Afandi Privacy Policy
Last updated:
1. Who we are
Afandi is a service provided by BARMJINI Software Solutions (Zayouna, Baghdad, Iraq — opposite the Iraqi Fashion House). Afandi is an AI employee that answers the messages businesses receive from their customers (today on the business's website and Telegram, and on WhatsApp, Instagram and Messenger once they are enabled with Meta), together with a system for managing conversations, customers and sales. This policy explains what data we receive, why, how we protect it, and how you can ask us to delete it.
2. Who this policy applies to
- Account holders: the businesses and people who sign up for and use Afandi (the “Customer”).
- The Customer's customers: people who message the Customer on its channels (its website, Telegram, and WhatsApp, Instagram and Messenger once enabled) and receive replies from Afandi.
- Website visitors: people who visit the Afandi pages on barmjini.com.
- BARMJINI's own WhatsApp (+964 785 331 2010): people who message BARMJINI itself on WhatsApp. For these messages BARMJINI is the data controller. They arrive through Meta's WhatsApp Business Platform — and, for our second number, through 360dialog, a WhatsApp Business Solution Provider approved by Meta — and an automated assistant (Anthropic's Claude models) replies. The conversation and your number are kept with our website chats (deleted automatically 12 months after the last message), and a copy is sent to our team's mailbox. You can ask us to delete them at any time (see Data deletion instructions).
For data about the Customer's customers, the Customer owns that data and is responsible for it (the data controller), and BARMJINI is the data processor: we process it on the Customer's behalf, following the Customer's instructions, and only to provide the service to the Customer.
3. Data we receive
- Account data: your name, business name, line of business, website address (if you enter one), and the email address and/or mobile number you sign in with. We don't use passwords: you sign in with a one-time code sent to your email or mobile.
- Channel connection data: the website domains allowed to show the chat widget, and your Telegram bot token (stored encrypted). Once Meta channels are enabled: the business's WhatsApp number, and the WhatsApp Business Account, Page and account IDs that Meta provides when you connect.
- Conversation data: the messages the Customer's channels receive and send through Afandi — including text, images, files and voice notes — the customer's name and ID on that channel (and their number, if they share it), and message times and statuses.
- Training content: the files, price lists, links and answers the Customer adds so Afandi can learn from them.
- Sales data: customer stages, deal values, tags and notes recorded by the Customer or its team.
- Usage and security data: device and browser type, IP address, sign-in times, and the technical logs we need to run and protect the service.
- Payment data: the payment method (Zain Cash, FIB or cash) and the transaction reference. We never store card numbers or e-wallet passwords.
- Website chat (the “احچي ويانا” — Chat with us — window): the text of your messages, the page you started the chat from, message times, and your name and number if you leave them. An automated assistant answers general questions, and the BARMJINI team can see every conversation in its admin panel. The chat may show a small form for your name and mobile number so the team can get back to you (for example after the first answer, or when you ask for a person): filling it in is optional and you can carry on without it (“مو هسه” — Not now); the form appears at most twice per conversation, and never after you have left your number. A copy of the conversation (up to the last 30 messages, with your name and number if you left them) is sent to the team's mailbox through an email provider when you send your first message, when you ask for a person, and as soon as you leave your number (in the form or in a message). Your browser keeps only the conversation token and its settings (such as hiding the form) so you can continue later. Full details are in the “Website chats” section of BARMJINI's privacy policy (barmjini.com/privacy).
5. Why we use data
- To run the service: receiving messages, letting Afandi reply, and showing conversations to the Customer's team.
- To turn voice notes into text that Afandi can understand.
- To organise customers and sales and produce reports for the Customer.
- To verify users and protect accounts (for example, the sign-in code sent to your email or mobile).
- To support the Customer and fix problems.
- To improve the service in general — without using the Customer's customers' conversations to train general-purpose AI models.
- To comply with legal requirements.
We never sell the data we receive through the service, never share it with any third party for marketing or advertising, and never use WhatsApp, Messenger or Instagram data for advertising.
6. How AI works with your data
Afandi reads the customer's message and the information the Customer has taught it, and writes a suitable reply. To do this, the message text and any photos the customer sends, the conversation context and the necessary business information (including the files the Customer uploads to teach Afandi) are sent to an external AI provider — Anthropic (the Claude models), in the USA — which processes them on our behalf solely to generate the reply; Anthropic's commercial terms do not allow it to use this data to train its models. If voice-note transcription is turned on, the audio is sent to a speech-to-text provider (OpenAI) for the same purpose only.
Replies can occasionally be inaccurate, so the Customer can review conversations and correct answers, and Afandi hands the conversation over to a team member when needed.
7. Who we share data with
- Meta (WhatsApp, Messenger and Instagram): messages pass through Meta's official business platforms and are subject to Meta's terms and policies.
- Telegram: messages to your Telegram bot pass through Telegram and are subject to its terms and policies.
- Sign-in code providers: your sign-in code is sent through an email provider or a mobile messaging provider (WhatsApp or SMS), which receive only your email address or number and the code.
- AI provider: Anthropic, to generate Afandi's replies from the message text and photos; and a speech-to-text provider (OpenAI) for voice notes, if that feature is turned on.
- Technical service providers: hosting, database and storage (Railway) and email delivery (Resend), only as far as needed to run the service.
- Payment providers: to complete payments.
- Authorities: when Iraqi law or a competent authority formally requires it.
- The Customer's own team: according to the permissions the account owner sets (owner, manager, agent).
Each of them receives only what it needs to provide its service to us or to the Customer. We do not sell data to anyone, and we do not share it with any third party for marketing.
8. Where data is stored
Data is stored in Afandi's database and file storage with our cloud hosting provider, Railway, on servers outside Iraq (the application runs in the European Union, in the Netherlands). Connections are encrypted, channel connection keys are stored encrypted, and each Customer's data is kept separate from every other Customer's and is visible only to its own team, according to their permissions.
Our other service providers (such as the AI provider, Anthropic, in the USA) also process data on servers outside Iraq. We choose providers that apply appropriate data protection.
9. How long we keep data
- Account and conversation data: for as long as the account exists — also after a subscription stops — until the Customer asks us to delete it.
- After a subscription is cancelled or a trial ends: the data stays so you can come back and continue; if you ask us to delete it (see Data deletion instructions), we delete conversation data and training content within 30 days of your request.
- WhatsApp, Messenger and Instagram messages: kept in the Customer's inbox while the account exists, and deleted together with the rest of the conversation data (see above). The raw notifications we receive from Meta are deleted automatically after 30 days, and the access tokens of Meta channels are erased as soon as a channel is disconnected.
- Technical logs: up to 90 days; the security and activity log (sign-ins and changes, with IP addresses): up to 12 months.
- Billing data: for as long as the law requires.
- Website chat: deleted automatically 12 months after the last message, and you can delete it from the site at any time (the chat's ⋮ menu → “امسح المحادثة” — Delete conversation). Copies sent to the team's mailbox are deleted on request.
10. Security
We use reasonable security measures, such as encrypted connections, sign-in with a one-time code instead of a password, encryption of channel connection keys (such as Telegram bot tokens), and role-based permissions. But no online system is 100% secure, so if anything happens that affects your data, we will tell you as soon as possible.
11. Your rights
- You can ask for a copy of your data, or ask us to correct or delete it.
- You can change or delete training content, and edit customer records, from the dashboard at any time; to delete customer records or conversations, ask us (see Data deletion instructions).
- If you are a customer of a business that uses Afandi: contact that business first, because it owns and controls your data; we will help it carry out your request.
12. Data deletion instructions
You can ask us to delete your data at any time, free of charge. Choose the option that fits you:
- If you have an Afandi account: ask us to delete your account and all of its data through the chat on our website (the “Chat with us now” button at the bottom of this page, or the “احچي ويانا” chat button on any page) — write “Delete my Afandi data” — or on BARMJINI's WhatsApp at +964 785 331 2010, or through the contact page at https://www.barmjini.com/contact, giving your business name and the email address or mobile number you sign in with. Requests in English are welcome. You can also disconnect any channel at any time from Settings → Channels.
- If you connected through Facebook: remove the Afandi app in your Facebook settings (Settings & privacy → Settings → Business integrations, or Apps and websites → Afandi → Remove). When you remove the app, Meta notifies us; we then disconnect every channel connected with your account (a Facebook Page, an Instagram account or a WhatsApp number) and immediately erase its access tokens.
- If you messaged a business that uses Afandi: ask that business for the deletion first, because it controls your data, and we will help it carry out your request. You can also contact us directly in the same ways as above.
- Website chat: you can delete it yourself at any time (the chat's ⋮ menu → “امسح المحادثة” — Delete conversation).
We verify your identity, complete the request within 30 days, and let you know when it is done. You can also stop your Telegram bot at any time through BotFather.
13. Children
Afandi is a service for businesses and is not intended for account holders under 18.
14. Cookies and browser storage
We use cookies and local browser storage to keep you signed in and to remember your preferences (such as the language of these pages). You can clear them in your browser settings.
Measurement and advertising: the BARMJINI website (including the Afandi pages) uses the Meta Pixel and a website analytics tool. These tools record the pages you visit, button clicks on the website's pages, and browser identifiers (such as the _fbp cookie), so we can measure our ads and improve the website. The website chat records only two fixed events: “Lead” when you start a chat, and “Contact” once per chat when you leave your number — without the number itself, your name or the text of your messages. Inside the Afandi app (/app, including its demo version) and its admin screens, automatic button events are turned off and what you type (your name, number and conversations) is never sent to these tools; they receive only the first page view, a fixed “Lead” event with no text when you start a support chat with the BARMJINI team, and a fixed “Contact” event once when you leave your number in it (without the number).
You can stop this measurement by blocking third-party cookies in your browser, or through the ad settings of your Facebook account. This does not affect your use of Afandi.
15. Changes to this policy
If we change this policy, we will publish the new version here and update the date, and if the change is significant we will also notify Customers inside the app.