← Thakaa Chat

Privacy Policy

Last updated: 6 October 2026

This policy explains how Thakaa Intelligence [registered legal name, e.g. ... LLC] (“we”, “us”), operator of the Thakaa Chat platform, handles personal data. We are based in the Sultanate of Oman and follow Oman's Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulations.

1. Our two roles

  • For businesses that use our platform (our customers), we decide how their account data is used, and are responsible for it.
  • For people who chat with a business's chatbot on that business's website, we process the chat on the business's behalf and under its instructions. The business is responsible for that data. If you chatted with a chatbot and have a question about your data, please contact that business first; we will help them respond.

2. What we collect

  • Account data: email address, password (stored only in encrypted, hashed form by our authentication provider), business name, and settings.
  • Business content: documents, instructions, logos and settings a business uploads to configure its chatbot.
  • Chat data: messages exchanged with a chatbot, the website it was used on, the time, a random visitor ID stored in the visitor's browser, and a one-way coded (hashed) version of the visitor's IP address used only to prevent abuse. We do not store visitors' IP addresses themselves, and we do not ask chat visitors for their name or contact details.
  • Technical data: limited logs needed to run, secure and fix the service.

3. Why we use it

  • To provide the platform: accounts, chatbots, document search and answers.
  • To generate chatbot answers from a business's own documents using AI.
  • To show businesses their conversation history and unanswered questions.
  • To prevent abuse (rate limits), keep the service secure, and fix problems.
  • To contact businesses about their account and the service.

We do not sell personal data, and we do not use chat data for advertising.

4. AI processing

To answer a question, the chatbot sends the visitor's message, recent messages from the same conversation, the business's chatbot instructions and the most relevant passages from the business's documents to our AI provider, Anthropic (Claude), which generates the answer. Document text and visitors' questions are also sent to Voyage AI to make the documents searchable. Chatbot answers are generated automatically and may sometimes be inaccurate.

[Before launch: confirm each AI provider's current data-use and retention terms (including any training opt-out setting in the Voyage AI dashboard) and describe them here accurately.]

5. Service providers

We use these providers to run the platform:

  • Supabase: database, file storage and logins (data stored in Frankfurt, Germany).
  • Vercel: website and server hosting (server processing in Frankfurt, Germany).
  • Anthropic: AI answers (United States).
  • Voyage AI: document search (United States).
  • Resend: account emails (sent from Ireland, EU; US company).
  • Sentry: error monitoring (United States).

6. Transfers outside Oman

Personal data is stored and processed outside Oman, in the European Union and the United States, by the providers above. [Lawyer to confirm the legal basis and safeguards for these transfers under the Oman PDPL and its Executive Regulations, including whether and how explicit consent must be collected from chat visitors and account holders.]

7. How long we keep data

  • Chat data: deleted automatically after the period the business chooses (30, 90 or 365 days), or earlier if the business deletes it.
  • Business content: until the business deletes it or closes its account.
  • Account data: while the account is open, then deleted within [X] days unless the law requires us to keep it longer.

8. Your rights

Under Oman's Personal Data Protection Law you may have the right to access your personal data, have it corrected or deleted, withdraw consent, object to processing, and complain to the competent authority. To use these rights, contact us at [contact email]. For chat data, you can also contact the business whose chatbot you used.

9. Security

We protect data with encryption in transit, strict access controls that keep each business's data separate, private file storage, and limited staff access. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

10. Children

The platform is intended for businesses and is not directed at children.

11. Changes

We may update this policy. We will post the new version here and, for significant changes, notify account holders.

12. Contact

[Company legal name], [address], Sultanate of Oman.
Email: [contact email]