A Atyaf Hub

Privacy policy

In short: the shop controls its customers' data and conversations, and Atyaf Hub performs messaging and AI-assisted replies on its behalf. We do not sell data, use it for advertising, or improve a public model with it. Atyaf-exclusive learning is off by default and requires separate opt-in, human review, and de-identification.

The summary above is for clarity only. The English text below is the binding one.

Privacy Policy

Last updated: 22 August 2026 · Policy version: 2026-08-22

Atyaf ("Atyaf", "we", "us") operates Atyaf Hub, a WhatsApp Business Solution / Tech Provider platform available at https://hub.atyaf.co. Atyaf Hub lets businesses connect their own WhatsApp Business Accounts and send and receive WhatsApp messages through the WhatsApp Cloud API. This policy explains what data we process, how, and why.

1. Our role

Each business that connects its WhatsApp Business Account to Atyaf Hub is the data controller of the messages and contacts it processes through our platform. Atyaf acts as a data processor (Tech Provider) that carries out messaging strictly on that business's instructions. We never message anyone without an onboarded business initiating the action from our dashboard or REST API.

2. Information we process

When a business onboards and uses Atyaf Hub, we process:

  • The business's WhatsApp access token, stored encrypted at rest, used only to call the WhatsApp Cloud API on the business's behalf.
  • WhatsApp Business Account ID, phone number IDs, display phone number and verified business name.
  • Message metadata and content that the business sends or receives through the platform (message IDs, direction, timestamps, delivery status, and the message body).
  • The phone numbers of the recipients the business chooses to message.

We do not sell personal data or use it for advertising. Message content is not used to improve a public or third-party model. The limited, opt-in use of reviewed and de-identified examples to improve an Atyaf-exclusive model is described in section 4.

3. How we use the data

Data is used only to deliver the service: sending and receiving WhatsApp messages, managing message templates, showing message history and delivery status in the dashboard, and providing our REST API to the connecting business. We use the WhatsApp access token solely to perform the actions the business requests.

4. AI-assisted replies, evaluation, and optional learning

When a business enables AI-assisted replies, relevant message fragments and the minimum business facts needed to answer may be sent to an approved AI sub-processor to understand the request, retrieve read-only facts, plan an action, transcribe media, or compose a reply. The model cannot write directly to the business database. Prices, availability, orders, payments, and every state-changing action are checked and executed by Atyaf Hub.

We retain an operational audit of the goals found, evidence used, proposed actions, validation results, model and version, and the final reply. We do not store or expose the model's private chain of thought. Failed, disputed, or low-confidence replies may be placed in a human review queue.

Learning is off unless the business gives separate, explicit authorization. With that authorization, only human-reviewed and de-identified examples may enter a versioned dataset used to evaluate or train a model exclusively for Atyaf's own service. The same authorization also permits Atyaf to use a measured, human-approved Atyaf-exclusive model release for that business's new dialogue turns, within the exact scope selected by the business. An order being completed is not, by itself, approval of earlier replies. No example is used to improve a provider's general model, shared with an external beneficiary, or activated in production without a measured quality review. A business may withdraw authorization at any time. Withdrawal makes new dialogue turns use the approved baseline instead, stops new learning use, and removes examples from future dataset releases; a turn that already selected its model before withdrawal may finish, subject to legal retention and backup obligations.

5. Where data is stored

Data is processed and stored on our own server infrastructure hosted in Germany (European Union). Communication with the WhatsApp Cloud API and with our dashboard is encrypted in transit over HTTPS.

6. Sub-processors

  • Hetzner Online GmbH — server hosting (Germany, EU).
  • Meta Platforms, Inc. — the WhatsApp Business Platform / Cloud API that actually delivers the messages, governed by Meta's own terms and privacy policy.
  • OpenAI, L.L.C. — AI planning, response composition, and supported media processing when AI replies are enabled.
  • Google LLC and Anthropic, PBC — optional media or AI processing only when the business enables a governed provider configuration that requires them.

Atyaf configures customer-content requests not to be used for provider model training and permits only provider access covered by the business's approved configuration and our data-protection controls.

7. Security

We protect data with HTTPS everywhere, encryption of WhatsApp access tokens at rest using the application key, verification of every inbound webhook via Meta's X-Hub-Signature-256 signature, and access controls on the provider dashboard.

8. Data retention and deletion

We retain a business's data while its account is connected and for as long as necessary to provide, secure, audit, and comply with legal obligations for the Service. A business may disconnect at any time and may request deletion of its stored tokens, message data, evaluation records, and eligible training examples. Data already required for fraud, security, billing, legal claims, or immutable backup rotation is kept only for the applicable purpose and period. To request deletion or withdraw AI-data authorization, contact us at the address below.

9. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. Because Atyaf acts as a processor, requests from message recipients are directed to the business (controller) that messaged you; we assist that business in fulfilling such requests.

10. Changes

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Atyaf

Email: hello@atyaf.co

Website: https://atyaf.co

Summary

Atyaf runs Atyaf Hub as a WhatsApp service provider and processor for each business. When AI replies are enabled, the minimum relevant message content and business facts may be sent to a disclosed AI sub-processor with general-model training disabled. We retain goals, evidence, actions, and outcomes for audit, not private chain of thought. Training an Atyaf-exclusive model requires separate merchant authorization, human review, and de-identification; completing an order is not automatic approval. Authorization can be withdrawn and eligible data can be deleted. Data is hosted in Germany and encrypted in transit. Contact: hello@atyaf.co