Privacy Policy

Last Updated: 11/6/2026

Website / Platform: www.octaboo.com
Operator: Metas for Programming & Design LLC
Trading Name: Octaboo
Contact Email: info@octaboo.com
Egypt Address: 149 Ahmed Shawqi St., Roushdy, Alexandria, Egypt – 21531
Oman Address: Muscat Governorate, Al Amrat, Madinat Al Nahathah, Block 452, Street 5529, Building 2100

---

1. Introduction

Octaboo respects the privacy and personal data of its customers, users, prospects, leads, business partners, and all individuals whose data may be processed through the Octaboo platform.

This Privacy Policy explains how Octaboo collects, receives, uses, stores, shares, transfers, protects, and deletes personal data when you access or use Octaboo’s website, software platform, dashboard, mobile or web applications, integrations, AI agents, lead management tools, customer support channels, and related services.

Octaboo is an AI-led lead operations platform that centralizes inbound leads from multiple channels into one unified inbox and uses AI agents to respond, qualify, tag, score, route, summarize, and organize conversations into sales-ready prospect profiles.

This Policy is designed to comply, where applicable, with:

Egyptian Personal Data Protection Law No. 151 of 2020 and its executive regulations and implementing decisions;
Egyptian Anti-Cyber and Information Technology Crimes Law No. 175 of 2018;
applicable Egyptian civil, commercial, telecommunications, consumer protection, and electronic transaction laws;
the EU General Data Protection Regulation, where applicable;
Meta Platform, WhatsApp Business, Facebook, Instagram, and Messenger requirements;
Google API Services User Data Policy, Google APIs Terms of Service, and applicable Limited Use requirements;
any other mandatory privacy, data protection, security, platform, or regulatory requirements that apply to Octaboo’s services.

By accessing or using Octaboo, creating an account, connecting a communication channel, inviting users, uploading data, using AI agents, or allowing Octaboo to process lead or customer data, you acknowledge that you have read and understood this Privacy Policy.

2. Scope of This Policy

This Policy applies to:

Octaboo business customers, including agencies, companies, growth teams, sales teams, and their authorized users;
visitors to Octaboo’s website and landing pages;
individuals who contact Octaboo for sales, support, partnership, billing, or general inquiries;
leads, prospects, and end customers whose data is received, processed, organized, or qualified through Octaboo on behalf of Octaboo customers;
users who connect Meta, WhatsApp, Instagram, Facebook, Messenger, Google, email, CRM, web form, website chat, advertising, or other third-party integrations to Octaboo;
white-label or agency-branded deployments powered by Octaboo.

This Policy does not replace the privacy policy of Octaboo’s business customers. Where an agency, advertiser, company, or other business customer uses Octaboo to manage its own leads, that customer remains responsible for giving its own leads and prospects any legally required privacy notices and obtaining any required consents.

3. Legal Role of Octaboo

Octaboo may act in different legal roles depending on the type of data and processing activity.

For account, billing, website, marketing, platform security, customer support, product analytics, and business relationship data, Octaboo generally acts as a data controller.

For lead, prospect, conversation, campaign, inbox, and customer data processed on behalf of a business customer through Octaboo, Octaboo generally acts as a data processor or service provider, and the business customer acts as the data controller.

For certain platform, compliance, fraud prevention, security, legal, or aggregated analytics activities, Octaboo may act as an independent controller to the extent permitted by applicable law.

Where required, Octaboo and its business customers may enter into a separate Data Processing Agreement, service agreement, or similar document that governs the processing of personal data.

4. Data We Collect or Receive

Octaboo may collect or receive the following categories of personal data, depending on how the platform is used.

4.1 Account and Business User Data

This may include:

full name;
business email address;
mobile number;
company name;
job title;
department;
login credentials;
role and permission level;
workspace name;
agency or client account details;
billing and subscription information;
support requests;
training, onboarding, and implementation information;
communication preferences.

4.2 Lead, Prospect, and Conversation Data

When a business customer connects lead sources to Octaboo, Octaboo may process data relating to that customer’s leads, prospects, customers, or contacts, including:

name;
phone number;
email address;
social media handle or profile identifier;
message content;
comments, replies, inquiries, and conversation history;
lead source;
campaign, form, ad, page, or channel information;
requested product or service;
need, interest, budget, timing, location, project, or qualification answers;
tags, lead scores, notes, assignments, AI summaries, and routing status;
appointment, meeting, callback, or handoff information;
CRM or sales pipeline status;
duplicate records and merged profiles.

4.3 Connected Channel and Integration Data

Where authorized by the business customer or user, Octaboo may receive data from connected platforms, including:

Meta, Facebook, Instagram, Messenger, and WhatsApp Business account data;
Facebook Page and Instagram professional account information;
WhatsApp Business phone number, templates, message status, and business messaging data;
Meta lead forms, comments, messages, page metadata, and permitted engagement data;
Google account or workspace data, only where the relevant Google integration is enabled and authorized;
email account metadata and message data, where email integrations are enabled;
website forms, landing pages, CRM systems, calendars, call systems, automation tools, and analytics platforms;
API tokens, access tokens, refresh tokens, webhook identifiers, permissions, and integration settings needed to provide the service.

Octaboo only accesses connected channel data based on the permissions granted by the relevant customer or authorized user and only for the purposes described in this Policy and the applicable platform permissions.

4.4 AI Processing Data

Octaboo’s AI agents may process conversation and lead data to:

generate suggested or automated replies;
ask qualification questions;
extract key information from messages;
classify lead intent;
tag and score leads;
summarize conversations;
identify missing data;
route leads to the correct person or team;
prepare sales-ready prospect profiles;
support reporting and analytics.

Octaboo’s AI agents are intended to support lead qualification and operational efficiency. They are not intended to make legal, medical, financial, credit, employment, or similarly significant decisions about individuals.

Unless separately agreed in writing, Octaboo does not use customer-owned lead conversations or prospect data to train general-purpose AI models owned by Octaboo or third-party providers. Where third-party AI infrastructure is used, Octaboo applies appropriate contractual, technical, and organizational controls designed to protect customer data.

4.5 Technical, Device, and Usage Data

Octaboo may collect:

IP address;
device type;
browser type;
operating system;
login time;
session logs;
pages visited;
features used;
workspace activity;
error logs;
API logs;
cookie identifiers;
approximate location based on IP address;
security and audit logs;
performance, diagnostic, and analytics data.

4.6 Payment and Billing Data

Where applicable, Octaboo may collect billing contact details, invoices, subscription plan, payment status, tax information, and transaction references. Payment card data may be processed by third-party payment processors and may not be stored directly by Octaboo except where legally and technically required.

4.7 Data Provided Through Support or Sales Communications

When you contact Octaboo, we may collect the content of your emails, calls, meetings, chats, support tickets, demos, forms, or other communications.

5. Sensitive Personal Data

Octaboo is not designed to intentionally collect sensitive personal data unless a customer’s specific use case requires it and the customer has a lawful basis to collect and process such data.

Sensitive personal data may include health data, biometric data, religious beliefs, political opinions, national identification numbers, financial information, children’s data, or other data treated as sensitive under applicable law.

Business customers must not upload, request, or process sensitive personal data through Octaboo unless:

it is strictly necessary for their lawful business purpose;
they have obtained all required notices, consents, permits, and approvals;
the processing complies with Egyptian law, GDPR where applicable, and any sector-specific rules;
they have informed Octaboo where additional safeguards are required.

Octaboo reserves the right to suspend or restrict processing that appears unlawful, excessive, sensitive, unsafe, or inconsistent with this Policy or the applicable service agreement.

6. Purposes of Processing

Octaboo may process personal data for the following purposes:

to create, operate, and secure user accounts;
to provide access to the Octaboo platform;
to connect and manage lead sources and integrations;
to centralize messages and lead inquiries into one inbox;
to enable AI agents to respond, qualify, summarize, tag, score, and route leads;
to create and maintain prospect directories and lead profiles;
to support sales handoff, assignment, ownership, and workflow automation;
to provide dashboards, analytics, reports, audit trails, and performance insights;
to manage white-label and multi-client workspaces;
to provide onboarding, customer support, troubleshooting, and training;
to improve product performance, reliability, usability, and security;
to send operational notifications, service messages, and platform updates;
to send marketing communications where permitted by law or consented to;
to manage billing, subscriptions, contracts, and payments;
to detect, prevent, and investigate fraud, misuse, unauthorized access, spam, and security incidents;
to comply with applicable laws, regulatory requirements, platform policies, court orders, and lawful requests;
to establish, exercise, or defend legal claims;
to enforce Octaboo’s agreements, terms, policies, and acceptable use rules.

7. Legal Bases for Processing

Depending on the context and applicable law, Octaboo may rely on one or more of the following legal bases:

Consent: including consent to receive marketing communications or connect third-party integrations;
Contract: performance of a contract or pre-contractual steps;
Legal Obligation: compliance with legal obligations;
Legitimate Interests: including platform security, service improvement, fraud prevention, customer support, business operations, and analytics, provided such interests are not overridden by the rights and freedoms of individuals;
Vital Interests: protection of vital interests, where strictly necessary;
Public Interest: public interest or official authority, where legally applicable;
Explicit Consent: or another legally recognized basis where sensitive personal data is processed.

Where Octaboo acts as a processor for a business customer, the business customer is responsible for establishing the lawful basis for collecting and processing the relevant lead, prospect, or end-customer data.

8. AI Agents and Automated Processing

Octaboo uses AI-powered features to assist with lead response, qualification, scoring, tagging, summarization, routing, and reporting.

These features may involve automated analysis of messages and lead attributes. The purpose is to help business customers respond faster, organize lead data, and prioritize follow-up.

AI outputs may not always be accurate or complete. Business customers are responsible for configuring playbooks, scripts, guardrails, approval modes, escalation rules, and human review standards appropriate to their business, industry, and legal obligations.

Octaboo recommends human review for high-risk conversations, sensitive inquiries, regulated industries, complaints, pricing commitments, contractual statements, financial decisions, medical claims, legal advice, and any communication that may materially affect a person’s rights or obligations.

Octaboo does not intend AI scoring or routing to produce legal or similarly significant effects without human involvement.

9. Data Sharing and Disclosure

Octaboo may share personal data with the following categories of recipients, only where necessary and lawful:

the business customer that owns or controls the relevant workspace;
authorized users within the relevant workspace;
agency customers and their client workspaces, where applicable;
service providers supporting hosting, cloud infrastructure, databases, AI processing, analytics, monitoring, communications, payments, CRM, customer support, security, and development;
third-party platforms connected by the customer, including Meta, WhatsApp, Instagram, Facebook, Messenger, Google, email, CRM, calendar, calling, advertising, and automation providers;
professional advisors, including legal, tax, accounting, audit, and compliance advisors;
regulators, courts, law enforcement, and government authorities where required by law;
successors or potential successors in the event of merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction;
other parties where the user or business customer has instructed or consented to the sharing.

Octaboo does not sell personal data.

Octaboo does not disclose customer lead data to advertisers, data brokers, or unrelated third parties for their own independent marketing purposes.

10. Meta, Facebook, Instagram, Messenger, and WhatsApp Data

Where a business customer connects Meta, Facebook, Instagram, Messenger, or WhatsApp Business integrations to Octaboo, Octaboo may process permitted platform data to provide the requested service.

Such data may include Page, account, business, message, comment, lead form, engagement, profile, permission, and webhook data, depending on the integration and permissions granted.

Octaboo processes Meta and WhatsApp data only to:

receive and centralize messages, comments, leads, and inquiries;
enable authorized users to view, respond to, and manage conversations;
allow AI agents to support qualification and routing;
create prospect profiles and summaries;
provide analytics, reporting, audit logs, and workflow automation;
maintain security, troubleshoot issues, and comply with platform requirements.

Octaboo does not sell Meta Platform Data.

Octaboo does not use Meta Platform Data for purposes that are not clearly described in this Policy or not permitted by Meta’s applicable terms.

Meta Data Deletion Instructions

Users may request deletion of personal data received from or processed through Meta, Facebook, Instagram, Messenger, or WhatsApp integrations by contacting:

Email: privacy@octaboo.com or contact@metas.us
Subject: Meta Data Deletion Request

The request should include, where available:

full name;
email address;
phone number;
Facebook Page name or ID;
Instagram handle;
WhatsApp Business number;
Octaboo workspace or company name;
description of the data to be deleted.

After receiving a verifiable deletion request, Octaboo will delete or anonymize the relevant personal data unless retention is required by law, security, fraud prevention, dispute resolution, backup integrity, or legitimate business obligations.

Where technically available, Octaboo may also provide a dedicated data deletion URL for Meta app review and user deletion requests.

11. Google API and Google User Data

Where a business customer or user connects Google services to Octaboo, Octaboo may access Google user data only after the user grants permission through Google’s authorization process.

Google data may be used only for the user-facing functionality that the customer enabled, such as login, email connection, calendar handoff, reporting, CRM workflow, or other approved integrations.

Octaboo’s use of information received from Google APIs complies with the Google API Services User Data Policy, including applicable Limited Use requirements.

For Google Workspace APIs, where applicable: *“The use of information received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.”*

Octaboo does not use Google user data for advertising.

Octaboo does not sell Google user data.

Octaboo does not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with law, protect security, or as part of a merger, acquisition, or sale of assets where legally permitted.

Octaboo does not allow humans to read Google user data unless:

the user has given explicit consent for a specific purpose;
it is necessary for security, abuse prevention, or troubleshooting;
it is required by law;
the data has been aggregated or anonymized so that it no longer identifies an individual.

Users may revoke Octaboo’s Google access through their Google account permissions or by contacting Octaboo for assistance.

12. Cookies and Similar Technologies

Octaboo may use cookies, pixels, local storage, SDKs, analytics tools, and similar technologies to:

operate the website and platform;
keep users logged in;
remember preferences;
measure performance;
analyze usage;
improve product experience;
detect fraud and security threats;
support marketing and attribution where legally permitted.

Users may control cookies through browser settings or available cookie management tools. Disabling certain cookies may affect the availability or performance of some services.

Where required by law, Octaboo will request consent before using non-essential cookies.

13. Marketing Communications

Octaboo may send marketing, product, educational, event, partnership, or promotional communications to business contacts where permitted by law or consented to.

Users may unsubscribe or object to marketing communications at any time by using the unsubscribe link, adjusting preferences, or contacting Octaboo.

Even after unsubscribing from marketing messages, users may still receive essential service, security, legal, billing, or transactional communications.

14. Data Retention

Octaboo retains personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law, contract, security, dispute resolution, audit, tax, accounting, or platform requirements.

Retention periods may vary depending on the type of data:

account data may be retained while the account remains active and for a reasonable period afterward;
lead and conversation data may be retained according to the customer’s workspace settings, service agreement, or Data Processing Agreement;
billing and tax records may be retained as required by applicable law;
security logs may be retained for fraud prevention, audit, and incident response;
backup copies may remain for a limited period until overwritten or securely deleted;
anonymized or aggregated data may be retained indefinitely where it no longer identifies an individual.

Customers may request custom retention settings where supported by the platform and agreed in writing.

15. Data Security

Octaboo applies reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include: access controls; role-based permissions; workspace separation; authentication controls; encryption in transit and, where applicable, at rest; secure hosting; audit logs; monitoring and alerting; backup procedures; staff access restrictions; vendor due diligence; incident response procedures.

However, no electronic transmission, storage system, platform, or integration can be guaranteed to be completely secure. Users and customers are responsible for protecting their login credentials, managing user permissions, and ensuring that connected accounts are secure.

16. International Data Transfers

Octaboo may process, host, store, or transfer personal data inside or outside Egypt, including through cloud hosting, infrastructure, support, analytics, communication, AI, and integration service providers.

Where personal data is transferred internationally, Octaboo will take appropriate legal, contractual, technical, and organizational measures designed to protect such data in accordance with applicable law.

Where GDPR applies, transfers outside the European Economic Area may be protected through mechanisms such as adequacy decisions, standard contractual clauses, supplementary safeguards, or other legally recognized transfer mechanisms.

Business customers are responsible for ensuring that their own use of Octaboo, including cross-border transfer of lead or customer data, complies with applicable laws.

17. Data Subject Rights

Subject to applicable law and verification requirements, individuals may have the right to:

request access to their personal data;
request correction of inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
object to certain processing activities;
withdraw consent where processing is based on consent;
request portability of personal data where applicable;
object to direct marketing;
request information about automated processing;
lodge a complaint with the competent data protection authority.

Requests may be sent to:

Email: info@octaboo.com
Subject: Privacy Rights Request

Octaboo may need to verify the requester’s identity before responding.

Where Octaboo acts as a processor for a business customer, Octaboo may forward the request to the relevant business customer or act according to that customer’s lawful instructions.

Octaboo may refuse or limit a request where permitted by law, including where fulfilling the request would conflict with legal obligations, security requirements, fraud prevention, platform integrity, third-party rights, confidential business information, or the establishment, exercise, or defense of legal claims.

18. Business Customer Responsibilities

Business customers using Octaboo are responsible for:

providing lawful privacy notices to their leads, prospects, and customers;
obtaining valid consent where required;
ensuring that connected channels are used lawfully;
ensuring that imported data was lawfully collected;
configuring AI scripts, qualification questions, routing rules, and automation in a lawful and appropriate manner;
avoiding collection of unnecessary or excessive personal data;
not uploading unlawful, sensitive, or prohibited data;
responding to data subject requests where they are the controller;
ensuring that their team members use Octaboo only for authorized business purposes;
maintaining accurate user permissions and workspace access controls;
complying with Meta, WhatsApp, Google, CRM, email, advertising, and other third-party platform terms.

Octaboo may suspend or restrict accounts that violate this Policy, applicable law, or third-party platform rules.

19. White-Label and Agency Use

Octaboo may provide white-label or multi-tenant services that allow agencies or partners to operate client workspaces under their own branding.

In such cases:

the agency or partner remains responsible for its client relationship and legal disclosures;
the agency or partner must not misrepresent Octaboo’s role or the nature of the service;
the agency or partner must ensure that its clients and end users receive appropriate privacy notices;
Octaboo may process data as a processor or subprocesser depending on the contractual arrangement;
the agency or partner must ensure that each client workspace is properly separated and accessed only by authorized users.

20. Third-Party Services and Links

Octaboo may integrate with or link to third-party platforms, websites, APIs, CRMs, payment processors, advertising networks, communication tools, social platforms, AI providers, and analytics services.

These third parties may have their own privacy policies, terms, and data practices. Octaboo is not responsible for the privacy practices of third parties that are not acting as Octaboo’s processors or service providers.

Users and customers should review the privacy policies and terms of any connected third-party services.

21. Children’s Privacy

Octaboo is intended for business use and is not directed to children.

Octaboo does not knowingly collect personal data from children under the age of eighteen (18), unless such processing is lawfully carried out by a business customer with all required consents and safeguards.

If Octaboo becomes aware that a child’s personal data has been processed unlawfully, Octaboo may delete or restrict such data.

22. Data Breach and Incident Notification

If Octaboo becomes aware of a personal data breach affecting personal data processed by Octaboo, Octaboo will take reasonable steps to investigate, contain, mitigate, and remediate the incident.

Where required by applicable law or contract, Octaboo will notify affected customers, users, regulators, or individuals within the legally required timeframe.

Customers are responsible for notifying their own leads, prospects, customers, regulators, or other parties where they are the controller and such notification is required by law.

23. Changes to This Policy

Octaboo may update this Privacy Policy from time to time to reflect changes in law, technology, platform requirements, services, integrations, security practices, or business operations.

The updated version will be published on Octaboo’s website or platform with a revised “Last Updated” date.

Where legally required, Octaboo will provide additional notice or request consent for material changes.

Continued use of Octaboo after the updated Policy becomes effective means that the user or customer acknowledges the updated Policy, subject to applicable law.

24. Contact and Complaints

For privacy questions, data requests, deletion requests, Meta data deletion requests, Google data requests, or complaints, contact Octaboo at:

Email: info@octaboo.com
Phone: +20 (0)35 415 990 / +20 (0)155 559 3762
Egypt Address: 149 Ahmed Shawqi St., Roushdy, Alexandria, Egypt – 21531
Oman Address: Muscat Governorate, Al Amrat, Madinat Al Nahathah, Block 452, Street 5529, Building 2100

Octaboo will review privacy requests and complaints within a reasonable period and in accordance with applicable law.

25. Language

This Privacy Policy may be published in English, Arabic, or other languages. In case of conflict between versions, the controlling version shall be: "Octa-Ar-1.0"