Your customer data. Protected by design.
AlooChat handles some of the most sensitive conversations a business has — orders, payments, complaints and personal details, in Arabic and English, across WhatsApp, Instagram, your website and email. Security, privacy and data protection are built into how the platform, the AI agents and every integration work.
GDPRPersonal data handled under EU GDPR where it applies, alongside the GCC data-protection framework.What we protect
Every part of the platform touches business-critical information. These are the areas our controls are designed around.
How AlooChat protects your data
The controls below are the ones we document publicly in our Privacy Policy and Terms.
Data encryption
Conversations and business data are encrypted in transit with TLS 1.3 and encrypted at rest with AES-256, so customer messages are protected both as they travel and where they are stored.
Application security
The platform is built on ISO 27001-aligned controls and reviewed by annual penetration tests. Our acceptable-use terms prohibit probing, reverse-engineering or circumventing platform security.
Infrastructure security
AlooChat runs on managed cloud infrastructure with servers in AWS Bahrain and AWS eu-central-1. Where data moves outside the GCC or EU, we apply Standard Contractual Clauses with supplementary technical measures.
Access control
Access is authenticated and governed by role-based controls, so team members see what their role allows. You decide who joins your workspace and what each person can do.
Data privacy
We process personal data under the GCC data-protection framework — UAE PDPL, Saudi PDPL and Kuwait CITRA Regulation 26/2024 — and the EU GDPR where it applies. Data-subject requests are answered within 30 days.
Read the Privacy PolicyIncident response
We monitor for fraud and security events, investigate what we detect, and notify affected customers and regulators in line with the breach-notification duties set out in GCC data-protection law.
AI security
AI agents and your customer data
An AI support platform holds more than tickets — it holds the knowledge your agent answers from. Here is how that content is handled.
Privacy and data ownership
Your content stays yours
You retain ownership of the content you submit. The licence you grant us exists so we can provide, secure and improve the service — and to fine-tune models solely for your workspace unless you opt into global training. You can remove your data at any time.
Clear retention and deletion
Chat transcripts are kept for 24 months by default and can be configured from 0 to 36 months. If you leave, your data is deleted or de-identified within 90 days, except where the law requires us to keep records.
Security for every conversation
The same protections follow a customer conversation wherever it starts and whoever answers it — an AI agent or a member of your team.
Have security questions?
Our team can help with security reviews, privacy questions, enterprise requirements and technical assessments. For data-protection requests specifically, write to privacy@aloochat.ai.