Privacy & Data Processing Policy
Effective Date: October 2026 · AMHR Marketing Management LLC, Dubai, UAE
1. Scope & Architecture Overview
Artin ("we", "our", or "us") operates the artinagent.com multi-tenant platform (app.artinagent.com, api.artinagent.com) and associated services. This Privacy Policy details our data collection, processing, and storage practices across everything Artin does: AI support and order taking, the smart CRM, follow-ups, campaigns and the content studio.
Operating Entity: AMHR Marketing Management LLC, registered in Dubai, United Arab Emirates.
2. Product-by-Product Data Flows & Processing
Each part of Artin processes only the data it needs for its function:
🛒 AI support & OrderSmart ordering (WhatsApp, Instagram, Telegram & website)
- Processed Data: Customer phone numbers and messaging identifiers, message text, transcribed voice notes, photos sent by customers, product line items, and delivery addresses.
- Purpose: Answering support questions from the business's own knowledge base and converting conversational requests into confirmed orders and invoices synced with the business's inventory.
- Isolation: Each business tenant operates in an isolated PostgreSQL database schema with Row-Level Security (RLS). No customer orders or contacts are shared across tenants.
🗂️ Smart CRM, follow-ups & campaigns
- Processed Data: Customer names, phone numbers, Instagram or Telegram identifiers, conversation history, order history, tags and opt-out status.
- Purpose: Keeping one profile per customer, sending the follow-ups and campaigns the business configures, and honouring opt-out requests (a customer who replies STOP is excluded from further outreach).
📸 Content studio & channel credentials
- Processed Data: Product catalog and knowledge-base text used to draft Instagram captions; channel credentials (WhatsApp, Instagram, Telegram tokens, WooCommerce keys) stored encrypted at rest.
- Purpose: Generating content drafts that the business approves before publishing, and connecting the channels the business chose. Credentials are never shown back in full once saved.
3. AI Model Governance & Zero Training Guarantee
We prioritize absolute enterprise confidentiality. When language models (such as Google Gemini Enterprise API) are utilized for transcription, catalog parsing, or drafting:
- Zero Model Training: Client commercial data, customer messages, catalogs, and pricing structures are never retained or used to train, retrain, or improve underlying public or proprietary AI models.
- Deterministic Execution: Pricing calculations, inventory levels, and discount schedules are executed via deterministic database logic (PostgreSQL), eliminating AI hallucinations in financial transactions.
4. Multi-Tenant Security & Encryption
- Row-Level Security (RLS): Database-level tenant isolation enforces cryptographic tenant ID verification on every single database transaction.
- In-Transit Encryption: All client and API communication requires TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS).
- At-Rest Protection: Databases, offline SQLite caches, and S3 file attachments are protected via AES-256 encryption.
- Session Integrity: Authentication utilizes cryptographically signed RS256 JSON Web Tokens (JWT) with automated rotation.
5. Authorized Sub-Processors
We engage only industry-standard, compliance-certified infrastructure and payment partners:
- Stripe, Inc.: Payment gateway and subscription billing (PCI-DSS Level 1 certified).
- Meta Platforms, Inc. / Cloud API: Encrypted transport for WhatsApp Business interactive messages.
- European Cloud Infrastructure: Dedicated application hosting in ISO 27001-certified German/EU data centers with automated encrypted backups.
- Google Cloud Enterprise AI: Secure API text parsing under strict enterprise zero-data-retention agreements.
6. Data Subject Rights & Contact
In compliance with the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) as well as GDPR principles, business users and end-customers hold the right to access, rectify, export, or request permanent erasure of their stored records.