Information We Collect

To provide you with the best experience on Thikaa, we collect certain information. Here's what we gather and why:

How We Use Your Information

We use your data to deliver and improve Thikaa's services:

• Service Delivery: Power your AI chatbots, process messages, and run automations
• Platform Improvement: Enhance our AI models, features, and user experience
• Customer Support: Respond to your inquiries and provide technical assistance
• Security: Detect fraud, prevent abuse, and protect your account
• Communications: Send important updates, product announcements, and billing information
• Analytics: Generate insights and reports for your business performance
• Legal Compliance: Meet regulatory requirements and respond to legal requests

WhatsApp & Messaging Data

As a WhatsApp Business API partner and direct integration provider, we handle messaging data with extra care:

• Message Processing: Messages are processed in real-time to enable AI responses and automations
• Chat Extraction: When you use our WhatsApp extraction feature, your chat history is used solely to train YOUR AI
• Data Isolation: Your conversation data is completely isolated and never shared with other users
• End-to-End Security: We maintain encrypted connections with all messaging platforms
• Meta Compliance: We fully comply with Meta's Platform Terms and WhatsApp Business Policy

Data Security

We implement enterprise-grade security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Secure Infrastructure: Hosted on secure cloud servers with 24/7 monitoring
• Access Controls: Strict role-based access with multi-factor authentication
• Regular Audits: Periodic security assessments and vulnerability testing
• Data Backups: Automated encrypted backups with disaster recovery procedures
• Incident Response: Dedicated team ready to address any security concerns

Information Sharing

We never sell your personal data. We may share information only in these circumstances:

• Service Providers: Trusted partners who help us deliver our services (AI providers like OpenAI, Anthropic, Google; cloud hosting; payment processors)
• Platform Integrations: When you connect third-party services like Salla, Shopify, or social media platforms
• Legal Requirements: When required by law or to protect our rights and users' safety
• Business Transfers: In case of merger, acquisition, or sale (with prior notice)
• With Your Consent: For any other purpose with your explicit permission

Your Rights

You have full control over your data. Exercise these rights anytime:

Cookies & Tracking

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality (authentication, security)
• Analytics Cookies: Help us understand how you use Thikaa to improve our services
• Preference Cookies: Remember your settings and language preferences

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

Data Retention

We retain your data only as long as necessary:

• Active Account: Data is retained while your account is active
• After Cancellation: Most data is deleted within 30 days of account closure
• Legal Requirements: Some data may be retained longer for legal compliance
• Backups: Backup data is purged within 90 days of deletion

International Data Transfers

Thikaa is operated by Deepthink Data LLC, with offices in Manama, Kingdom of Bahrain and Delaware, USA. Your data may be processed outside your country in order to deliver the service. Every transfer is covered by a written agreement containing standard contractual clauses, and we transfer only the minimum data the service actually needs.

• Saudi Arabia: transfers of personal data outside the Kingdom are made only on the grounds permitted by the Personal Data Protection Law and its Implementing Regulations — where the destination provides an adequate level of protection, or under appropriate safeguards following a transfer risk assessment. Transfers never prejudice national security or the vital interests of the Kingdom
• Bahrain: transfers are made to countries listed as providing adequate protection, or otherwise on a lawful ground under the Personal Data Protection Law No. 30 of 2018, including with the authorisation of the competent Authority or your explicit consent
• Sub-processors: our cloud hosting, AI model, payment and messaging providers are bound by written data processing terms. A current list is available on request from privacy@thikaa.com
• Data residency: if your organisation requires data to stay in a specific country, contact us before subscribing — we will tell you honestly whether we can meet that requirement

Saudi Arabia — Personal Data Protection Law

If you are in the Kingdom of Saudi Arabia, we process your personal data in accordance with the Personal Data Protection Law (Royal Decree No. M/19) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA).

Why we are allowed to process your data

• Performance of a contract — running the account and the service you subscribed to
• Your consent — for marketing messages and any optional feature; you may withdraw it at any time without affecting what we did before you withdrew
• Legal obligation — tax, invoicing and record-keeping duties
• Legitimate interests — only where the law permits it, only after weighing your rights, and never for sensitive data

Your rights under the Saudi PDPL

• Right to be informed of the legal basis and purpose of collecting your data
• Right of access to your personal data held by us
• Right to obtain a copy of your data in a readable, commonly used format
• Right to request correction, completion or updating of your data
• Right to request destruction of data that is no longer needed, subject to records we must keep by law
• Right to withdraw consent at any time

Sensitive data, marketing and children

• We do not seek health, credit, genetic or biometric data, and we do not use personal data for advertising without your separate consent
• Every marketing message carries a clear way to stop receiving it
• We do not knowingly collect the data of anyone under 18

Breaches and complaints

• If a breach occurs that may cause you harm, we notify SDAIA within 72 hours of becoming aware of it and inform you without undue delay
• You may contact our data protection contact at privacy@thikaa.com, and you have the right to lodge a complaint with SDAIA if you are not satisfied with our response

Bahrain — Personal Data Protection Law

Deepthink Data LLC is established in the Kingdom of Bahrain, so our processing is governed by the Personal Data Protection Law (Law No. 30 of 2018) and supervised by the competent Personal Data Protection Authority.

Your rights under the Bahrain PDPL

• Right to be notified before your data is processed, and to know who processes it and why
• Right of access to your data and to information about its sources and recipients
• Right to object to processing likely to cause you damage or distress
• Right to object to automated decisions — you may ask that a decision which significantly affects you not be based solely on automated processing, and ask for it to be reviewed by a person
• Right to correction, blocking or erasure of data that is inaccurate, incomplete or processed unlawfully
• Right to object to direct marketing at any time, free of charge

Automated processing and our AI

Our platform generates automated replies to your customers' messages. Those replies are a communications tool, not a decision about a person's rights, credit or employment. We do not use the platform to evaluate personality, performance or creditworthiness by automated means, and we do not carry out any processing that requires the Authority's prior authorisation without obtaining it first.

Our data protection contact

• Data Protection Guardian: privacy@thikaa.com, Deepthink Data LLC, Manama, Kingdom of Bahrain
• We answer every request within 30 days, free of charge, and tell you in writing if we need longer or must refuse
• You may lodge a complaint with the Bahraini Personal Data Protection Authority if you are not satisfied with our response

Who Is Responsible For What

Two different relationships run through this platform, and the law treats them differently:

• Your own account data (your name, email, phone, billing) — Deepthink Data LLC is the data controller and this policy governs it
• Your customers' conversations that pass through your bot — you are the data controller and we are your data processor. We act on your instructions, we do not use your customers' messages to train models for other tenants, and we return or delete that data when you leave
• As controller of your customers' data you are responsible for having a lawful basis to collect it and for telling your customers that an automated assistant may reply to them and that a human agent may read the conversation
• A written data processing agreement is available on request from privacy@thikaa.com

Children's Privacy

Thikaa is designed for businesses and is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at info@thikaa.com.

Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make significant changes:

• We will notify you via email or platform notification
• The "Last Updated" date will be revised
• Continued use of Thikaa constitutes acceptance of the updated policy

We encourage you to review this page periodically for the latest information.