Safa Ads — Privacy Policy
Effective date: 22 October 2026
This notice explains how Safa Ads handles personal information when you contact us on WhatsApp, ask us to create marketing materials, use an enabled payment or advertising service, or visit a promotional page we host.
Safa Ads is currently being tested. This notice covers testing and describes planned production features. Payment, advertising and document-upload sections apply only when those features are made available and you use them. Our planned production retention periods and hosting arrangements are identified below.
1. Who is responsible for your information
Safa Ads is operated by ALEXANDER BECH INFORMATION TECHNOLOGY CONSULTANTS EST., a sole establishment in Dubai, United Arab Emirates, trade licence number 1156573. We are responsible for the personal information we process to provide Safa Ads.
Business address: Office 201, Leader Real Estate L.L.C Building, Al Souq Al Kabeer, Dubai, United Arab Emirates.
- Privacy email: ab@safa-ai.com
- Privacy enquiries by phone: +971 56 963 7927, or WhatsApp privacy support
These are human privacy-support contacts, separate from the Safa Ads bot. Please email us if chat is unavailable. This notice covers Safa Ads; another service using the Safa name may have its own notice.
2. Information we collect
Your conversation and account. We receive your WhatsApp number or account identifier, profile name supplied by WhatsApp, messages, button selections, form answers, language preference, timestamps, message-delivery information and support requests. We record your approvals, corrections and privacy choices so we can act on the right instructions.
Your business and order. This can include your business name, website, products or services, prices, offers, service area, business contact details, selected public address or opening hours, campaign preferences and your declaration about a trade licence or business permit. That declaration is not documentary verification. When you supply a public website, we may fetch its text to propose business information for you to check.
Your content. We process photos, logos, voice notes and other material you supply, together with transcripts, creative drafts, captions, revisions and approved files. We retain private source files as well as working copies. We remove embedded camera/location metadata from working product images before model processing; private original files may still contain that metadata. Information visibly included in an image remains part of the image.
Verification documents, when needed. An enabled verification flow may request a licence, permit, identity document or evidence of authority. We explain the purpose and provide a separate private upload link. Do not send identity documents, payment-card details, passwords or customer lists in ordinary chat. The current private document-upload flow sends documents for operator review, not into our conversational or creative AI prompts.
Payments and advertising, when enabled. We record order amounts, payment and refund status, transaction references, invoices, advertising-account identifiers, campaign approvals, spend and performance information. Payment details are entered into the payment provider's checkout. Safa's checkout integration does not collect your full card number or security code.
Page visits and technical records. Our promotional-page redirect records may include the time of a tap, campaign reference, source, event identifier, coarse device category and a Google advertising click identifier. Our redirect table does not store a visitor's IP address, full browser user-agent string or WhatsApp identity. Hosting, delivery and third-party services may process network information to serve a request. We also keep security, error, service-usage and support records.
3. Why we use information
We use information to respond to you; prepare and check your brief; create, revise and deliver materials; administer orders and enabled payments or campaigns; review eligibility and provider requirements; provide support; prevent misuse; resolve disputes; honour privacy choices; and maintain required business records.
AI processes relevant conversation context, business details, images and, when provided, voice notes to perform these tasks. It can make mistakes. You can correct information and request human review. Material approvals, such as confirming a brief or approving publication, require the service's explicit confirmation steps.
Optional brand memory helps us reuse preferences for your own future orders when you choose it. Withdrawing that choice stops reuse; it does not itself erase the records needed for an existing order. We may use operational measurements such as processing time, cost and error rates to maintain the service. Safa does not use your WhatsApp messages or media to train or fine-tune general-purpose AI models.
We process information to provide the service you request, obtain consent where required, and meet applicable legal obligations. Where we rely on consent, you can withdraw it. Withdrawal does not undo earlier lawful processing. If information essential to an order is withheld or withdrawn, we may be unable to complete that order and will address any outstanding payment or campaign separately.
4. When information is shared or made public
Relevant information is available to authorised Safa personnel and service providers for their work:
| Recipient | Purpose and relevant information |
|---|---|
| Meta / WhatsApp | Delivering your messages, media, controls and service replies; processing messaging identifiers and delivery events. |
| Anthropic / Claude | Conversation, brief preparation, copy and quality checks using relevant text and images. |
| Google / Gemini API | Creating or editing images and transcribing voice notes using relevant instructions and media. |
| Microsoft Azure and connection providers | Safa's application data, uploaded files and Safa-managed backups are hosted on Microsoft Azure in the United Arab Emirates (UAE North region). |
| Stripe, when payments are enabled | Hosted checkout, payment processing, refunds and associated order or billing information. |
| Google Ads and related measurement services, when enabled | Advertiser verification, approved advertising content, destination and business-contact information, targeting, budgets and campaign measurement. |
| Professional advisers or public authorities, where necessary | Relevant records for legal obligations, accounting, dispute resolution or lawful requests. |
These providers have their own contractual obligations and, for processing they control independently, their own privacy notices. Deleting information from Safa does not automatically delete their records.
For Gemini, we use a paid-tier project. Google's paid-service terms exclude using prompts and responses for product improvement and incorporate its processing addendum. This is not zero retention: Google describes 55-day abuse-monitoring retention, authorised review of flagged content and a specific exception for training policy-enforcement models. See Google's abuse-monitoring policy. Other providers have separate arrangements; we do not promise identical retention or data use across providers.
When you approve a public page or campaign, the approved creative and selected business details may be visible to the public, advertising platforms and search engines. Public material can be copied by others. Private verification documents are not promotional content. We do not sell your personal information.
5. Location and security
Safa's application database, uploaded files and Safa-managed backups are hosted on Microsoft Azure in the United Arab Emirates (UAE North region). This describes Safa's hosting location; relevant information may also be processed outside the UAE by our messaging, AI, payment, advertising and other service providers.
Relevant information sent to our external providers may be processed internationally during testing as well as production. We are reviewing the applicable provider agreements and transfer arrangements before production launch. You can contact privacy support for information about the providers involved in your request.
We use controls such as restricted operator access, verified incoming requests and limited-life private upload/download links. No system or transmission method can guarantee absolute security. Keep private links confidential and notify us if you suspect misuse.
6. How long information is kept
The table sets out our planned production retention limits. During testing, scheduled cleanup and backup expiry are not yet fully operational, so these periods are targets rather than verified automatic deadlines. Contact privacy support for a tracked deletion request and information about records held about you. We will confirm the outcome and any justified delay; an acknowledgement is not proof that deletion has finished. Earlier valid deletion requests take priority, subject to relevant legal obligations or documented holds.
| Category | Planned production retention limit |
|---|---|
| Completed order messages, transcripts, source media, creative files and non-financial order history | While the order is active, then 24 months after it closes, to support corrections, reorders and access to previous work. Later orders do not automatically restart an older order's clock. Necessary copies explicitly reused in a new order follow that new order's period. |
| Abandoned enquiries and unpaid drafts that never become a paid order | 90 days after your last interaction about that enquiry/draft, unless you resume it or there is an outstanding obligation. Background processing does not restart this period. |
| Account details and optional brand preferences | While needed for your active relationship, then 24 months after your last interaction with Safa. Reusable preferences are removed earlier if you withdraw that choice. A minimal link to retained financial records may remain separately. |
| Identity, licence, permit and other verification-document copies | While the verification or appeal is open, then 30 days after it closes. For abandoned verification, 90 days after your last interaction. We keep a minimal verification outcome/reference with the relevant order rather than retaining document images unnecessarily. A specific legal/provider requirement can justify a documented exception. |
| Public pages and their public asset copies | Until 30 days after the offer ends, unless withdrawn earlier. Public withdrawal restricts access promptly; eligible public copies are deleted within 30 days. Private creative files follow their separate order period. |
| Google advertising click identifiers | Removed after successful conversion processing, or 90 days after collection, whichever is earlier, including failed or never-uploaded events. Non-identifying campaign totals may be retained for reporting. |
| Routine technical, diagnostic and security logs | 90 days after creation. Only relevant evidence is retained longer for an actual incident, dispute or legal obligation. This period does not override the separate rules for financial records or order content. |
| Minimal approval, consent and privacy-request evidence | 24 months after the relevant order or request closes. Evidence required to substantiate a financial transaction follows the financial-record period instead. |
| Invoices, payments, refunds and necessary accounting/tax evidence | Seven years after the end of the relevant tax period, with longer retention where an applicable law, tax audit, dispute or specific legal hold requires it. This does not justify retaining all conversation content or verification images for seven years. |
| Safa-controlled backups and recovery copies | A rolling maximum of 35 days from backup creation, including local recovery backups; soft-deleted objects within Safa-controlled storage expire within seven days of active deletion. Deleted data may remain in older backups for up to 35 days after active-system deletion. A separately documented legal hold can extend relevant preservation. |
| Copies controlled independently by providers | Follow the provider's applicable terms and legal duties. Safa's periods do not override those independent obligations; we request processor deletion where applicable. |
An active order, unsettled payment/refund, unconfirmed campaign stop, unresolved external operation or legal preservation duty can delay relevant deletion. We record the reason and scope, review open holds at least every 90 days, and resume eligible deletion after the reason ends. These reasons do not authorise indefinite retention of unrelated information. Privacy restrictions are reapplied before restored backups return to service. We review the overall retention schedule at least annually.
When you ask us to delete your data, we keep a small anonymous summary of each finished campaign: its business category, emirate, plan, image style, the month it ran and its results (spend, views, clicks and taps). It contains nothing that identifies you or your business, and we use it only to improve how we plan campaigns.
7. Your choices and requests
You can ask us to explain our use of your information, provide access or a copy, correct inaccuracies, restrict processing, delete information or withdraw consent where applicable. Some requests are subject to legal exceptions and proportionate identity checks. You may also raise a concern with the competent data-protection authority where applicable.
In your Safa Ads conversation, send privacy or الخصوصية, then use the current controls:
- Forget preferences: withdraw reusable brand-memory preferences. Order and financial history are separate.
- Hide my pages: remove public access to Safa-hosted promotional content, request campaign pauses and stage deletion of private verification documents/public copies. Paid creative files remain available under their existing access terms.
- Request deletion: request broader account/content deletion. This withdraws public use, cancels eligible unpaid work and revokes paid-download access. Save any files you want to keep first. Outstanding obligations and retained records are reviewed separately.
For notification opt-out, send UNSUBSCRIBE. You can still contact us and receive a reply to your request. STOP during a live campaign is treated as a campaign-pause request; it is not a full data-deletion request.
For access, corrections, questions or a request when chat is unavailable, contact ab@safa-ai.com or +971 56 963 7927. Our service targets are to acknowledge a request within five business days and resolve it within 30 calendar days of receipt, including eligible active-system deletion. We request any necessary identity checks promptly. If verification, complexity or a lawful exception prevents completion, we explain the reason and next steps within that 30-day period. Any shorter applicable legal deadline takes priority. See our Data-deletion instructions for details.
8. Visitors contacting a business
A promotional-page contact button takes you to WhatsApp to contact the advertised business. That business handles the conversation you start with it under its own responsibilities and privacy practices. Safa's redirect does not read that buyer–business conversation.
Where enabled, optional Google measurement may receive advertising click and conversion-event information and use browser storage. Before enabling it, we will provide a page-level explanation identifying Google, an opt-in choice with an equally accessible rejection option, and a way to change that choice. Contacting the business will remain available without accepting measurement. Google measurement tags and click-ID collection/upload will require that choice; click IDs will be removed after confirmed processing or within 90 days of collection, whichever is earlier.
These optional measurement controls are planned for production and are not yet available for testing. This notice does not claim that every connected third-party page is cookie-free.
9. Children and changes to this notice
Safa Ads is intended for adult business owners and authorised representatives, not children. Please do not upload children's personal information or unnecessary information about other people. If you believe a child has supplied personal information, contact us so we can review it.
We will date updates to this notice and explain material changes through an appropriate service notice. If a new use requires consent, an updated notice alone will not replace that consent.