Home
Draft. This text is still under legal review and may change before the final version.

Privacy policy

Last updated: October 1, 2026

Mawgood is a product of Aurano Technology (OPC), a company registered in Egypt ("Aurano", "we"). This policy explains what data we collect when you use Mawgood, what we use it for, who we share it with, and how you can get a copy of it or have it deleted.

Who is responsible for the data

  • Your account and workspace data (business owners and their teams): Aurano is responsible for it (the controller).
  • The business's customers' data (people who message the business on WhatsApp, Instagram and Messenger): the business is responsible for it, and Aurano processes it on the business's behalf and instructions so Mawgood can reply (the processor). If you are a customer of a business that uses Mawgood, contact that business first; we will help it answer your request.

Data we collect

  • Account and team: name, email, password (stored with one-way hashing) or Google sign-in, role in the team, and which agents each member can see.
  • Business and agents: the business name, type and links, and each agent's settings (name, tone, working hours, instructions).
  • Conversations and contacts: customer messages and replies from Mawgood and the team on WhatsApp, Instagram and Messenger, voice notes, images and files, the customer's id on each channel (WhatsApp number, Instagram or Messenger id), their name, and notes and tags the business's team adds.
  • Orders, bookings and leads: products, address, delivery area, appointment times, and contact details the customer gives.
  • Knowledge files: files and links the business uploads so Mawgood can learn from them (price lists, menus, FAQs).
  • Payments: we use Paymob. We never see or store card numbers. We keep metadata only: card brand and last 4 digits, Paymob's token for a saved card (encrypted), and the amounts and status of invoices, payments and payment links.
  • Connected services: when a business connects Meta, Shopify, Google Calendar or Paymob, we store access tokens encrypted and read only what the feature needs (catalog, calendar, messages).
  • Technical data: IP addresses and error and performance logs, to protect and fix the service. We don't write message text, passwords or tokens to logs.

How we use data

  • To run Mawgood: receive messages, let the agent reply, take orders and bookings, and hand conversations to the team.
  • To bill the subscription and credits, and send invoices and alerts.
  • To protect the service from abuse and fraud, fix problems and improve reply quality.
  • We don't sell data, and we don't use the business's customer conversations for advertising. We don't train general-purpose AI models on your data.

AI

Mawgood writes its replies with AI models from outside providers (OpenRouter and Google Gemini). We send the model only the part of the conversation and the business's knowledge it needs to write the reply. Replies can be wrong; the business can review them and hand any conversation to its team.

Who we share data with (service providers)

We share data only with the providers the service needs, under contracts that require them to protect it:

  • Meta (WhatsApp, Instagram, Messenger) and YCloud (our WhatsApp partner that pays Meta's fees for us): delivering messages.
  • Paymob: subscriptions, credits and payment links.
  • Google: sign-in, Google Calendar for bookings, and Gemini models.
  • Shopify: catalog and orders, when the business connects it.
  • Resend: sending email.
  • Cloudflare R2: file storage.
  • MongoDB Atlas: the database, [Frankfurt or Bahrain, to be decided].
  • Railway: application hosting.
  • OpenRouter and Google Gemini: AI models.

We may disclose data when the law or a court requires it.

Transfers outside Egypt

Some of these providers store or process data outside Egypt (for example in the EU and the US). We transfer data with the safeguards the law requires. [Lawyer: licences or permits needed for cross-border transfers under Law No. 151 of 2020.]

How long we keep data

  • Chat messages: 24 months by default. The workspace owner can change this to 12 or 36 months or "forever" in Settings › Data & privacy. Older messages are deleted automatically every day; orders and bookings are kept.
  • Raw deliveries from the messaging platforms: 30 days.
  • Data export files: 24 hours after they are ready.
  • Setup calls with the Mawgood team: the name, email and phone number (and business name and notes) you give when booking are deleted automatically 24 months after the call time.
  • Account and settings: while the account is active, and [period set by the lawyer] after it is closed.
  • Invoices: as long as Egyptian tax law requires [set by the lawyer].
  • Backups: deleted automatically within [backup retention period].

Your rights

You can ask to know what data we hold about you, get a copy, correct it, delete it, or object to or restrict its processing.

  • Workspace owners can download a copy of all of the workspace's data in Settings › Data & privacy; the file arrives by email.
  • Deletion requests from Meta: if Meta sends us a request to delete your data (for example after you remove our app in your Facebook settings), we delete the contact, conversations and messages linked to your id in every business, remove the name, phone number and address from orders and bookings the business must keep for its accounts, and show the request's status on a page with a confirmation code.
  • Customers of a business can also ask the business itself, or us at the email below, to delete their data.
  • Any other request: email [email protected] and we will reply within [the legal deadline].

Security

Connections are encrypted (HTTPS), access tokens and secrets are encrypted at rest, each team member sees only what their role allows, and Mawgood's admin panel requires two-factor sign-in and logs every action. If a breach affects your data, we will tell you and the authorities within the deadlines the law sets.

Egypt's Personal Data Protection Law

We process data under Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations. We collect data for specific, stated purposes, keep only what we need, and keep it only as long as necessary. You can file a complaint with the Personal Data Protection Center. [Lawyer: the licence or permit Aurano needs, and a data protection officer if required.]

UK GDPR

When we offer the service in the United Kingdom, we process data under the UK GDPR and the Data Protection Act 2018:

  • Lawful bases: performing our contract with the business, legitimate interests (protecting and improving the service), legal obligation (invoices), and consent where it is required.
  • Our role: controller for account data, and processor for the business's customers' data under a data processing agreement [to be prepared by the lawyer].
  • International transfers: with safeguards such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses.
  • Your rights: access, rectification, erasure, restriction, objection and portability, and a complaint to the Information Commissioner's Office (ICO).
  • [Lawyer: a UK representative under Article 27, if required.]

Children

Mawgood is a service for businesses and is not directed at children.

Changes to this policy

If we change this policy in a meaningful way, we will email workspace owners in good time before it applies and update the "Last updated" date above.

Contact us

Aurano Technology (OPC), [registered company address], Egypt. Email: [email protected].