: detecting abuse, rate limiting, keeping tamper-evident audit records, investigating incidents.
- Legal obligations: retaining records we are required to keep and responding to lawful requests.
- Communicating with businesses that ask for a demo or contact us.
Where a legal basis is required, we rely on the performance of the agreement with the business customer, our legitimate interests in operating a secure service, compliance with legal obligations, and consent where a business customer or user gives it. Business customers are responsible for the legal basis of the messages they send to their own customers, including opt-in where it is required.
This policy is written with regard to the personal data protection legislation of the Hashemite Kingdom of Jordan, including the Personal Data Protection Law No. 24 of 2023, and to other laws that mandatorily apply to us or to a business customer. We do not claim compliance with every data protection regime worldwide: a business customer that is subject to other laws (for example in the European Union) must assess for itself whether the Service meets its obligations, and we provide the information needed for that assessment.
Infrastructure and hosting
The platform runs on virtual servers of DigitalOcean, LLC. The current environment is hosted in DigitalOcean's Singapore (SGP1) region. All traffic to the website and the application passes through Cloudflare, Inc., which provides DNS, TLS termination at its edge, caching of public pages and protection against denial-of-service attacks; the servers accept public web connections from Cloudflare only.
Credentials, provider tokens and multi-factor seeds are encrypted by the application with keys that are never stored in the database. Backups of the database and of uploaded attachment files are taken nightly and encrypted on the server immediately after they are taken, with a public key; the unencrypted copy is removed, and decryption needs a private key that is kept off the server.
We do not promise hosting in a particular country or data residency for a particular market. If the hosting region changes, this policy is updated before the change takes effect.
Third parties that process data
| Provider | Purpose | Data |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivering and receiving WhatsApp messages of connected business accounts | Phone numbers, message content, delivery status, profile names |
| Cloudflare | DNS, TLS, proxying and protection of the website and application | IP addresses, request metadata, encrypted traffic in transit |
| DigitalOcean | Hosting of servers, volumes and backups | All platform data, encrypted at rest |
| Google LLC (Google Workspace) | Hosting the Operator's business mailbox that receives messages sent to the contact address on this website | Sender address, content and attachments of the e-mails you send us |
Apart from Meta's messaging platform listed above, no analytics, advertising, payment, telephony, e-mail marketing or external artificial-intelligence provider processes personal data for the service today. Transactional e-mail from the application (invitations, password resets, security notices) is generated by the application and currently captured in an internal mailbox on our own server; no external e-mail provider is connected, and delivery to recipients outside the server is not yet enabled. If a provider is added, this policy is updated before the provider receives personal data.
Retention and deletion
Retention is implemented inside the platform, per workspace and per data class. Each business customer sets its own retention period for the following classes within the minimum and maximum the platform allows, and an automated job enforces the period; the business customer can preview what a run would remove before changing a policy:
- messaging events (delivery and webhook records);
- closed conversations and closed tickets, which are anonymised rather than deleted so that business records stay consistent;
- attachments;
- contact-center call history (anonymised or deleted);
- automation runs and AI executions;
- data-export files.
The following periods are fixed by the platform:
- the workspace audit log is kept for seven years and is never shortened by a workspace policy;
- signed-in sessions end after 12 hours without activity and after 7 days at the latest, and the records of ended sessions are kept for 30 days as security evidence;
- links to data-export files expire after 24 hours and the files themselves after the workspace's export retention period;
- website and application request logs at the edge are kept in log files for at most 14 days; the server's console copy of the same redacted log is rotated by size rather than by time;
- encrypted backups are taken nightly and rotated on a configured schedule that keeps the newest backup of each of the last 7 days, of each of the last 5 weeks and of each of the last 12 months and deletes the others; under this schedule a copy of a deleted record can remain in a backup for up to about twelve months. The rotation runs automatically after each backup. The Operator may also hold an encrypted copy of a backup off the server to verify that it can be restored; such a copy is not covered by the automatic rotation.
When a workspace is closed, its users lose access; the data remains stored until it is deleted on a verified request, which the Operator assesses individually as described on the data deletion page.
We do not publish default retention periods beyond those stated here: every other period is chosen by the business customer within the platform's limits. We do not state a fixed period between the closure of a workspace and the deletion of its data; deletion follows the process on the data deletion page. This page is updated when the enforced behaviour changes.
Your rights and requests
Depending on the law that applies to you, you may have the right to access the personal data held about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent you gave.
If you messaged a business that uses EngageOps AI, address your request to that business. The platform gives the business the tools to answer: a per-contact data export, and an erasure request that requires approval by a second member of the business's staff and then removes or anonymises the contact's personal data in one irreversible operation. We assist the business where needed and forward requests we receive directly to the business concerned. If the business cannot be reached, no longer holds a workspace, or the request concerns data that no function in the application can act on, you may write to us at the contact channel below: we assess the request individually and respond to the extent the law requires of us, stating what we can do and what we cannot.
If you hold a user account in a workspace, you can review and change your profile, sessions and multi-factor settings in the application, and address other requests to the contact channel below.
You may also lodge a complaint with the data protection authority competent for you.
Security
We apply technical and organisational measures appropriate to a multi-tenant business platform, including: encryption in transit (TLS); application-level encryption of credentials, tokens and backups; mandatory multi-factor authentication for privileged roles; role-based access control with default deny; row-level isolation of every workspace's data in the database, enforced by the database itself; hashed and encrypted credentials and tokens; rate limiting; security headers; tamper-evident audit records with hash-chained checkpoints; signed webhook verification; and encrypted backups with a scripted restore procedure. The platform's code has undergone two internal adversarial reviews of its production-hardening phase; no external penetration test has been commissioned yet.
No system can be guaranteed to be completely secure. Business customers remain responsible for the devices and credentials of their staff and for the permissions they grant. If we become aware of a personal data breach that affects a business customer's data, we inform that business without undue delay, with the information available to us at the time (what happened, which data and people are likely affected, what we have done and what we recommend), so that it can meet its own obligations; we notify the competent authority ourselves where the law requires that of us.
International processing
The current environment is hosted in Singapore; Cloudflare operates a global network, and Meta processes WhatsApp data in the countries in which it operates. Personal data of people in Jordan and in other countries is therefore processed outside their country of residence. Where the applicable law, including Jordanian law, requires conditions or safeguards for the transfer of personal data abroad, the business customer and we rely on the contractual terms of the providers listed above and on the agreement between the business customer and us, and the business customer remains responsible for assessing whether these suffice for its own data.
We do not offer in-country hosting or a specific transfer mechanism for a particular market at present. Business customers that need one must assess this before using the Service.
Children
The service is offered to businesses and their staff. It is not directed to children, and we do not knowingly collect personal data from children on this website. Business customers are responsible for the audiences they message.
Changes to this policy
We may update this policy when the service, the providers or the law change. The version number and effective date at the top of this page identify the current text. Material changes are announced to business customers' workspace owners before they take effect, by e-mail to the registered address of each workspace owner, and earlier versions are available on request from the contact channel below.
Contact
Operator: شركة افاق الاتمتة لحلول البرمجية / ذات مسؤولية محدودة, Al Thuraya Complex, 3rd Floor, Abu Nseir, Amman, Jordan. Registration number 80575, national establishment number 200211022. Corporate website: afaaq-tech.uk.
Privacy and data requests: [email protected]. Where a request concerns a workspace, please write from the e-mail address registered in that workspace so that we can verify it.