Your data, handled with care.

Phantom Core Technologies LLC (“PhantomCore”, “we”, “us”) is a technology company based at Office M02, Fronds Building, Sheikh Zayed Road, Dubai, United Arab Emirates. We build AI agents, WhatsApp automation, CRM software and custom applications, including PhantomPulse and PhantomLink.

This policy covers our websites, products, chatbots, mobile apps and related services (together, the “Services”).

Information you give us

• Contact details when you fill in a form, book a demo or message us: your name, email address, phone number, company and the message you send.
• Account details when you sign up for a product: name, email, password (stored securely) and business information.
• Billing details needed to invoice you. Card payments are handled by a payment gateway; card details are not stored or processed on our servers.

Information created when you use the Services

• Usage information such as pages visited, features used, time zone, country and device or browser type.
• Access tokens and settings needed to connect the Services to other systems you choose to integrate (for example your CRM, calendar or Google Workspace).
• Conversations with our website chat assistant.

Information we process for our clients

When a client uses our products, we process the messages, contacts, call data and files that the client and its customers send through channels such as WhatsApp, Instagram, Facebook, email and SMS. We process this data only to provide the Services to that client.

• To provide, operate and maintain the Services you use.
• To reply to enquiries, book demos and give support.
• To keep the Services secure, prevent fraud and fix problems.
• To understand how the Services are used so we can improve them.
• To tell you about updates and, where allowed, about new features or offers. You can opt out at any time.
• To meet our legal and regulatory obligations.

Where data protection law such as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) or the EU and UK GDPR applies, we rely on one or more of these grounds:

• Contract: to provide the Services you have signed up for, or to take steps you ask for before signing up.
• Legitimate interests: to run, secure and improve our business, where those interests are not overridden by your rights.
• Consent: for example for certain marketing messages. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or share information.

Our AI features process client data only to deliver the Services to that client, for example to answer a customer, qualify a lead or update a record.

We do not use any of your data collected through Google Workspace APIs (if any) for developing, improving or training AI and/or ML models. We do not use any of your data collected through Google Workspace APIs to develop, improve, or train generalized/non-personalized AI and/or ML models. We do not transfer any of your data collected through Google Workspace APIs (if any) to third-party AI tools, and the transfer is not for generalized/non-personalized AI/ML models.

Messages sent through the WhatsApp Business Platform, Instagram or Messenger also pass through Meta, and are subject to Meta’s own terms and privacy policy. Email and SMS are delivered through the relevant providers.

Clients using our messaging products are responsible for getting the opt-in consent required before they message their customers, and for meeting the channel’s rules.

We do not sell, rent or trade your personal data. We share it only in these cases:

• With carefully selected service providers who help us run our business and the Services, such as cloud hosting, communication and messaging tools, and payment processing. They may use the data only to provide their service to us, under strict confidentiality.
• When the law requires it, or to protect our rights, our users or the public.
• As part of a merger, acquisition or sale of assets, with the same protections continuing to apply.
• With your permission, or at your direction, for example when you connect an integration.

We may share aggregated statistics that cannot identify you.

Customer data is hosted in the United Arab Emirates on Amazon Web Services (AWS).

For extra safety, we keep backup copies in two further countries, the United Kingdom and India, so your data can be recovered even in the unlikely event of a regional outage.

Some of our service providers may also process data outside the UAE. Whenever data leaves the country, we take steps to make sure it stays protected as the law requires, for example by working with providers that offer appropriate contractual safeguards.

We keep personal data only for as long as we need it for the purposes above, our legal obligations and our legitimate business interests.

In general, information obtained while providing the Services is removed from general access within a few days and deleted at the latest within three years after we stop providing the Services, unless you ask for earlier deletion, we have agreed otherwise, or the law requires us to keep it longer.

• Customer data is hosted in the UAE on Amazon Web Services (AWS), with backup copies in the United Kingdom and India.
• Sensitive information is encrypted in transit using SSL/TLS.
• Personal data sits behind secured networks and is only accessible to a limited number of people with special access rights, who are required to keep it confidential.
• Card payments are processed by a payment gateway, not on our servers.
• Our Data Processing Agreement, including its technical and organisational security measures, is available to clients on request.

If a data breach affects your personal data, we will notify you by email within 7 business days, and we will notify the relevant authorities within the time the law requires.

Depending on where you live, you can ask us to:

To make a request, email phantom.admin@phantomcore.io from the email address linked to your account. For deletion, use the subject line “PhantomCore Data Erasure Request <account id>”. Customer data is deleted within 14 working days of receiving the request.

If your data was collected by one of our clients (for example a business that messaged you on WhatsApp), please contact that business first. We will help them respond.

We use cookies and similar technologies to remember your preferences, keep the website working and understand how it is used, so we can improve it. Our website chat assistant also uses cookies to keep your conversation going.

You can block or delete cookies in your browser settings. Some features, such as the chat assistant, may not work properly without them.

We may send you updates about our Services and, where allowed, about new features or offers. Every marketing email lets you unsubscribe, or you can email phantom.admin@phantomcore.io and we will remove you from all marketing correspondence promptly.

Our Services are for businesses and are not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has given us their data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes to how we use personal data, we will tell you by email and/or by a clear notice on our website. Changes take effect 30 calendar days after that notice, and immediately for new users.

If you do not agree with a change, you can close your account before it takes effect. Continuing to use the Services after the effective date means you accept the updated policy.

Links to other websites are not covered by this policy; please read their privacy policies.