Privacy Policy
Last updated 27 August 2026
This policy covers two different things, and they have different answers. Part A is this website — what it collects while you read it and what happens to the demo form. Part B is the messaging and voice service: what happens to a conversation when you message or call a business that runs on Kalaj.
It is written to the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for users in Pakistan, to the Prevention of Electronic Crimes Act 2016 as amended in 2025.
The short version. This site sets no tracking cookies and runs no third-party analytics. We count pageviews on our own servers without storing your IP address or anything that identifies you across days. The only personal data we keep from the website is what you deliberately type into the demo form.
If you messaged a business on WhatsApp and reached an assistant, that business decides what happens to your conversation — Kalaj runs the software on their behalf. Part B explains what that means in practice, what is stored, for how long, and how to stop it.
Part A — This website
Who is responsible
Kalaj is the controller for the data described here. For anything in this policy, including a request to see or delete your data, write to hello@kalaj.ai. We answer within 30 days.
What we collect, and why
When you just read the site
We record that a page was viewed. To count returning visitors within a single day without identifying anyone, your IP address and browser are combined with a secret that is regenerated every night and never written to disk, and the result is a one-way hash. Your IP address is not stored. After midnight UTC the secret is gone and the hash cannot be linked to anything, including a hash from the day before.
| What | Why | Kept |
|---|---|---|
| Page address | Which pages people read | 24 months |
| Referring site (domain only) | Where visitors come from | 24 months |
| Country | Which markets to serve | 24 months |
| Browser family | What to test against | 24 months |
| Daily visitor hash | Counting people, not visits | 24 months, meaningless after 24 hours |
We do not collect your IP address, city, device identifier, full user-agent string, or the full address of the page that referred you. There is no advertising or profiling on this site and no data is sold or shared with advertisers — we have no advertising partners.
When you fill in the demo form
Your name, company, work email, phone number if you give one, and your message. We use these to reply to you and arrange a demo. The form is sent to us as an email; it is not added to any database or marketing list unless you tick the separate box asking us to.
If you talk to an agent on this site
The demo call carries your voice to our agent so it can answer. The audio is processed to run the conversation and is not used to train voice models or build a profile of you. Do not share confidential or personal information you would not want processed — it is a public demo, not a private channel.
The legal basis
| Purpose | Basis under PDPL |
|---|---|
| Replying to a demo request | Necessary to take steps you asked for |
| Counting pageviews (no identifiers) | Legitimate interest in knowing whether the site works |
| Marketing emails | Your consent, given by ticking the box — never assumed |
| Keeping the site up and secure | Legitimate interest |
Who else sees it
As few parties as possible, and none of them for their own purposes:
- Supabase — our database, where pageview counts are stored.
- Resend — delivers the demo-form email to our inbox. This means the details you type into the form pass through a service based in the United States. We are telling you this plainly because PDPL requires that a transfer outside the UAE is disclosed, and because we would rather you learn it here than notice it later.
- Our hosting provider — serves the pages you are reading.
We do not sell personal data, and we do not share it with advertisers or data brokers. Any transfer outside the UAE is limited to the specific purpose above and covered by the processor's contractual data-protection terms.
How long we keep it
- Pageview records — 24 months, then deleted.
- Demo enquiries — 24 months after our last contact, unless you become a customer.
- Marketing consent — until you withdraw it, plus a record of the withdrawal so we can prove we honoured it.
Your rights
Under PDPL you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- stop or limit how we use it;
- provide it in a portable, machine-readable form;
- stop using it for a purpose you object to, including any automated decision-making.
Email hello@kalaj.ai. There is no charge, and we will not ask you why. You can also complain to the UAE Data Office if you are unhappy with how we have handled a request.
Withdrawing consent
Withdrawing is as easy as giving — that is a requirement, not a courtesy. Every marketing email has a one-click unsubscribe link, and you can email hello@kalaj.ai at any time. To stop being counted in our pageview statistics, use the opt-out on our cookies and tracking page. We also honour Global Privacy Control and Do Not Track automatically, without you asking.
Security
Traffic to this site is encrypted in transit. Analytics records are not readable by the browser and are reachable only by our own server. Access to demo enquiries is limited to the people who need to answer them.
Children
This is a business website and is not directed at children. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
Part B — Messaging and voice conversations
This part applies if you sent a WhatsApp message to a business, or spoke to a voice assistant on a phone call, and that business runs on Kalaj. You may have arrived by tapping an advert, by messaging a number yourself, or by calling.
Who is responsible for your conversation. The business you contacted is the controller: they decide what the assistant is for, what it asks, and how long the conversation is kept. Kalaj is their processor — we run the software and act on their instructions. If you want a conversation deleted, the business is the right place to ask, and you can also write to us at hello@kalaj.ai and we will route it.
What is processed
The conversation itself, and the minimum around it needed to answer you:
- Your messages and our replies, stored as a transcript so the assistant can follow the conversation and the business can see what was said on their behalf.
- Your WhatsApp phone number, which is how the reply reaches you. On a voice call, the number you called from.
- Voice notes and images you send, if the business has those enabled. A voice note is transcribed to text; an image is described in words. We do not keep the audio or the picture after that.
- Anything you tell the assistant — a name, an email address, an appointment time, a delivery address. This is data you choose to give, and the assistant only asks for what the business needs to help you.
- How you arrived, where WhatsApp tells us. If you tapped an advert, WhatsApp passes an advert identifier so the business knows which campaign reached you. It does not tell us anything about your Facebook or Instagram profile.
- Call recordings and transcripts for voice calls, where the business has enabled them and told you so at the start of the call.
We do not sell your data, and we do not use your conversations to train AI models. Your messages are not added to any training set, ours or a third party's.
Why, and on what basis
To answer you. Under the UAE PDPL the basis is the performance of the service you asked for when you started the conversation, and the legitimate interest of the business in responding to an enquiry. You started the conversation by messaging or calling; that is the opt-in, and it is the only thing that opens a 24-hour window in which the business may reply freely.
Marketing messages are different and are never sent on the strength of you having asked a question. They require a separate, specific consent, and WhatsApp enforces this as well as we do.
Who else sees it
| Who | What they get | Why |
|---|---|---|
| The business you contacted | The whole conversation | It is theirs. They asked for the assistant and they answer for it. |
| Meta / WhatsApp | The messages, as the carrier | WhatsApp delivers them. Meta's own privacy policy governs that leg. |
| AI model providers | The conversation text, to compose a reply | Sent under agreements that prohibit training on it. Not retained by them for our account. |
| Speech providers | Audio, on voice calls and voice notes | To turn speech into text and text into speech. |
| Hosting and database | Stored conversations | Where the service runs. Increasingly this is infrastructure the business itself controls. |
| Payment providers | Amount and reference only | If you pay through a link. Card details never reach Kalaj — they go straight to the provider. |
Where it goes
Some of these providers operate outside the UAE and outside Pakistan. Where data leaves the country it does so under contractual protections requiring an equivalent standard of care, as the PDPL requires for cross-border transfer. Businesses with a residency requirement can be deployed entirely within their own infrastructure, and we say so here rather than leave it implied.
How long it is kept
The business sets this, because it is their record. Our defaults: a conversation stays available to the assistant for the length of the conversation and a short window after it, and the transcript is retained for the business's own records until they delete it or the agreement ends. Voice-note audio and images are discarded once converted to text. Where a business has asked us to remember a returning customer, that is a short profile — a name, a language preference, a few notes the assistant wrote — and never a stored transcript history.
Your rights, and how to use them
Under the UAE PDPL you may ask for a copy of your data, ask for it to be corrected or deleted, object to how it is used, and withdraw consent. In Pakistan, PECA 2016 as amended makes it an offence to transfer your personal data without your consent, and the same requests below apply.
- To stop the assistant messaging you: reply STOP, or block the number in WhatsApp. Both are honoured immediately and neither needs a reason.
- To reach a human instead: ask. Every assistant can hand the conversation to a person at the business.
- To see or delete your conversation: ask the business directly, or write to hello@kalaj.ai and we will pass it to them and make sure it is actioned. We answer within 30 days.
You are talking to software
The assistant identifies itself as an assistant. It is not a person, and it does not pretend to be one. It can hand you to a human at any point, and for some subjects it is required to — if a conversation touches on a medical or mental-health emergency, the assistant stops, gives you the relevant emergency number, and does not continue with the task.
Security
Conversations travel over encrypted connections. Credentials the business gives us — their WhatsApp access, their calendar, their payment account — are encrypted at rest and are never visible in the dashboard once saved. Each business's data is separated from every other business's, and for clients on their own infrastructure it is separated physically.
Changes
If this policy changes materially we will update the date at the top and, for anything that affects how we use data you have already given us, contact you directly rather than relying on you re-reading this page.
Contact
Kalaj, United Arab Emirates. For any privacy question, request or complaint: hello@kalaj.ai. If you contacted a business through WhatsApp and want your conversation removed, that business is the fastest route, but you can start with us and we will route it.