Privacy Policy

Who we are

Borhan is a service of Surf Apps LLC, a limited liability company in the United States. Borhan serves businesses in Jordan and the Gulf (GCC) countries. You can reach us at privacy@borhan.one.

Our role: for businesses, and on their behalf

Businesses that use Borhan (“customers”) decide why and how their customers’ conversations are handled. For that data, the business is the controller and we process it on its behalf and on its instructions, as its service provider.

For the data we collect for our own purposes, such as waitlist sign-ups, business accounts and website security, we are the controller.

If you messaged a business on WhatsApp and want to know how it uses your data, please contact that business first. We will help it respond.

What we collect through WhatsApp

When you message a business that uses Borhan, Meta’s WhatsApp Business Platform delivers the message to us so we can answer on the business’s behalf. We receive and store:

• your WhatsApp phone number and the profile name you set in WhatsApp;
• the content of your messages: text, and media you send such as photos, voice notes and documents;
• transcripts of voice notes, so the assistant can understand them;
• message details: times, delivery and read status, and the replies the assistant or the business’s team sent;
• details the conversation reveals that matter to the sale, such as the product you asked about or an order, recorded as a lead for the business.

We don’t collect your WhatsApp contacts, your other chats, or your location unless you send it in the conversation.

What we collect from businesses and visitors

• Waitlist: the WhatsApp number you enter, its country code, the language of the page and which form you used.
• Business accounts: your name, email address and profile picture from Google sign-in; your business details, product catalog, prices, rules and settings; your team members’ names and email addresses; and your alerts number.
• Security data: when you send a form, Cloudflare Turnstile checks that you aren’t a bot, and we use your IP address briefly to limit abuse. We don’t store IP addresses with your sign-up.

How we use it

• to answer customers on the business’s behalf, using only the business’s catalog, prices and rules, and to hand conversations to the business’s team when a person should step in;
• to alert the business on WhatsApp about orders, leads and conversations that need a person;
• to run, secure and fix the service, and to prevent fraud and abuse;
• to contact waitlist members about Borhan’s launch;
• to meet legal obligations.

We do not sell personal data. We do not use conversations for advertising. We do not use one business’s data to serve another business.

AI processing

To write replies, transcribe voice notes and search a business’s information, we send the relevant conversation text to AI models. We send only what a reply needs. Requests go through Cloudflare’s AI Gateway to model providers reached through OpenRouter, and we route only to providers that don’t use the data to train their models or keep it after answering.

The assistant introduces itself as the business’s assistant. A person from the business can take over any conversation, and you can ask to talk to a person at any time.

Who processes data for us

We use these service providers (“sub-processors”). Each receives only what its job needs:

• Cloudflare, Inc.: hosting, databases, file storage, the AI Gateway, voice-note transcription and search indexing (Workers AI), Turnstile bot checks and email forwarding.
• Meta Platforms, Inc.: the WhatsApp Business Platform that carries messages between you and the business. Meta processes WhatsApp data under its own terms and privacy policy.
• OpenRouter, Inc. and the AI model providers it routes to: generating replies.
• Functional Software, Inc. (Sentry): error monitoring, set up not to collect message content, request bodies or contact details.
• Google LLC: sign-in for business accounts.

Where data is stored

Our databases and files are hosted by Cloudflare, with primary storage in Europe. Cloudflare’s global network and our other providers may process data in other countries, including the United States, where most AI processing takes place. When data moves between countries, we rely on our providers’ contractual and security commitments.

How long we keep it

• Conversations and media: 12 months by default. Each business can choose a shorter or longer period for its own conversations.
• Waitlist sign-ups: until we contact you about the launch, and no longer than 12 months after that unless you become a customer.
• Business accounts: while the account is open, and deleted within 90 days after it closes.
• Operational logs and error reports: up to 90 days.
• Backups: our databases can be restored for up to 30 days, after which deleted data is gone from backups too.

Deleting your data

You can ask us to delete your data at any time, and we will do so within 30 days.

• If you messaged a business that uses Borhan: write to privacy@borhan.one with the WhatsApp number you used and, if you know it, the business’s name. To confirm the number is yours, we may ask you to send us a WhatsApp message from it. We then delete your conversations and leads, and let the business know.
• Waitlist: write to privacy@borhan.one, or message us on WhatsApp at +1 443 494 5970, with the number you signed up with.
• Business accounts: the account owner can write to privacy@borhan.one to delete conversations, contacts or the whole account.

Deleting data with us doesn’t delete the copy on your own phone or in WhatsApp itself. Meta handles that under WhatsApp’s policies.

Your rights

Depending on where you live, data protection laws give you rights over your personal data. These laws include Jordan’s Personal Data Protection Law No. 24 of 2023, Saudi Arabia’s Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and the UAE’s Federal Decree-Law No. 45 of 2021. The rights include to:

• know what data we hold about you and get a copy;
• correct data that is wrong;
• have your data deleted;
• object to or restrict some processing, and withdraw consent where we rely on it.

To use these rights, write to privacy@borhan.one. We answer within 30 days. If you’re unhappy with our answer, you can complain to your local data protection authority.

Security

Data is encrypted in transit and at rest. Each business’s data is kept in its own isolated store, and access is limited to the people and systems that need it. Our security page describes how a message flows through Borhan.

Children

Borhan is for businesses, and business accounts are for people aged 18 or over. Businesses may not use Borhan to direct messages to children. If you believe a child’s data has reached us, write to privacy@borhan.one and we will delete it.

Cookies

borhan.one uses no advertising or analytics cookies. Turnstile may set cookies that are strictly necessary to tell people from bots. The dashboard uses sign-in and preference cookies so it works.

Meta and WhatsApp

Borhan connects to WhatsApp through Meta’s WhatsApp Business Platform and follows Meta’s Platform Terms, the WhatsApp Business Terms of Service and the WhatsApp Business Messaging Policy. Businesses using Borhan must get their customers’ permission before messaging them first, as WhatsApp requires.

Changes

If we change this policy, we will update the date above. If a change matters to how your data is used, we will tell businesses and waitlist members before it takes effect.

Contact

Questions or requests: privacy@borhan.one.