Privacy policy
JAWEBNI is a sales assistant that replies, on behalf of a shop (the "Seller"), to the messages received on its Facebook Messenger and Instagram pages. This policy explains which data we process, why, for how long, and what your rights are, whether you are a Seller using JAWEBNI or a customer writing to a shop equipped with JAWEBNI.
1. Who is responsible
The JAWEBNI service is operated by MAGIC CITY SNEAKERS, MG N°2 Rés. Sila 4, Lot STKE, La Soukra, 2036 Ariana, Tunisia. For any question or request about your data: [email protected].
2. Which data we process
2.1 If you are a Seller (JAWEBNI account)
- Account data: name, e-mail address, phone number, shop name.
- Meta data needed for the connection: the ID and name of your Facebook page, the ID of your professional Instagram account, and the access token ("page access token") that Meta gives us with your authorisation.
- Your catalogue: products, prices, sizes, stock, links, imported from Shopify, WooCommerce, PrestaShop, a Google Sheet or an Excel / CSV file, or typed by hand. Your shop's keys and access tokens are stored encrypted and are never displayed.
- What the automatic analysis finds on your site, your Facebook / Instagram page and your shop settings (delivery fees and times, exchanges, opening hours, FAQ), with the source of each piece of information. Nothing is used before you confirm it.
- Your settings and your policy: delivery fees and times, address, opening hours, exchange, refund and payment rules, public promo codes, reply texts.
- With your explicit permission, your past conversations with your customers (see 2.3).
- Billing and usage data: chosen plan, number of conversations handled, technical logs.
2.2 If you are a customer writing to a shop
- The content of the messages you send to the shop's page: text, photos, voice notes, and the technical identifier Meta assigns to your conversation with that page ("PSID"). We do not receive your Facebook profile or your friends list.
- If you place an order in the conversation: your name, your phone number, your governorate and delivery address, and the products ordered. If the shop has enabled it, the order is also created in its online shop (Shopify or WooCommerce); if it ships the parcel, this information is passed to its courier.
2.3 Reading the inbox history (with consent)
The Seller can tick "Learn from my past conversations". Only in that case does JAWEBNI read, read-only, the page's conversation history through Meta's official API. Before any analysis and before anything is stored, customers' names, phone numbers, e-mails, addresses, order numbers and links are masked. Raw messages are only held in memory for the duration of the analysis; we keep only rules (delivery, exchanges…), frequently asked questions and reply examples without personal data. The Seller can withdraw consent at any time by unticking the box, and ask for what was learned to be deleted.
3. Why (purposes)
- Replying to customers' messages on behalf of the shop (price, availability, delivery, order).
- Passing orders and serious requests (complaints, refunds) to the shop and, if it has enabled it, to its online shop or its courier.
- Suggesting the Seller's settings (delivery, exchanges, hours, FAQ, style) from the Seller's own sources, which the Seller confirms or not.
- Letting the shop re-read, correct and take over any conversation.
- Billing the Seller according to the number of conversations.
- Keeping the service secure and working properly.
We do not use customers' data for advertising, we do not sell it and we do not share it with other shops.
4. Meta platform data
JAWEBNI only uses Meta's official APIs (Messenger Platform and Instagram Messaging) and complies with the Meta Platform Terms. The data received from Meta (messages, page and conversation IDs, access token) is used exclusively to provide the service to the Seller who connected the page. It is never resold, never used to build advertising profiles, and is deleted when the Seller disconnects the page or closes the account (see the Data deletion page). If Meta informs us that a user has withdrawn their authorisation, we delete the corresponding data.
5. Processing by providers (processors)
- Hosting and database: Cloudflare (European Union servers, Western Europe region).
- Artificial-intelligence models: the assistant's replies are generated by AI model providers (for example models reached through OpenRouter, or Google), chosen for data protection: no retention and no training on your customers' content. To draft a reply, the text of the customer's messages (and, where relevant, the photo sent) is passed to them. We send only what is needed and we do not pass on the customer's name, phone number or address when the reply does not require it. The analysis of past conversations only sends them texts that are already anonymised.
- Catalogue and orders: Shopify, WooCommerce, PrestaShop or Google Sheets, depending on what the Seller connected.
- Delivery: the courier chosen by the Seller (today First Delivery), when an order is shipped.
- E-mails and alerts to the Seller: an e-mail sending service (Resend or Brevo) and Telegram, if the Seller enabled them.
These providers may be located outside Tunisia. We choose providers that contractually commit to protecting the data.
6. For how long
- Conversations and orders: kept while the Seller's account is active, so that the Seller can re-read them; deleted at the latest 30 days after the account is closed or the page disconnected.
- Meta access tokens: deleted immediately when the page is disconnected.
- Shop keys and tokens (Shopify, WooCommerce, PrestaShop): deleted when the shop is disconnected or the app uninstalled.
- Account and billing data: kept for the life of the account, then for as long as legal and accounting obligations require.
- Technical logs: 90 days at most.
7. Your rights
Under Tunisian Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data, you have a right of access, rectification, objection and deletion of your data. To exercise it, write to [email protected]; we answer within 30 days. You may also refer the matter to the National Authority for the Protection of Personal Data (INPDP). If you are a customer of a shop, you can also ask the shop directly: it can delete your conversation from its app. For a Shopify shop, the deletion requests passed on by Shopify (a customer's or the shop's data) are handled automatically.
8. Security
Data is transmitted encrypted (HTTPS) and stored with a host that encrypts data at rest. Access is limited to the people who need it to run the service. Meta access tokens and shop keys are encrypted and never displayed. Each account only sees its own data.
9. Minors
JAWEBNI is a service for professionals. We do not seek to collect data from minors; if a customer is a minor, Meta's rules apply to their account.
10. Changes
If this policy changes, the update date above is changed and Sellers are informed by e-mail in case of a significant change.