Privacy Policy

This policy covers data processing when visiting the kexel website, using the platform or communicating with a business using it. We determine processing purposes for subscriber accounts, billing, support and service security and act as controller for those purposes.

We process business customers’ conversations and orders on the business’s behalf and lawful instructions; the business controls that data. It must inform its customers and obtain legally required consents. Our independent obligations as a processor remain.

We may process names, business details, email, phone numbers, team details and permissions, login and session information, and necessary operational and error logs. Support never asks you for your password.

Google sign-in provides basic identity data authorised by the user, such as name, email and profile picture. Signing in does not grant access to Gmail or Google Drive. Google data is used for sign-in and account purposes in accordance with the Google API Services User Data Policy and Limited Use requirements.

We retain necessary payment details such as transaction reference, amount, status, subscription plan and payer email. Card data is entered at the payment gateway; full card numbers and security codes do not reach us. We also process support correspondence and requests you send us.

Depending on enabled features, data includes messages, comments, sender names and identifiers, phone numbers and handles, message times and delivery status, attachments such as images, audio and files, notes, qualification and follow-up information, and order details the business records or asks to collect.

We also process the knowledge base, products, policies and files uploaded by the business, channel identifiers, connection permissions and necessary integration keys. Official social-platform connections do not require you to give us your social-account password.

When a store or shipping integration is enabled, we process data needed for the function the business selects. This may include products, orders and recipient name, phone number and address transmitted to the shipping provider.

We use data to operate accounts, the inbox, automated replies, orders and selected integrations, provide support, secure the service, confirm payments and meet legal obligations. Processing relies on consent where required or another ground permitted by law for the specific purpose; accepting the terms is not blanket consent for every use.

Necessary parts of messages, context and attachments may be processed by AI providers to deliver the requested replies and functions within the business workspace. Outputs may need human review. We do not use customer conversations to train general-purpose models or serve another business, or sell, rent or use data to build advertising audiences.

Access is limited to authorised business users and members of our team who need it to provide and protect the service. Necessary data may be shared with hosting, storage, data-processing, AI, channel-connectivity, payment and service-email providers to perform the relevant function.

Enabling a channel, store or shipping service exchanges the data needed for your selected operations, such as recipient and order details sent to a shipping company. Some providers may process certain data under their own policies. You can request details of recipients relevant to your account through the contact below.

We may disclose necessary data in response to a binding legal request or to protect a right under applicable law.

Data may be processed outside Egypt by service providers. Transfers remain subject to protection and licensing or authorisation requirements under Egyptian law; using the website does not waive them. Processing-location details are available through the contact below.

We retain account data and content as needed to provide the service or for a disclosed lawful purpose. Specific records may be retained for legal obligations or active disputes, with restricted use. Recovery copies follow separate retention cycles, details of which are available on request.

We take appropriate security measures to protect data and limit access to authorised people. No system can be guaranteed absolutely secure. We investigate and address data incidents and make required notifications within statutory deadlines.

Subject to law, you may request knowledge of, access to or a copy of your data; correction, completion, erasure or restricted processing; withdrawal of consent; and objection to processing or its results. Withdrawal does not invalidate earlier lawful processing and may prevent a feature relying on it.

Send requests through the contact below. We verify identity and authority only as necessary, handle requests within statutory deadlines and explain any refusal or retention. You may complain to the Egyptian Personal Data Protection Center or another competent authority.

The workspace owner can delete it from Settings → Delete workspace by confirming the business name. This ends team access and starts workspace-data deletion and channel disconnection. First retain anything you need using available account features or by asking support.

You may also email the privacy contact below from your account email, identifying the business and the data to delete. We verify identity and authority only as necessary and never ask for your password or verification code.

We handle verified requests without undue delay and within applicable legal deadlines, aiming to complete deletion within 30 days at most unless a shorter deadline applies. If a legal exception requires us to retain specific data, we explain its scope and reason.

If you messaged a business using kexel, that business controls your conversation data. Ask it to exercise your rights, or email our privacy contact with the business, platform and number or handle you used. We coordinate with the business and assist as permitted by law and our authority, without disclosing anyone else’s data.

Disconnecting a channel on Connections or revoking app permissions at the external platform stops the connection but does not necessarily delete conversations already received. Stored-data deletion can be requested separately.

To remove Facebook or Instagram permissions, use the apps and integrations settings in your Meta account. Deletion from kexel does not delete copies held by the business or external platforms, which have their own obligations and policies.

We use cookies and local storage for login, preferences and tracking choices. Referral and campaign information may be retained for 30 days and associated with signup to identify subscriber sources.

Google Analytics and Meta Pixel run on public pages only with your consent. They may receive IP address, device, page, referral and cookie-identifier data, signup events and payment confirmation and amount. They do not run inside the dashboard, and we do not send them customer conversation content or contact details.

You may accept or reject measurement, change your choice using the button below or use browser cookie controls. Disabling essential cookies may affect login.

Business accounts are for adults. Sensitive or children’s data must only be provided for a necessary lawful purpose with required consents, licences and legal safeguards. If notified of data that cannot lawfully be processed, we investigate and work with the business on appropriate action.

We update this policy when processing purposes or the service change and state the version date. We notify users of material changes appropriately and obtain fresh consent where required by law; continued use alone is not consent to a new purpose requiring separate consent.

Contact and privacy requests: support@kexel.website