Privacy Policy

Last updated: 15 October 2026

This policy explains how Genfleet LLC (in formation) ("GenFleet", "we", "us") handles personal data when you visit genfleet.ai, use the GenFleet platform, or message a business that uses GenFleet.

1. Who we are

Genfleet LLC (in formation), a limited liability company being formed in Egypt
Nasr City, Cairo, Egypt
Privacy contact: privacy@genfleet.ai

2. Our two roles

GenFleet is a platform that lets businesses ("tenants") run AI agents and connect them to messaging channels such as WhatsApp, Messenger, Instagram, Telegram, Slack and Discord.

We are the controller for data about our own website visitors, our customers' account users, and our business contacts. Part A covers this.
We are a processor for data about the people who message a tenant's agents ("end customers"), and for the content tenants put into the platform. The tenant decides why and how that data is used. Part B covers this.

If you message a business on WhatsApp, Messenger, Instagram or another channel and its replies come from a GenFleet agent, that business is responsible for your data. Its own privacy notice applies. Part B explains what we do on its behalf and how you can still reach us.

Part A: Data we control

A1. Website visitors (genfleet.ai)

What we collect

Demo request form: your work email, role, business function, preferred billing period, plan of interest, and what you want to use agents for.
Developer waitlist form: your email, your GitHub username, plan of interest, and what you are building.
Technical data: when you load our site, our website hosting and security provider receives your IP address, browser details, and the pages you request, and keeps request logs.
Fonts: our website serves its fonts itself, so loading the site sends nothing to a font service.

Why, and on what basis

To answer your demo request or waitlist sign-up (steps you asked us to take before a contract; your consent where the law requires it).
To keep the site running and secure (our legitimate interest in operating a secure website).

Lawful basis (GDPR Art. 6): the demo or waitlist sign-up is taken at your request (Art. 6(1)(b)); the security of the site is our legitimate interest (Art. 6(1)(f)).

Who receives it
Form submissions pass through a form-handling service, which forwards them to our email inbox. Both are described on our Subprocessors page.

Cookies and similar technologies

Our website does not set cookies and does not use analytics or advertising trackers.
It stores one setting in your browser: whether you prefer light or dark mode. It never leaves your device.
Our website security provider may set strictly necessary security cookies if it detects suspicious traffic or shows you a security check. They are used only to protect the site.

A2. Customers and users of the platform

What we collect

Account data: your name, email address, password (stored only in a form that cannot be read back), your company or workspace name and web address, your role in the workspace, and who invited you.
Onboarding data you choose to give: a company description, website, what you plan to use agents for, and a company document (PDF) if you upload one.
Security data: records of sign-ins, password resets and invitations, and an audit trail of actions in your workspace. For actions that change data, the audit trail records who did it, what they did, and their IP address.
Usage data: how many messages and how much AI model use your workspace consumes, how long agents run, and which agents and channels are used. We use this to apply your plan's limits and credits, and for billing.
Connections you set up: when you connect a channel or tool, we store its access credentials in encrypted form. When you connect a Meta channel by logging in with Facebook, we receive your Facebook user ID and name, the Pages and Instagram business accounts you choose to share, and an access token. See section A4.
Support and communications: emails and messages you send us.

Browser storage in the app
The GenFleet app does not set cookies. It keeps your sign-in session, profile, workspace list, display preferences and unsent chat drafts in your browser so you stay signed in and keep your layout. Signing out removes your sign-in session and profile from the browser. Display preferences and unsent drafts stay on your device until you clear your browser storage. The app loads fonts from a web font service. When you connect a Meta channel, the app loads Meta's login window; Meta's privacy policy applies to it.

Why, and on what basis

Purpose	Basis (GDPR)	Basis (Egypt PDPL, Art. 6)
Create and run your account; provide the platform	Contract	Performance of a contract
Security, fraud and abuse prevention; audit trail	Legitimate interests	Legitimate rights of the controller
Plan limits, credits and billing	Contract; legal obligation for tax records	Contract; legal obligation
Service emails (password reset, invitations, security notices)	Contract; legitimate interests	Contract
Improving the platform using aggregated, de-identified statistics	Legitimate interests	Legitimate rights of the controller
Product news and marketing emails	Consent	Prior consent (Art. 17)

We do not send marketing emails today.

A3. Operational logs

Our servers keep logs and metrics so we can run, fix and secure the platform. They mainly hold technical details such as account and agent identifiers, error codes and timings. They do not hold the content of messages. Logs are deleted after 7 days, or may be moved to an archive and deleted after 24 months. Other monitoring data is deleted after at most 15 days. Before raw data expires, we turn it into summary statistics (such as request counts, error rates, response times and tool usage) that contain no names, IDs, IP addresses or message content. We keep those statistics indefinitely to track the platform's health over time.

A4. Data we receive from Meta (Facebook, Instagram, WhatsApp)

Meta's Platform Terms require us to explain this separately.

From the person who connects a Meta channel (a tenant's staff member):

Facebook user ID and name.
The list of Facebook Pages and Instagram business accounts they choose, with their IDs, names and usernames.
A Facebook access token, and Page or WhatsApp Business access tokens.

From people who message a connected Page, Instagram account, or WhatsApp number:

The ID Meta gives them for that Page or Instagram account, or their WhatsApp ID, which is their phone number.
Their WhatsApp profile name, where WhatsApp provides it.
The text of their messages, and references to any media they send. We do not download the media files.
Ad-referral information if they started the chat from an ad or link (for example, the ad ID and headline).

How we use it: only to deliver messages between that person and the business's agent, to let the business manage its channel, and to keep the service secure. We process message data for the business, as its processor (Part B).

What we never do with Meta data: sell or license it, use it to build advertising profiles, use it to train or improve AI models, use it as safety examples (section B1), or share it except with the business concerned and the service providers that help us run the platform.

Deletion: see our Data Retention and Deletion page, which also serves as our Meta data-deletion instructions.

Part B: Data we process for businesses (end customers)

B1. What we process

When a business connects a channel and an agent, we process, on its behalf:

Channel identifiers: your phone number or WhatsApp ID, your Messenger, Instagram, Telegram, Slack or Discord ID, and the chat or channel you wrote in.
Display and profile names the channel provides.
Message content: the text you send and the agent's replies. Media is referenced, not downloaded.
Conversation memory: by default, the agent keeps your conversation for about 24 hours so it can follow the thread, and does not save facts about you. If the business turns on memory about its customers, the agent keeps your conversation history for up to 24 months after your last contact so it can recognise you when you come back. If the business turns memory off again, the stored history is deleted, except messages from the last 24 hours, which are deleted within a day. If the business also allows it, the agent may save short facts it learns (for example, a preference you state) in its general memory, which it uses in all its conversations.
Task progress: if the agent runs a multi-step task for you (for example, an order or a booking), it stores the task's progress.
Tool use: if the agent looks something up or takes an action in the business's systems, we store the request and result. Actions the business marks as sensitive wait for a person's approval, and we keep a record of that approval.
Documents: businesses may give their agents reference documents. These may contain personal data.
Security message log: we keep a copy of incoming messages, with the sender's ID and time, for 12 months so we can investigate attacks, abuse and incidents. It is encrypted and open only to a small number of authorised GenFleet staff.
Safety examples: we may keep short excerpts of conversations, after removing names, phone numbers and other identifiers, to write and test the platform's safety rules. We never take them from Meta channels (WhatsApp, Messenger, Instagram), never use them to train AI models, and do not take them from businesses that opt out.

B2. How AI is involved

The business's agent sends your message, the conversation history, and the business's instructions to a large language model to write a reply. Replies are generated by AI and may contain mistakes. See our AI Transparency Notice.

We do not use your messages to train AI models. The AI Transparency Notice and our Subprocessors page explain which types of model provider receive them and what their terms allow.

Who decides the basis. The business that connects the agent is the controller and must name a lawful basis for each purpose under GDPR Art. 6 and PDPL Art. 6. We process on its instructions.
Source. The data comes from the channel (WhatsApp, Messenger, Instagram, Telegram, Slack or Discord) when you message the business. It is not bought or collected from other sources.
Automated decisions. Agents may answer questions and take actions you ask for, such as checking an order. We do not make decisions with legal or similarly significant effects on you. A business that uses an agent to make such decisions must assess Art. 22 itself and keep a person in the loop, as the AI Transparency Notice says.
Sensitive information. Please do not send health, religious, political, biometric or similar sensitive information to an agent. The platform cannot tell it apart from other messages, so anything you send is stored as part of your conversation. Businesses must not ask for it without a separate agreement with us.

B3. Your rights as an end customer

Contact the business first. It controls your data and must answer your request. We help it do so.

If you cannot reach the business, or you contacted us through a Meta product, write to privacy@genfleet.ai. We will pass your request to the business and act on its instructions. Where Meta's terms or the law require us to delete data directly, we will do so. See the Data Retention and Deletion page.

Service providers (subprocessors) that host our platform, run AI models, send email, or deliver our website. Our Subprocessors page describes each type, with its location. Business customers can ask us for the named list.
Channel and tool providers that a business chooses to connect (for example Meta, Telegram, Slack, Discord, GitHub, Notion). Data passes to them because the business asked for it.
AI model providers a business connects with its own account. If a business uses its own key for a model provider, that provider acts under the business's own agreement with it.
Authorities, when the law requires it.
A buyer or successor, if our business is sold or merged, under the same protections.

We do not sell personal data.

4. International transfers

We are based in Egypt. Our platform is hosted with a cloud provider, in a data centre outside Egypt. Some providers, including AI model providers, operate in other countries, mainly the United States. See the Subprocessors page for where each type of provider operates.

Egypt: under PDPL Art. 14, personal data may leave Egypt only to a country whose protection is at least as strong as Egyptian law, and only with a licence or permit from the Personal Data Protection Center. Art. 15 allows exceptions, including with the person's explicit consent, for listed purposes such as contract performance, legal claims and medical care. Art. 16 allows transfers to a controller or processor abroad under a licence and listed conditions.
Website visitor data: the IP address and browser details that reach our website security provider, and our web font service when you use the GenFleet app, are sent outside Egypt.
EU/UK: we do not offer GenFleet to people in the EU or the UK. If that changes, we will put the European Commission's Standard Contractual Clauses or another lawful safeguard in place before any transfer.

5. How long we keep data

See our Data Retention and Deletion page for each category. In short:

Account data: while your account is open, then deleted normally within 30 days of your request to close it, except the record of which terms you accepted, a closed workspace's legal name (up to 5 years), and records we must keep by law.
Channel conversation history: about 24 hours, unless the business has turned on memory about its customers. Then up to 24 months after you last contacted the business, so the agent can recognise you when you come back.
Facts an agent saved: until the business deletes them.
Security message log: 12 months.
Copies of model requests and replies kept by our AI gateway: deleted after 90 days.
Some records, such as reference documents and dashboard chats, are kept until the business deletes them or the agent.
Logs: 7 days, or up to 24 months in an archive. Backups: 14 days. Summary statistics that do not identify anyone: indefinitely.

6. Security

We isolate each business's agents in separate sandboxes, encrypt stored credentials, use encrypted connections (TLS) for all traffic, store passwords only in a form that cannot be read back, keep our databases off the public internet, and keep an audit trail. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires. Under Egyptian law (PDPL Art. 7), that means the regulator within 72 hours and affected people within 3 working days of that notice. Under GDPR Arts. 33–34, we notify the supervisory authority within 72 hours where required, and notify affected people without undue delay where the breach is likely to result in a high risk to them. We notify business tenants that act as controllers for your data within the period in our Data Processing Agreement, so they can meet their own duties.

7. Your rights

Depending on where you live, you may have the right to:

know what data we hold about you and get a copy;
correct it;
delete it;
restrict or object to its processing;
withdraw consent at any time (this does not affect earlier processing);
be told of a breach that affects your data;
receive your data in a portable format (GDPR);
complain to a regulator.

To use these rights, email privacy@genfleet.ai. We may need to confirm your identity. We respond within 6 working days of receiving your request (PDPL Art. 10 and 32), whichever law applies to you. We do not charge for these requests.

Regulators

Egypt: Personal Data Protection Center (PDPC). You may complain to it if we fail to meet your rights or if you disagree with our decision on your request. It must decide within 30 working days (PDPL Art. 33). Website: portal.pdpc.gov.eg.
EU: your local data protection authority.
UK: the Information Commissioner's Office (ico.org.uk).

8. Children

GenFleet is a business service. It is not meant for anyone under 18, and we do not knowingly collect children's data for our own purposes. Businesses must not use their agents to collect children's data without a separate agreement with us.

9. Changes

We will post changes here and update the date at the top. For material changes, we will tell account owners by email or in the app before they take effect.

10. Language

This policy is published in English. An Arabic version will follow.