Privacy policy

Last updated: 30 October 2026

FlashReplai is an AI assistant that replies to customers on WhatsApp on behalf of local businesses. This policy explains what personal data we handle, why, who helps us handle it, and the rights you have. We wrote it with Egypt's Personal Data Protection Law (Law No. 151 of 2020) in mind.

The policy covers two different groups of people, and our role is different for each:

• Visitors to flashreplai.ai and people who request a demo. Here, FlashReplai decides how your data is used, so we are the controller. See Part 1.
• Customers who message a business that uses FlashReplai on WhatsApp. Here, the business decides how your data is used and is the controller. FlashReplai is the processor: we handle the data only on the business's instructions, to run the service for it. See Part 2.

Who we are

FlashReplai is run by Flash Replai for Technology and Information, at 36 First New Cairo, 3rd floor, apartment 9, Cairo, Egypt. You can reach us about anything in this policy at hello@flashreplai.ai.

Part 1: Website visitors and demo requests

Browsing the website

The website has no analytics, advertising or tracking cookies. It is served through our website hosting and security provider, which, like any web host, processes technical data such as your IP address, browser type and the pages you request, to deliver the site and protect it from attacks. Our provider doesn't publish a fixed retention period for this data; it says it keeps personal data for a period consistent with its business purposes.

The demo request form

When you request a demo, we ask for your name, business name, type of business, country and WhatsApp number, and optionally your email. You must tick a box agreeing to be contacted.

• Our website stores nothing. When you press send, the form is checked and immediately passed on as an email to hello@flashreplai.ai (sent through our email delivery service) and as a message to our team on a team messaging app. It is not saved in any database on the website.
• The email arrives in our inbox, which is hosted by an email provider, and the message stays in our team chat. We keep them for 12 months, then delete them.
• To block spam, the form uses a security check from our website hosting provider, which checks your browser and IP address to tell people apart from bots.

Why we use this data

Only to contact you about your demo and to send you a quote if you ask for one. The legal basis is your consent, which you give when you tick the box and can withdraw at any time by emailing us. We don't sell your data, use it for advertising, or add you to a mailing list.

Our clients' accounts

If your business becomes a client, we also keep the details of the staff who use the dashboard and the staff bot (name, email, messaging app account) and billing records, to run your account and send service emails. We keep account details while you're a client and delete them within 30 days after you leave. We keep billing records for 5 years, as Egyptian tax law requires.

Part 2: Customers of businesses that use FlashReplai

If you messaged a business on WhatsApp and an AI assistant replied, that business uses FlashReplai. The business is responsible for your data, and its own privacy policy applies too. This part explains what happens on our side.

What we process

• Your WhatsApp number and the profile name you set in WhatsApp.
• The messages you exchange with the business, including the assistant's replies and any replies from the business's staff.
• Voice notes, images and files you send are not analyzed or used by the assistant. They are stored encrypted on our secured servers, so the business's staff can open them in the conversation, and are deleted with the conversation.
• Requests recorded from the conversation, such as an order, booking, complaint or outage report, with the details you gave.

What we use it for

• To reply to you on the business's behalf, using only the information the business has given us.
• To record your requests for the business and pass the conversation to its staff when needed.
• To keep the service secure and working, and to fix problems.

We don't use your data for our own purposes, we don't sell it, we don't use it for advertising, and we don't use it to train AI models. Our AI model and AI search providers don't use this data to train their models either.

The assistant is an AI

The assistant introduces itself as an AI assistant and never pretends to be a person. You can ask for a staff member at any time, and the conversation will be passed to the business's team.

Opting out

Businesses must have your permission before messaging you first on WhatsApp. If you no longer want messages from a business, tell it in the chat or contact it directly, and it must stop. You can also block the business in WhatsApp.

How long we keep it

By default, we keep conversations and recorded requests, including any voice notes, images and files in them, for 90 days, then delete them. When a business stops using FlashReplai, we delete its customers' data within 30 days. Backups are kept on a rolling 30-day cycle, so deleted data leaves our backups within a month.

Sensitive data

FlashReplai doesn't currently serve healthcare businesses. Please don't send health, financial or other sensitive information through the assistant, such as medical details, card numbers or passwords.

Who receives data

We use other companies to run the website and the service. Each receives only what it needs for its task, under its own terms and data protection commitments. They fall into these categories:

• AI model providers read customers' messages and the business's information, to write the assistant's replies. Data is stored in the United States. Replies may be generated on the provider's servers in other countries. Our provider deletes it within 30 days, or keeps it up to 2 years if it's flagged for breaking the provider's usage policy, and doesn't use it to train its models.
• AI search providers process the business's information, such as prices, hours and policies, and each customer's question, to find the relevant answer. They process it in the United States, delete it right after processing, and don't use it to train their models.
• Cloud hosting, storage and backup providers store conversations, recorded requests and accounts on our servers in Germany, where the WhatsApp Web sessions described below also run. Backups of our database are stored in the Netherlands (Amsterdam) on a rolling 30-day cycle. Backups are encrypted.
• Email delivery services send demo requests to our inbox and service emails, such as sign-in and notification emails, to clients' staff. Our email delivery service stores data in the United States and keeps email and log data for 30 days. Our inbox, where demo requests and support emails arrive, is hosted by an email provider that may store mail in the United States and other countries.
• Website hosting and security services serve the website and app, run the demo form, and check visitors' IP address, browser and connection details to block bots and attacks. Our provider doesn't publish a fixed retention period for this data. The provider runs a global network, so this data may be processed in the data center closest to the visitor.
• Messaging platforms send and receive messages:
  • WhatsApp carries every message between customers and the business, and also processes messages under its own privacy policy. Some business numbers are connected through a WhatsApp Web session that runs on our servers in Germany. This is not an official WhatsApp connection: messages pass through that session to our servers. Numbers connected through WhatsApp's official Business Platform send and receive messages through a messaging provider. WhatsApp and the messaging provider process messages in the United States and other countries.
  • A team messaging app delivers new demo requests to our team, and lets a business's staff receive alerts and reply to conversations passed to them, so those messages pass through it. Its servers are in several countries.
• Spreadsheet export, only when a business chooses to send recorded requests to its own online spreadsheet. The records are then copied into the business's spreadsheet account, which may store them in the United States and other countries, and the business controls them from then on.

Transfers outside Egypt

Personal data is transferred and processed outside Egypt: in the United States (AI model provider and email delivery), Germany (our servers) and the Netherlands (backups). Our AI search, messaging, inbox and spreadsheet providers process data in the United States and other countries, and our website hosting provider runs a global network. We only transfer it to providers that commit to protecting it, and as Law 151 of 2020 allows. We follow the Personal Data Protection Center's requirements for transfers outside Egypt, including any license it requires.

Client businesses can ask us for the list of the specific service providers we use at hello@flashreplai.ai. We tell our clients 30 days before we add a new provider in any of these categories.

How we protect data

Data is encrypted in transit and at rest, including backups and files, access is limited to the people who need it, and each business can see only its own customers' conversations. If a breach affects your data, we will notify the business, the Personal Data Protection Center and affected people as the law requires.

Your rights

Under Law 151 of 2020 you have the right to:

• know whether we hold your data, and get a copy of it;
• correct data that is wrong or incomplete;
• have your data deleted;
• withdraw your consent, or object to or restrict how your data is used;
• be told if a breach affects your data;
• complain to Egypt's Personal Data Protection Center.

Website visitors and demo requests: email hello@flashreplai.ai and we'll reply within 30 days.

Customers of a business: contact the business first, since it controls your data. If you contact us instead, we'll pass your request to the business and help it respond.

How to delete your data

To delete your demo request, or your messages with a business that uses FlashReplai, email hello@flashreplai.ai with the WhatsApp number you used and, for a business, its name. We'll confirm once the data is deleted, apart from anything the law requires us or the business to keep.

Children

The website and the demo form are for businesses and are not meant for anyone under 18.

Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, we'll tell our clients before it takes effect.

Contact

Questions or requests about your data: hello@flashreplai.ai. See also our terms of service.