Data processing agreement
Ravinaro WhatsApp Agent · version 2026-11-08
This agreement is part of the terms for the Ravinaro WhatsApp Agent between you, the business using it ("you", the controller), and Ravinaro L.L.C-FZ, Meydan Free Zone, Dubai, UAE ("Ravinaro", the processor). It applies whenever Ravinaro processes personal data for you through the WhatsApp Agent, and it takes effect when you start using the service. Questions go to privacy@ravinaro.com.
1. What is processed, and why
People concerned.
- Your customers and prospects who message your WhatsApp number.
- Your team members who use the dashboard.
Data.
- WhatsApp numbers, names and profile names; message content, times and delivery status.
- Notes the agent keeps about each customer (for example language or what they asked about), bookings and marketing consent or opt-out.
- Team members' names, email addresses and roles.
Purpose. Only to provide the WhatsApp Agent to you: receive and send messages, prepare AI replies, hand chats to your team, run the bookings and broadcasts you set up, show statistics, and keep the service secure. Ravinaro does not sell this data and does not use your customers' messages to train AI models.
Duration. For as long as you use the service, then until deletion as set out in section 7.
Special categories. The service is not designed for health, financial card or other sensitive data. Ask your customers not to send it; the agent is told not to store it.
2. Your instructions
Ravinaro processes the data only on your documented instructions: these terms, your settings in the dashboard, and anything you ask in writing. If an instruction seems to break data protection law, Ravinaro tells you. You are responsible for having a lawful basis for the processing and for telling your customers about it in your own privacy notice, including that replies may be written by AI.
3. Confidentiality and security
- Everyone at Ravinaro with access to the data is bound to confidentiality, and access is limited to what their work needs.
- Data is encrypted in transit; WhatsApp access tokens and secrets are encrypted at rest.
- Each workspace's data is kept separate, and every request is checked against the signed-in user's workspace.
- Support access to your workspace happens only when you switch it on in the dashboard, for a limited time, and is logged.
4. Sub-processors
You authorise Ravinaro to use the sub-processors listed below. Ravinaro puts data protection terms in place with each of them that are at least as protective as this agreement, and stays responsible for them. Ravinaro gives at least 30 days' notice by email before adding or replacing one; you may object on reasonable data protection grounds, and if no solution is found you may end the service without penalty.
Sub-processors are listed below by category, with where and when each is used. Ravinaro gives you the current list of named sub-processors on request, under a confidentiality agreement, for your records and this agreement: email privacy@ravinaro.com.
| Sub-processor | What for | Where | When |
|---|---|---|---|
| Cloud hosting and database provider | Hosting, database, file storage, search index, document reading and email forwarding | Global network (USA headquarters) | Always |
| Messaging platform (WhatsApp Business Platform by Meta) | Sending and receiving WhatsApp messages on your number | Ireland / USA | Always |
| AI model providers | AI replies and checks (only text needed for the reply) | USA, Singapore or China, depending on the model | When one of their models is used |
| Payment processor | Subscription billing and card payments (no chat data) | USA / Ireland | When you pay |
| Email delivery provider | Account and alert emails to you and your team (no chat data) | USA | Always |
| Browser push services (run by your browser maker) | Delivering alerts to your browser | USA | Only if you turn on browser alerts |
We list sub-processors by category. The current list of named sub-processors is given to customers on request, under NDA, for their records and DPA: email privacy@ravinaro.com. We tell you by email at least 30 days before we add or replace a sub-processor, and you may object.
Tools you connect yourself (Google Calendar, Microsoft Outlook Calendar, Square, Formitable, Your own booking system, n8n or webhooks) act under your own agreement with them and are not Ravinaro’s sub-processors.
5. Transfers outside your country
Some sub-processors are outside the EU, the UK and the UAE. Where the law requires it, transfers rely on an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK addendum), with extra safeguards where needed.
Khalil: confirm the transfer mechanism in place with each AI provider (especially those in China) before relying on this section for EU customers.
6. Helping you meet your duties
- Customer requests: the dashboard lets you find a customer, download everything held about them and erase it (Settings › Privacy and data). Ravinaro helps further on request.
- Opt-outs: customers who send STOP get no marketing messages, and you cannot override it.
- Breaches: Ravinaro tells you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what is known and what is being done.
- Ravinaro gives you the information you reasonably need for a data protection impact assessment or a regulator's question.
7. Retention and deletion
- Message text is kept for the period you choose (3, 6, 12 or 24 months; 12 by default), then cleared every night. Delivery logs are kept 30 days.
- You can download all your data at any time (Settings › Privacy and data).
- When you delete your workspace, the AI stops at once and all data is deleted 30 days later unless you cancel; a request by email or through Meta is completed within 30 days. Backups held by our hosting provider expire on their own schedule.
- Only the billing records the law requires are kept after deletion.
8. Information and audits
Ravinaro makes available the information needed to show it meets this agreement, and answers reasonable written questions. An on-site audit can be agreed once a year at your cost, with 30 days' notice and under confidentiality.
9. Order of documents
If this agreement and the terms conflict on data protection, this agreement wins. Where the GDPR or UK GDPR applies to you, this agreement is read to meet its Article 28.
Khalil: review this DPA (entity, breach window, audit terms) before linking it in sales material.