Scode provides Scode Automation, a smart business platform that answers businesses' customers in a website chat widget and in messaging channels such as WhatsApp, Instagram and Telegram. This policy explains what information we handle, why, and who it is shared with. It also covers this website.
Two kinds of people in this policy
Business owners are our customers: they create the account, add their business information and connect their channels.
Customers are the people who message those businesses and receive the assistant's replies. The business owner controls their data, and we process it on the owner's behalf and instructions.
Information we collect
- Business account data: name, email address, a password stored in an unreadable encrypted form, team members, and subscription and invoice records.
- Knowledge you add: files, your website's content, questions and answers, and the business information you provide so the assistant can answer accurately.
- Conversations: messages between a customer and the assistant or a member of your team, and the channel identifier used to reach them, such as a WhatsApp number or an Instagram account.
- Contact details customers give: if a customer shares a name, number or email during a conversation, it is kept as a lead for the business they contacted.
- Technical data: IP address, times and request data, used to prevent abuse, limit request rates and diagnose problems.
This website
We measure this website's visits with Google Analytics, to learn which pages are visited most, where visits come from and how often the contact buttons are pressed. This service uses cookies, and we do not use it to identify you.
When you press a WhatsApp button, the conversation moves to WhatsApp and is subject to its terms and privacy policy.
How we use the information
To generate replies, hand a conversation to your team when the assistant cannot help, count AI credit, prepare analytics for the business owner, prevent abuse, and run and protect the service.
We do not sell personal information, and we never use one business's knowledge or conversations to answer for another business.
AI providers and other processors
Replying to a message requires sending the conversation text and the relevant knowledge excerpts to third-party AI providers. We use:
- Google (Gemini): to generate replies.
- Anthropic (Claude) and OpenAI: standby providers, used only if the primary provider is unavailable.
- Voyage AI: to turn text into a form that makes the knowledge searchable.
- Meta: when a business connects WhatsApp, Instagram or Facebook, messages pass through Meta's systems under its own terms and privacy policy.
- Telegram: when a business connects a Telegram bot.
These providers process the content only to return a result, and we do not allow them to use it to train their models.
Where data is stored
Account data, conversations and knowledge are stored on servers we operate, in databases, file storage and a cache. Channel connection data, such as access tokens, is encrypted at rest.
Because the AI providers listed above operate internationally, message content may be processed outside Iraq.
Retention
We keep conversations and knowledge while the business account is active, so the business owner can review their customer service history. Temporarily cached replies expire automatically after a short period. When a business owner closes their account, we delete their data or remove what identifies people, except what the law or accounting requires us to keep.
Your choices
If you are a customer who messaged a business and want your messages or details corrected or deleted, contact that business: it controls this data. If you cannot reach it, write to us and we will help pass on your request.
If you are a business owner, you can export or delete your data from the dashboard, or by writing to us.
Security
Access is limited to each business's own account, channel connection data is encrypted at rest, connections are encrypted, and the system verifies the signature of messages arriving from channels so forged ones are rejected. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Children
The service is meant for businesses and is not directed at children.
Changes to this policy
We may update this policy. Any material change appears in the last updated date above, and we tell business owners directly where appropriate.
Questions about this policy, or a data request: privacy@scode.iq