Privacy policy

1Introduction

1.1Khalas is an AI assistant for life in Dubai that you reach on WhatsApp and at app.khalas.si. To order, book, pay, call and remind on your behalf, it needs some information about you. This Policy explains how that information is handled.

1.2This Policy applies wherever you are. Some rights in clause 11 depend on where you live and are marked as such.

1.3This Policy forms part of the Terms and Conditions, and words with capital letters have the meanings given in clause 2 of those Terms.

2Who is responsible for your information

2.1Khalas is a product of Billion Impact, Inc. Two companies in the same group provide the Services, because the assistant and regulated money services carry different obligations.

2.2Verification partners, card issuers, payment networks and Merchants are separate controllers of the information they collect directly from you or need to keep under their own obligations. Their own privacy notices apply to that information.

2.3Where this Policy says we, us or our, it means whichever company is responsible for the activity described. Contact details are in clause 15.

3Information we collect

3.1We collect what we need to carry out your requests, keep your Account safe, and meet our legal obligations. It falls into the categories below.

3.2Information you give us

1. Your mobile number and your WhatsApp display name, which identify your Account.
2. What you send Khalas: messages, voice notes, photos, documents and links, and the instructions in them.
3. Details you ask Khalas to use or remember, such as your name, email address, delivery addresses, home and work locations, car plate, parking zone, mobile numbers to top up, travel preferences and your usual orders.
4. Information about other people that you give Khalas to complete a task, such as the name and number of someone you are sending a gift to, or a business you want called. Only share someone's details if you are allowed to.
5. Your settings, such as approval and spending limits, and your communication preferences.
6. Messages you send us for help, feedback and complaints.

3.3Information created when Khalas works for you

1. Orders, bookings, tickets, top-ups and parking sessions Khalas makes for you, with their status, amounts and receipts.
2. Phone calls Khalas places for you. Call audio is processed to hold the conversation, and a transcript or summary of the call may be kept so that Khalas can report back to you.
3. Emails and messages Khalas sends or receives on your behalf.
4. Khalas's memory of you: preferences and facts it learns so that it can do things the way you like, such as your usual eggs or your preferred seats.
5. Scheduled and automatic tasks you set up, and a record of when they ran.

3.4Payment and verification information

1. Before money can move, a regulated verification partner checks your identity and collects any documents directly from you. We receive and keep the outcome and the details attached to it, such as your name, date of birth, nationality and verification status, not the documents themselves.
2. Card records: which cards exist, their status and the itemised record of each charge. The full card number, expiry date and security code are held by a PCI DSS Level 1 certified provider and are not stored by Khalas or shown to the AI.
3. A record of each payment decision, including the limit it was checked against and whether it was approved, refused or held for your approval.
4. Screening and monitoring records that the law requires us to keep.

3.5Linked Accounts. If you connect an account such as an email inbox or calendar, Khalas can read and act on it within the access you approved. We keep the credentials needed to maintain the connection, and information Khalas retrieves from it to complete your task.

3.6Information collected automatically

1. When you use the website or dashboard: device and browser type, pages viewed, and approximate location derived from your IP address.
2. Technical logs, error reports and performance data, used to keep the Services working and secure.

4How we use your information

5Legal bases

5.1Where data protection law requires a legal basis, including the UAE Personal Data Protection Law, the GDPR and the UK GDPR, we rely on the following.

6Who we share information with

6.1We do not sell your information, rent it, or share it for anyone's advertising. We share it only as described below, and each recipient receives only what it needs.

7Storage and security

7.1Your Account, conversation history, saved details and order records are stored in our cloud database and with our hosting providers. Card numbers are held only by the certified card provider. Identity documents are held only by the verification partner.

7.2We use technical and organisational measures to protect your information, including encryption in transit and at rest, restricted and logged access to production systems, keeping provider credentials on our servers rather than with the AI, and rate limiting.

7.3No system is completely secure. You are responsible for the security of your phone, your messaging accounts and any dashboard link or code we send you.

7.4If a personal data breach is likely to put your rights at risk, we will notify the relevant authority within the time the law requires, and will tell you without undue delay where the risk to you is high.

8International transfers

8.1Khalas serves people in the UAE using providers around the world. Your information may be processed in the United Arab Emirates, the United States, Canada, the European Union and other countries where our providers operate.

8.2Some of those countries have different data protection laws from where you live. Where a transfer needs safeguards, we use them, such as standard contractual clauses. You can ask us for a copy of the safeguards for a particular transfer.

9How long we keep information

9.1We keep information for as long as we need it for the purpose it was collected for, or for as long as the law requires, whichever is longer.

10Your rights

10.1Access and correction. You can ask for a copy of the information we hold about you and ask us to correct it. You can also ask Khalas what it remembers about you and tell it to change or forget something.

10.2Deletion. You can ask us to delete your information or close your Account. Within 30 days of a verified request, we will delete your Account details, conversations, saved details and Khalas's memory of you, except records we must keep by law, as listed in clause 9.

10.3Objection and restriction. Where we rely on legitimate interests, you can object, and you can ask us to restrict processing while we consider an objection or a correction.

10.4Messages and analytics. You can stop marketing messages at any time. Approval requests, security alerts and notices of changes are not marketing and continue while you use the Services.

10.5Making a request. Write to team@khalas.si with the subject Privacy Request, from the email address or about the phone number on your Account. We may ask you to confirm your identity. We respond to verified requests within 30 days and will tell you if we need longer where the law allows.

10.6Complaints. Contact us first at team@khalas.si and we will respond within 30 days. You may also complain to the data protection authority where you live or work.

11Regional rights

11.1United Arab Emirates. Where the UAE Personal Data Protection Law applies, you have the rights it gives you, including to be informed, to access, correct and erase your data, to restrict or object to processing, and to object to decisions based solely on automated processing that significantly affect you.

11.2United Kingdom and European Economic Area. You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects. A payment refused automatically by a limit you set, or a verification check declined automatically, can be reviewed by a person on request. Choices Khalas makes on your instructions within your limits are acts on your behalf, and you can stop them at any time.

11.3California. You have the rights to know, delete and correct, to opt out of sale or sharing, and to limit use of sensitive personal information, and not to be discriminated against for using them. We do not sell personal information or share it for cross-context behavioural advertising. We honour the Global Privacy Control signal.

11.4Canada. Canadian federal privacy law applies to the Payment Services. You can ask for access to your information, challenge its accuracy, and complain to the Office of the Privacy Commissioner of Canada.

12Cookies

12.1The khalas.si website does not use advertising or tracking cookies. The dashboard at app.khalas.si uses cookies and similar storage that are strictly necessary to sign you in and remember your settings.

12.2If we add optional analytics, we will tell you and give you a choice where the law requires it.

13Children

13.1Khalas is for people aged 18 and over. We do not knowingly collect information from children. If we learn that we have, we delete it. If you think a child has used Khalas, write to team@khalas.si.

14Changes to this Policy

14.1The Last updated date at the top shows when this Policy last changed.

14.2For a material change, we will tell you before it takes effect, by WhatsApp or email or in the dashboard.

14.3If a change would mean using information we already hold for a genuinely new purpose, we will ask for your consent first.

15How to contact us