Privacy Policy
Last updated: 2026-10-16
This explains what data we collect, why, who we share it with, how long we keep it, and how to exercise your rights under Egypt’s Personal Data Protection Law No. 151 of 2020. We collect the minimum needed to provide the service, and we never sell your data.
1. Who we are
The data controller is Youssef Alsherief, operator of BotYalla (https://botyalla.com). For anything about your data: info@botyalla.com.
2. What we collect
- Account data: username, email and phone number (and whether they are verified), age, account type (individual · company · institution), your password stored hashed never in plain text, language preference, and your profile picture or business logo if you upload one. If you sign up with Google or Facebook: only your account ID there, your email and your name — we never see your password there and never post on your behalf.
- Payment data: plan, cycle and amount, payment method and reference, the transfer receipt image, and the result of the automatic receipt check. We never collect bank card data.
- Bot data: settings, texts and templates, and the bot token needed to run it.
- Your end customers’ data: what they send your bot (messages, orders, bookings, names, contact numbers, images, voice notes).
- Technical data: IP address, request path and time, and error messages in server logs.
- Your correspondence with us by email or WhatsApp.
3. Our role for your customers’ data
For your end customers’ data you are the controller and we are a processor acting for you: we process it only to run your bot and show it to you, never for any other purpose, and we never contact your customers on our own. You must inform them and obtain their consent where the law requires it.
If you enable AI replies (“Hybrid” or “AI Brain”), you must tell your customers that replies are automated and may be wrong. It is only enabled with your explicit consent, you can switch back to the flow at any time, and you can step into any conversation and reply yourself from the inbox.
4. Why we use it
- Providing the service, running your bots and fulfilling your subscription — to perform our contract.
- Reviewing payments and keeping accounting records — a legal obligation.
- Protecting the platform, preventing fraud and abuse, rate limiting — a legitimate interest.
- Operational emails (password reset, payment receipts, welcome, expiry reminders, support replies) and important service notices (changes to the terms, maintenance). We send news and offers only if you opt in — at signup or on your Account page — and every such email has a one-click unsubscribe link.
6. Transfers outside Egypt
Some of these parties (Telegram, Meta, AI providers, and possibly the hosting provider) process data outside Egypt. We follow the conditions set by the law and its executive regulations for such transfers, including any required licences and consent.
7. How long we keep it
- Account and bot data: for as long as the account exists, deleted within 30 days of a deletion request or account termination.
- Payment records and receipts: 5 years, as accounting and tax records require.
- Your end customers’ data: until you delete it or the bot or account is deleted. Media not attached to a completed request or a conversation is deleted automatically after 7 days.
- Inbox conversation messages: 12 months from each message, then deleted automatically.
- Your photos and videos in the media library: until you delete them or the account is deleted.
- Password reset links: one hour, single use; we store only a hash of the link.
- Server logs: size-capped rotating files replaced automatically, usually within weeks.
- Backups: 14 days, then deleted.
8. How we protect it
- Encrypted connections (HTTPS), and passwords stored with a one-way hash.
- Permissions read from the database on every request; each business sees only its own bots’ data.
- Payment receipts and customer media are kept outside public files and shown only to their owner.
- Changing your password signs out every other session automatically.
- Protection against request forgery (CSRF), a Content Security Policy, and rate limiting.
- Daily backups whose integrity is checked as soon as they are taken.
9. Your rights
Law No. 151 of 2020 gives you the right to:
- Know what data we hold about you, access it and obtain a copy.
- Correct, update or complete it.
- Have it erased or blocked once its purpose has ended.
- Withdraw your consent at any time.
- Restrict processing to a specific scope and object to processing that breaches your rights.
- Be informed of any breach affecting your data.
You can edit your basic details, download a copy of your data and request account deletion on the Account page; for the other rights write to info@botyalla.com. We may ask you to prove your identity first, to protect you. You also have the right to complain to the Personal Data Protection Centre.
11. Children
The platform is for businesses and not for anyone under 18; we do not knowingly collect their data. If your bot addresses children, you are responsible for obtaining their guardians’ consent.
12. Data breaches
If a breach affects your data we notify the Personal Data Protection Centre within 72 hours of becoming aware of it, as the law requires, and tell you without undue delay what happened and what we have done.
13. Changes to this policy
We tell you about any material change through the platform or by email before it takes effect; the last-updated date appears at the top of this page.
14. Contact
For any request or question about your data: info@botyalla.com · WhatsApp +201281275886.