Privacy policy

Yafta is operated by Mohamed Abdelmaksoud, a sole proprietorship registered in Egypt under commercial register number 273292. We are the controller of the personal data described in this policy.

For any question about this policy, or to exercise any of the rights set out below, write to mohamed@abdelmaksoud.dev.

We collect only what you give us, either to use the service or to contact us.

• Account: your email address and your chosen language. Your password is held by our authentication provider and is not accessible to us.
• Business: its name, country, and a description of your premises generated from photographs you upload.
• Branches: address, telephone number, opening hours and map link.
• Brand: colours, logo, social media handles, WhatsApp number and tone of voice.
• Menu: dish names, prices, descriptions and which dishes sell best.
• Photographs: dishes, premises, menu card, logo, and any image attached to a chat message.
• Conversations: the messages you send in chat and the replies you receive.
• Posts: captions, prices shown, and the images produced.
• Facebook and Instagram: if you connect them, the account details and statistics described in the section below.
• Billing: amount, date and payment method. Card details are held by our payment provider and are not accessible to us.
• Enquiries: if you write to us through the contact form, your name, email address, the name of your business, and what you wrote.

A message sent through the contact form is delivered to our own inbox by email and is not stored in Yafta.

To generate an image or answer a question in chat, Yafta sends your dish photographs, your branch address and telephone number, your prices and your own text to AI providers located in the United States: Google and OpenAI. Your images are stored in Germany, and the application is hosted in Germany.

We do not currently instruct those providers to exclude your data from model training or to delete it after processing. Their standard terms for API customers apply.

Yafta does not train any model on your data, and does not sell or share your data for advertising.

We use the following processors, each handling only what its function requires.

Images are served from public web addresses. Anyone with the link to one of your images can open it, whether or not you have published it.

If you connect a Facebook Page or an Instagram professional account, you do so through Facebook Login for Business, and you choose there which Page, business and Instagram account Yafta may access. Yafta then receives from Meta:

• The identifier, name and follower count of the Page and of the Instagram account you chose.
• An access token that lets Yafta publish to that Page and account on your behalf.
• The Page's recent posts, so that you can see them in Yafta.
• Statistics for the posts Yafta published for you: views, reach, reactions, comments, shares, clicks and saves.

We use this information only to publish the posts you approve, to edit or remove them when you ask, to show you which account Yafta publishes to and what is on your Page, and to show you how each post performed. It is visible only to your account. We do not sell it or use it for advertising.

Where Yafta holds an access token, it is stored encrypted. Nothing is published unless you approve that specific post.

To stop Yafta's access, open Accounts in Yafta, choose the account, and select Disconnect. This deletes the access token and the account details immediately. You can also remove Yafta from your Facebook settings, under Business integrations. To have the posts Yafta published and their statistics deleted as well, write to mohamed@abdelmaksoud.dev and we will delete them within thirty days.

We keep your data for as long as your account exists.

• Deleting a dish, photograph, post or conversation removes it from your view but retains the underlying record, so that billing history and support requests remain accurate.
• Photographs attached to a chat message but never sent are deleted within twenty-four hours. Photographs in messages you sent are retained.
• Records of what was generated are retained indefinitely. These include the exact text sent to the AI provider, which can contain your address, telephone number and prices.
• Billing records are retained indefinitely, as accounting records.
• Messages sent through the contact form live in our email, as the record of that enquiry and of how we answered it.

Yafta does not currently offer a self-service option to delete your account and erase your data. To have it removed, write to mohamed@abdelmaksoud.dev and we will carry it out.

You may request a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to mohamed@abdelmaksoud.dev and we will respond within thirty days.

If you are in the European Union or the United Kingdom, you may also lodge a complaint with your national data protection authority. If you are in Egypt, that authority is the Personal Data Protection Centre.

Your account has access only to its own data, and this is enforced by the database rather than by the application.

Our staff can access any account in order to answer a support request or investigate a failed post. Such access is logged.

If a court, a regulator or another public authority asks us for your personal data, we review whether the request is lawful before answering it, disclose only the minimum the request requires, and keep a record of the request and of what we provided.

We have not provided personal data to any public authority in response to a national security request in the past twelve months.

Yafta uses three cookies, none of which are used for advertising.

• One records your chosen language.
• One records the country you are visiting from, so that prices are shown in the appropriate currency.
• One keeps you signed in.

We use Vercel Analytics to count page views. It does not use cookies to track you across other websites.

Access to your data is restricted at the database level, connections are encrypted, and passwords are held by our authentication provider rather than by us.

If your personal data is exposed, we will notify you and the relevant supervisory authority within seventy-two hours of becoming aware of it.

Yafta is a tool for businesses and is not intended for anyone under the age of 18. We do not knowingly collect data from children.

The date at the top of this page records when this policy last changed. We will notify you of any change that materially affects you.