Privacy Policy

Welcome to Dera ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy outlines how we collect, use, process, store, and safeguard your information when you interact with our AI-powered personal assistant service available via WhatsApp, web applications, and associated services (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with any part of this policy, you must immediately cease using the Service.

To provide an intelligent, context-aware, and automated personal assistant experience, we collect several categories of information:

2.1 Information You Provide Directly

• Account & Profile Data: Phone number, WhatsApp display name, user profile information, and account settings.
• Conversational Inputs & Prompts: Text messages, voice notes, images, uploaded documents, and instructions sent to the assistant via WhatsApp or associated interfaces.
• Task & Transactional Data: Information explicitly provided to perform actions on your behalf, such as appointment schedules, restaurant reservation preferences, contact details, notes, and task lists.

2.2 Automatically Collected Information

• Technical & Usage Metadata: Timestamps of messages, interaction duration, system logs, IP addresses, device identifiers, and error report diagnostics.
• Communication Routing Data: WhatsApp Business API metadata required to send and receive messages securely across the WhatsApp network.

2.3 Third-Party Integration Data

• Connected Service Tokens: If you authorize the assistant to interface with external tools (such as Google Calendar, external booking engines, or custom tools), we securely store the necessary OAuth tokens, API keys, or session identifiers required to execute authorized tasks.

We process your data exclusively for legitimate operational, service delivery, and security purposes:

• Core Assistant Functionality: Executing automated task loops, tool selection, appointment booking/cancellations, entity extraction, and generating conversational responses.
• State & Memory Retention: Maintaining conversational context across multi-step tasks (e.g., remembering your preference for a booking while checking external calendar availability).
• System Optimization & Reliability: Monitoring system performance, server response latency, resolving software bugs, and ensuring platform availability.
• Security & Verification: Preventing abuse, fraudulent activity, unauthorized API calls, and protecting user accounts.

4.1 Large Language Models (LLMs) & Agent Frameworks

• Your prompts and conversational state are processed through state-of-the-art Large Language Models (e.g., Anthropic Claude, OpenAI, or localized inference routers) and orchestration engines (such as LangGraph).
• Zero Model Training Commitment: Your personal conversational data, prompts, and tool inputs are never used to train, fine-tune, or improve public foundational AI models without your explicit, opt-in consent.

4.2 Vector Storage & Long-Term Memory

• To deliver personalized assistant behavior, relevant excerpts of your interactions may be embedded and stored in secure vector or relational databases (e.g., Supabase / Cloudflare D1).
• Vector embeddings allow the assistant to remember your long-term preferences, past bookings, and instructions securely.

4.3 Human-In-The-Loop Validation

• Sensitive or state-altering actions (e.g., finalizing a booking, canceling a service, or executing financial transactions) are routed through explicit validation steps, requiring your clear confirmation before execution.

We do not sell, rent, or trade your personal data to advertisers or third-party marketers. We share your information only with trusted service providers critical to delivering the Service:

• Messaging Infrastructure: Meta Platforms, Inc. / WhatsApp Business API (for delivering messages to your mobile device).
• Hosting & Edge Compute: Cloudflare Pages/Workers and cloud database providers (for secure, encrypted edge processing and storage).
• AI & Inference Gateways: Secured LLM API providers and inference proxies (for processing intent, agent reasoning, and natural language understanding).
• Action Tools & APIs: Third-party booking, reservation, or scheduling platforms that you specifically request the assistant to interact with on your behalf.
• Legal Compliance: We may disclose information if required to do so by law, court order, or governmental regulation.

• Conversational Logs: Active conversational context is retained for as long as necessary to fulfill your requests and maintain ongoing user preferences.
• System Logs: Operational server logs and debugging traces are automatically purged after 30 to 90 days.
• Data Deletion Requests: You have the right to request full deletion of your user account, vector memory, and interaction logs at any time by sending a request to our support email or typing CLEAR DATA within the assistant chat. Upon verification, all associated personal records will be permanently removed from our primary storage within 30 days.

We implement rigorous technical and organizational measures to safeguard your data:

• Encryption in Transit: All traffic between WhatsApp, Cloudflare edge servers, databases, and AI model providers is encrypted using industry-standard TLS 1.3/SSL protocols.
• Encryption at Rest: Database stores, vector indices, and persistent keys are protected using strong AES-256 encryption.
• Secure Key Management: Administrative secrets, API tokens, and credentials are strictly isolated using encrypted secrets management.

Your data may be transferred to, stored, and processed in servers located outside of your state, province, or country of residence. By using the Service, you consent to the transfer of information to servers operated in secure cloud facilities worldwide in accordance with applicable global privacy frameworks.

Depending on your jurisdiction (e.g., GDPR, NDPR, CCPA), you hold specific rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete data.
• Right to Erasure: You can request the complete deletion of your personal data ("Right to be Forgotten").
• Right to Restrict Processing: You can request that we suspend or limit how we process your personal data.

To exercise any of these rights, please contact us using the details below.

Our Service is not directed to individuals under the age of 18 (or the age of legal majority in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a minor has provided us with personal data without parental consent, we will take immediate steps to delete such information.

We may update this Privacy Policy periodically to reflect technological changes, legal requirements, or adjustments to our Service architecture. Any updates will be posted with a revised "Last Updated" date. Continued use of the Service following the posting of changes constitutes your acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at:

• Email: privacy@meetdera.com
• Website: https://meetdera.com
• Service Name: Dera WhatsApp Personal Agent