Privacy Policy — BotOrders

This Privacy Policy explains how BotOrders, developed, operated and maintained by Web and Art (Cairo, Egypt), collects, uses, stores, and protects personal data when you interact with the BotOrders platform through Facebook Messenger, Instagram Direct, or WhatsApp.

BotOrders is a social commerce platform that enables Shop Owners to sell products and receive orders through chat. If you are a customer placing an order through a shop that uses BotOrders, this policy explains your rights. If you are a Shop Owner, this policy also covers the data we process on your behalf.

1. Who We Are

BotOrders is a social commerce platform that enables businesses to sell products and receive orders through Facebook Messenger, Instagram Direct, and WhatsApp.

Operated by: Web and Art
Website: webandart.com
Address: 2/5 El Orouba St., New Maadi, Cairo, Egypt

Web and Art is a Meta Tech Provider and operates BotOrders using the Messenger, Instagram, and WhatsApp Business APIs.

2. Data We Collect

2.1 Customer Data (collected when placing an order)

Name — used to address the customer and label the order.
Mobile phone number — used for delivery coordination and order confirmation.
Email address — used only by BotOrders to send order confirmations to the customer. Not shared with Shop Owners or any third party.
Delivery address — street, building, floor, apartment, area, city, and any notes.
GPS location (geographic coordinates) — collected when the customer shares their location via the delivery address webview, and only when required by the Shop Owner or delivery provider. Used to pin the exact delivery location on a map.

            
            Location Data: GPS coordinates are collected only when the customer actively shares their location through the address form. The coordinates are stored with the order and shared with the Shop Owner and the designated delivery provider. We do not track location continuously or outside of the address submission flow.
        

2.2 Messaging Data (from Meta platforms)

Messenger/Instagram user ID — the platform-assigned identifier used to send messages back to the user.
Message content — text messages sent by the user to the shop's bot, processed to identify intents (browsing, ordering, etc.).

We access only the minimum permissions required: pages_messaging for Facebook, instagram_manage_messages for Instagram, and the WhatsApp Business API for WhatsApp. We do not access your friends list, photos, timeline, or any other personal profile data.

2.3 Shop Owner Data

Business name, contact email, Facebook Page ID, Instagram account ID, WhatsApp phone number.
Product catalog data entered by the Shop Owner.
Order history and reports.
Payment gateway configuration — Shop Owners connect their own Paymob or Fawry business accounts directly. BotOrders stores only the shop's gateway identifier; we do not store card numbers, bank details, or any payment credentials belonging to customers.

Shop Owners are responsible for ensuring that all submitted business information is accurate, lawful, and authorized for use before connecting services to the BotOrders platform.

We reserve the right to review, approve, reject, suspend, or remove integrations or accounts that violate applicable laws, Meta policies, or platform terms.

2.4 Technical / Log Data

Webview interaction logs (page opens, form submissions, errors) — used for debugging and quality assurance.
Server access logs — IP address, timestamp, request path — retained for a reasonable period used for security and debugging.

3. Guest Orders

Customers may place orders as guests without creating a traditional user account.

Information collected during guest checkout is limited to what is necessary to:

Process orders
Provide delivery services
Communicate with customers
Complete transactions

GPS location is collected only when required by the Shop Owner or delivery company. It is never collected automatically or without the customer actively sharing it.

4. How We Use Your Data

Order fulfillment — processing and confirming orders placed through the chat.
Delivery coordination — sharing name, mobile, address, and GPS location with the Shop Owner and delivery provider.
Order coordination — passing order details to the Shop Owner so they can fulfill, invoice, and collect payment directly.
Customer support — responding to issues raised by Shop Owners or customers.
Platform improvement — analyzing aggregated, anonymized usage patterns to improve the service.

We do not use your data for advertising, sell it to third parties, or use it for any purpose beyond operating the platform.

Actual product fulfillment, invoicing, payment processing, delivery, and commercial transactions are handled by the connected Shop Owner or their authorized providers (such as payment gateways and delivery companies).

5. Third Parties We Share Data With

Party	Purpose	Data Shared
Meta Platforms (Facebook/Instagram/WhatsApp)	Messaging API — source of incoming messages and delivery of outgoing responses	Message content and user-scoped IDs as required by Meta's API
Shop Owners	Receiving and fulfilling orders	Name, mobile, address, GPS location, order details
Delivery providers (only when the Shop Owner uses a third-party delivery service)	Shipping and last-mile delivery	Name, mobile, address, GPS location
Payment gateways (Shop Owner's own gateway accounts, e.g., Paymob, Fawry — only when the Shop Owner offers online payment; many shops use Cash on Delivery instead)	Online payment processing initiated by the customer	Order total amount only — no personal data (name, mobile, etc.) is passed to the gateway by BotOrders
Cloud hosting provider (EU-based)	Server infrastructure where data is stored	All Platform Data stored on the server

We do not share data with any party not listed above without your explicit consent, except where required by Egyptian law or a valid legal process.

6. Data Security

We implement industry-standard security measures including:

HTTPS/TLS encryption for all data in transit.
Access controls limiting data access to authorized personnel only.
Encrypted storage of sensitive credentials.
Regular security reviews of our codebase and infrastructure.

No system is 100% secure. If you believe a security incident has occurred, contact us immediately at botprivacy@webandart.com.

7. Data Retention

Customer account data (name, mobile, email, saved addresses): permanently deleted upon account deletion request.
Order records (delivery details, order history at time of placement): retained where required for legal, accounting, tax, fraud prevention, or dispute resolution purposes.
Server logs: retained for less than 30 days.
Webview interaction logs: retained for a short period used for debugging purposes.

Customers 7.1 Self-Service Account Deletion

Customers can now request account deletion directly within the BotOrders chatbot:

Go to 👤 My Account → 🗑 Delete Account
Your account will be marked for deletion with a scheduled deletion date 30 days from the request
During the 30-day grace period: You cannot place new orders or access your account, but you can reactivate anytime
Reactivate your account: Tap 🔄 Reactivate Account before the deadline to cancel the deletion request
After 30 days: Your account, saved addresses, and personal data are permanently deleted
Your order history is preserved in our system for accounting, tax, and delivery tracking purposes

You may also submit a data deletion request using the process described in our Data Deletion page for additional support options.

8. Your Rights

You have the right to:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate data.
Deletion — request deletion of your personal data. Customers can delete their account directly from the chatbot via My Account → Delete Account. For additional support, see our Data Deletion page.

For privacy and data protection matters, please contact us at botprivacy@webandart.com. For general support, use botsupport@webandart.com.

9. Meta Platform Compliance

BotOrders uses the Meta Platform (Facebook, Instagram, WhatsApp) under Meta's Platform Terms and Developer Policies. We comply with:

Meta's Platform Terms
Meta's Developer Policies
WhatsApp Business API Terms of Service

Data obtained via Meta APIs is used solely for the purposes described in this policy and is not transferred to third parties for advertising or data aggregation purposes.

10. Children's Privacy

BotOrders is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at botprivacy@webandart.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of BotOrders after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions, data requests, or concerns:

Web and Art
2/5 El Orouba St., New Maadi, Cairo, Egypt
For privacy and data protection matters: botprivacy@webandart.com
For general support: botsupport@webandart.com
Website: webandart.com