Privacy Policy

1. Data we handle for ourselves (as controller)

Contact details you share with us (name, email, phone, company) when you contact us or become a client, and website usage data strictly needed to operate the site.

We use this data to respond to you, provide our services, and manage our client relationships. We do not send marketing messages without your opt-in consent, and you can withdraw consent at any time.

2. Data we handle for our clients (as processor)

When a business uses an Onsila-operated assistant (for example on WhatsApp), that business is the controller of its customers’ conversation data. We process it on the business’s instructions to run the assistant: receiving messages, generating replies, and showing conversations to the business’s own team.

Our assistants identify themselves as automated, and you can ask for a human at any time — the business’s team can take over the conversation.

3. Where data lives and the services we rely on

Conversation and account data is stored on infrastructure in Riyadh, Saudi Arabia.

Messaging channels are operated by their providers — for WhatsApp, Meta Platforms, Inc. (processing includes servers outside Saudi Arabia, including the United States). AI replies are generated using Anthropic’s Claude API (United States). We send only the conversation content needed to produce a reply; Anthropic does not train its models on this data.

These transfers are made with appropriate contractual safeguards and documented risk assessments, and only the minimum necessary data is sent.

4. Retention

We keep personal data only as long as needed for the purposes above or as our client agreements require, then delete it.

5. Your rights, and how to delete your data

Under the Saudi Personal Data Protection Law (PDPL) you may request access to, correction of, or deletion of your personal data.

To request deletion: email privacy@onsila.sa from the address or phone number concerned, or simply reply to any Onsila-operated assistant conversation asking for your data to be deleted, with the word “delete”. Tell us which business you were messaging if you know it. We action requests within 30 days and confirm by email when the data has been deleted.

If the data is part of a conversation with one of our business clients’ assistants, that business is the data controller — we will forward your request to them and assist them in carrying it out.

6. Changes

We will post any updates to this policy on this page with a new effective date.