Privacy Policy

1. Who we are

OcttoApps Technologies W.L.L. ("OcttoApps", "we", "us" or "our") is a technology company registered and operating in the State of Qatar. We design and build websites, mobile applications, admin dashboards, booking and ordering systems, CRM and client portals, and WhatsApp-based customer communication and automation for businesses.

We are the data controller for the information described in this policy when you contact us, enquire about our services, or message our official WhatsApp Business number. Where we operate a WhatsApp channel or business system on behalf of a client, that client is the controller of their own customer data and we act as their service provider (processor) under contract.

2. Scope of this policy

This policy explains how we handle personal and business information collected through:

• Our website at octtoapps.tech, including enquiry and booking forms.
• Our official WhatsApp Business Platform number and any WhatsApp conversation you start with us.
• Email, telephone calls and meetings relating to our services.
• Systems, dashboards and portals we build and operate, to the extent we handle data within them.

It does not cover the independent privacy practices of other companies whose websites or services you may reach through links we publish. Their own policies apply to those services.

3. Information we collect

We collect only the information we need to answer your enquiry, deliver a project, or support a system we have built. Depending on how you interact with us, this may include:

Information you give us directly

• Identity and contact details — your name, email address, telephone or WhatsApp number, and preferred language.
• Business information — company or trade name, industry, role, location, commercial registration details where relevant to an engagement, and the business requirements you describe to us.
• Enquiry and project content — the message, brief, budget range, timeline, files, screenshots, logos, product or service information and any other material you choose to send us.
• Booking and meeting details — the date, time, channel and subject of meetings you arrange with us.
• Billing and account information — invoicing details and payment references for clients under contract. We do not store full payment card numbers; card payments, where used, are handled by regulated payment providers.

Information collected automatically

• Technical data — IP address, browser type and version, device type, operating system, referring page and the pages you view on our website. This is generated in standard server logs by our hosting provider.
• Message metadata — for WhatsApp and email, the timestamp, delivery and read status, and the phone number or address a message was sent from or to.

Information we receive from our clients

When we build or operate a system for a client, that client may make their own customer records available to us so that we can configure, test, support or run the service. We process that information on the client's instructions and for the purposes of our agreement with them, and not for our own separate purposes.

We do not intentionally collect special categories of data — such as health, religious or biometric information. Please do not send such information to us unless it is genuinely necessary for a project and we have agreed in writing how it will be handled.

4. WhatsApp messages and contact data

We use the WhatsApp Business Platform, provided by Meta Platforms, Inc. and its affiliates, to communicate with businesses and customers who choose to reach us on WhatsApp. When you message our WhatsApp Business number, or opt in to receive messages from a WhatsApp channel we operate, we process:

• Your WhatsApp phone number and the profile name displayed by your WhatsApp account.
• The content of your messages — text, images, documents, voice notes, location shares and other attachments you send us.
• Conversation metadata — timestamps, message and conversation identifiers, delivery and read receipts, and which template or automated flow a message relates to.
• Your opt-in and opt-out status, so we respect your communication preferences.

We only send WhatsApp messages to people who have contacted us first or who have opted in to hear from us, and we use approved message templates where the WhatsApp Business Platform requires them. We do not use WhatsApp contact information for unrelated marketing, and we do not upload your WhatsApp number to advertising audiences.

WhatsApp message delivery is operated by Meta. Message content is transmitted through Meta's infrastructure and is subject to Meta's own terms and privacy policy in addition to this one. Messages you send us are stored in our business systems so that our team can read them, respond and keep a record of the conversation.

5. How we use your information

We use the information described above for the following purposes:

• Responding to enquiries and providing customer support — reading your message, answering questions, sharing pricing and proposals, arranging meetings and resolving issues you report.
• Delivering AI-assisted responses — generating suggested or automatic replies to routine questions such as opening hours, service details, availability, order or booking status, so that you get an accurate answer quickly. See section 6.
• Providing and operating our services — designing, building, hosting, maintaining and supporting the websites, applications and business systems we are engaged to deliver.
• Managing bookings and appointments that you make with us or through a system we operate.
• Administration and billing — preparing quotations, contracts and invoices, and keeping accounting records.
• Service communications — sending confirmations, project updates, support notices and information you have asked for.
• Improving quality and reliability — reviewing conversation quality, diagnosing faults, monitoring performance and improving our templates and workflows. We use aggregated or de-identified information for this wherever it is practical.
• Security and abuse prevention — protecting our systems and our clients' systems against spam, fraud and unauthorised access.
• Legal and regulatory compliance — meeting obligations under Qatari law, including tax and accounting requirements, and responding to lawful requests from competent authorities.

We rely on your consent, the performance of a contract with you, our legitimate interest in running and improving our business, and compliance with legal obligations as the bases for this processing. Where we rely on consent — for example, to send you WhatsApp updates — you can withdraw it at any time.

6. AI-assisted responses

To answer common questions quickly and consistently, some of our customer support replies are drafted or sent with the help of artificial intelligence. This works as follows:

• The content of your message, and relevant recent context from the same conversation, may be sent to a trusted AI infrastructure provider so that a reply can be generated.
• We send only what is needed to answer the question. We do not send unrelated records, and we avoid including sensitive information in AI prompts.
• AI-generated replies are used for routine informational support. Commercial matters such as quotations, contracts and anything with a legal or financial effect on you are handled by a member of our team.
• You can ask to speak with a member of our team at any point in the conversation.

We aim to use established AI providers on business or developer terms, and we take their published data-handling commitments into account when we choose them. Those commitments are set by the provider, and how customer content is handled — including whether it may be used to improve their services, and how long it is kept — is governed by the terms and documentation of the provider concerned rather than by us. We do not authorise our AI providers to use your information for their own independent purposes, and we will tell you which providers are involved if you ask. AI-assisted processing is not used to make decisions producing legal or similarly significant effects about you.

7. Service providers we use

We share information with a small number of selected providers who help us operate our business. We choose providers that offer terms and security practices appropriate to the information involved, and we seek to ensure they use it only to provide their service to us. These include:

• Meta Platforms, Inc. (WhatsApp Business Platform) — message delivery, template approval and conversation infrastructure for WhatsApp communications.
• AI infrastructure providers — enterprise AI and large language model services used to generate the AI-assisted support replies described in section 6.
• Cloud hosting and website providers — hosting of our website, applications and databases, including form submissions, backups and server logs.
• Email, calendar and productivity providers — business email, meeting scheduling and internal collaboration.
• Business and support tools — CRM, ticketing, analytics on our own systems, and error-monitoring services used to keep systems working.
• Payment and accounting providers — regulated payment processors and accounting software used for invoicing and bookkeeping.
• Professional advisers — legal, audit and accounting advisers, where necessary and under a duty of confidentiality.

We may also disclose information where we are required to do so by law, court order or a competent authority in Qatar, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our people, our clients or the public. If our business is reorganised, merged or transferred, information may pass to the successor entity subject to this policy.

8. We do not sell your data

OcttoApps does not sell, rent or trade personal information, business contact details or WhatsApp data to anyone. We do not share your information with data brokers, and we do not provide it to third parties for their own independent advertising or marketing purposes. Information is shared only with the service providers described in section 7, and only so that they can perform their service for us, subject to the terms and confidentiality obligations that apply to them.

Client data that we process on behalf of a client is never used for our own commercial purposes, sold, or shared with any other client.

9. International data transfers

We are based in Qatar, but some of the providers listed in section 7 — including Meta and our AI and cloud infrastructure providers — operate data centres and support functions outside Qatar. This means your information may be transferred to, stored in, or accessed from other countries.

When information is transferred outside Qatar, we take reasonable steps to ensure it remains protected to a standard consistent with this policy and with Qatar's Law No. 13 of 2016 on Personal Data Privacy Protection. In practice this means relying on the data protection and confidentiality terms offered by the provider concerned, and any additional safeguards required by applicable law.

10. Data security

We apply technical and organisational measures appropriate to the sensitivity of the information we hold and to the system concerned. Depending on the service, these measures include:

• Encryption in transit — HTTPS/TLS across our website, dashboards and integrations; WhatsApp message transport is secured by Meta's own platform encryption.
• Encryption at rest where it is provided by the cloud platforms hosting our databases and backups.
• Access control — access limited to the people who need it, individual accounts, strong passwords, and multi-factor authentication where the system supports it.
• Credential hygiene — API keys and access tokens stored as protected secrets and changed when circumstances require.
• Monitoring and backups — logging, error monitoring and backups so that data can be restored after an incident.
• Confidentiality obligations for employees and contractors who handle personal information.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect your rights, we will take appropriate steps to contain it, notify affected parties and the competent authority where the law requires, and reduce the risk of recurrence.

11. How long we keep information

We retain personal information only for as long as is reasonably necessary for the purposes described in this policy, and for as long as we are required or permitted to keep it in order to meet our legal, regulatory, accounting, tax and legitimate business obligations. We do not apply a single fixed period to every category of information.

The period that is reasonably necessary depends on the circumstances, including:

• Why the information was collected — an enquiry that does not lead to work is generally kept for a shorter time than the records of a delivered project.
• Whether an ongoing relationship exists — records relating to a live engagement, a system we support, or a continuing conversation are kept while that relationship continues.
• Legal and financial obligations — contracts, invoices and accounting records are kept for the periods required of us under Qatari commercial, tax and company law.
• Potential legal claims — information may be kept while it may be needed to establish, exercise or defend a legal claim.
• Contractual instructions from clients — where we hold data on behalf of a client, retention follows our agreement with that client, and the data is returned or deleted on their instruction.

When information is no longer needed for any of these purposes, we delete it or make it anonymous. Where you ask us to delete information and we are able to do so, we will remove it from our active systems; residual copies may persist for a limited time in routine backups before being overwritten in the ordinary backup cycle.

12. Your privacy rights

Subject to the law that applies to you — including Qatar's Law No. 13 of 2016 on Personal Data Privacy Protection, and other data protection laws where they apply to your situation — you have the right to:

• Be informed about what personal information we hold about you and how it is being used.
• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate, outdated or incomplete.
• Request deletion of your personal information where we no longer have a lawful reason to keep it.
• Withdraw consent at any time where our processing is based on your consent, including opting out of WhatsApp messages.
• Object to or restrict processing that you believe causes you harm or is not necessary.
• Receive a portable copy of information you provided to us, in a commonly used machine-readable format, where technically feasible.
• Ask for review by a member of our team of any response that was produced with AI assistance.
• Complain to us, and to the competent data protection authority in Qatar, if you believe your rights have not been respected.

These rights apply as provided by the law that governs your situation, and some of them may be subject to conditions or exceptions under that law. We do not ordinarily charge for handling a request, and we will not refuse you service or treat you less favourably for making one.

13. Access, correction and deletion requests

To request access to your data, ask us to correct it, or ask us to delete it, contact us using any of the methods below and tell us:

• What you would like us to do — access, correction, deletion, or an opt-out.
• The email address, phone number or WhatsApp number you used when dealing with us, so we can locate your records.
• Any detail that helps us find the right information, such as the approximate date of your enquiry or the company you represent.

We will acknowledge your request as soon as we reasonably can and respond within a reasonable period, and within any timeframe required by the law that applies to your request. If your request is unusually complex, or if we need more information to act on it, we will tell you. We may ask you to confirm your identity — for example, by replying from the same email address or WhatsApp number — so that we do not disclose someone else's data by mistake.

We may not always be able to action a request in full. For example, we may need to retain invoices and accounting records that we are legally required to keep, or information we need in connection with a legal claim, and some requests may be limited by the law that applies. Where that happens, we will explain what we are keeping and why, and we will act on the remainder of your request so far as we are able.

14. Cookies and website data

Our website is deliberately lightweight. It does not currently use advertising cookies, cross-site tracking pixels or third-party marketing trackers. Our hosting provider records standard server logs, and we load web fonts from Google Fonts so that pages render correctly, which means your browser contacts Google's servers to fetch those font files. Any cookie strictly necessary for a page or form to work is used only for that purpose.

You can block or delete cookies in your browser settings at any time. Doing so will not prevent you from reading this website.

15. Children's privacy

Our website and services are intended for businesses and for adults acting in a professional capacity. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time to reflect changes in our services, our providers, or the law. The effective date at the top of this page always shows when the current version was published. Where a change materially affects how we use your information, we will take reasonable steps to notify you — for example, by email or through the channel you normally use to reach us.

17. Contact us about privacy

For any question, request or complaint about privacy and your data, please contact us:

If you are not satisfied with our response, you may raise the matter with the competent data protection authority in the State of Qatar.