Privacy Policy

Last updated: January 29, 2026

Introduction

Rasava provides an AI-powered business assistant and unified inbox for small businesses at rasava.ai. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights available to you under applicable data protection laws (including GDPR).

Information We Collect

  • Account information: name, email, and account identifiers.
  • Integration data: Google account identifiers and Meta/WhatsApp integration tokens needed to connect inboxes.
  • Messages and metadata: message snippets, timestamps, sender/recipient identifiers (email or phone), thread IDs.
  • Usage analytics: basic, aggregated events for product improvement.

WhatsApp Data

If you connect WhatsApp to Rasava, we process WhatsApp messaging data to provide the inbox and reply features.

What we process

  • Customer phone number
  • Message content (e.g., text)
  • Message timestamps and delivery status
  • Media content (only if sent by the customer)

Why we process it

  • To deliver messages to your inbox
  • To help you reply to customers from Rasava
  • To enforce WhatsApp messaging rules (e.g., the 24-hour customer care window and template-only messaging when required)
  • To troubleshoot reliability issues (using aggregated, de-identified information where possible)

Sharing with Meta / WhatsApp

To send and receive WhatsApp messages, Rasava communicates with Meta/WhatsApp services (WhatsApp Cloud API). This is required to deliver messages.

Retention

We retain messaging data only as long as needed to provide the service for the connected business account, or until the business deletes it or requests deletion.

Contact

If you have questions or requests related to data processing or deletion, contact: mahdieh.roustaei@gmail.com

Why We Collect It & Legal Bases

We process personal data for the following purposes and legal bases:

  • Providing the service: processing your account, routing and displaying messages, and delivering functionality — legal basis: contract.
  • Integrations: storing tokens and identifiers to interact with Google/Meta APIs on your behalf — legal basis: contract/consent (where required by providers).
  • Product improvements & analytics: aggregated analytics — legal basis: legitimate interests.
  • Compliance & safety: preserving data for legal obligations and abuse prevention — legal basis: legal obligation or legitimate interests.

Retention

We retain data as long as needed to provide the service and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements. If you delete your account we will delete most personal data within 30 days, except for limited records we must retain for legal reasons (see Data Deletion page).

Your Rights

Depending on your jurisdiction you may have rights to access, correct, port, restrict, or erase your personal data, and to object to certain processing. To exercise these rights contact us atmahdieh.roustaei@gmail.com or follow the steps on our Data Deletion page.

Cookies and Analytics

We use minimal cookies and third-party analytics to understand product usage. We do not use tracking for advertising. You can opt out of analytics by contacting support.

Third-Party Processors

We use third-party providers to operate the service, including Vercel (hosting), Clerk (authentication), Google APIs (Gmail), Meta (WhatsApp Cloud API), and our database provider (Postgres). These providers process data on our behalf under contracts that include data protection obligations.

International Transfers

Data may be transferred and stored outside your country. Where transfers occur from the EU/EEA, we rely on appropriate safeguards such as standard contractual clauses or transfers to providers that implement adequate protections.

Security

We employ reasonable technical and organizational measures to protect personal data. However, no system is completely secure — if you suspect a security issue contact us atmahdieh.roustaei@gmail.com.

Children

Our services are not intended for children under 16. If you believe a child has provided us personal data, contact support at mahdieh.roustaei@gmail.com and we will promptly address the request.

Contact

For privacy requests or questions: mahdieh.roustaei@gmail.com