1. Introduction & Scope

This Privacy Policy applies to the FaktoriBOT application, website (https://faktoribot.tech), and its backend APIs (operated under Tajwar AI Lab / FaktoriBOT Technologies). It explains how we collect, process, store, and safeguard data when garment factory personnel, supervisors, and management interact with FaktoriBOT via the WhatsApp Cloud API or authorized WhatsApp integrations.

2. Information We Collect

To provide automated operational intelligence and alert routing for manufacturing facilities, FaktoriBOT collects only the data strictly necessary for these purposes:

• WhatsApp Metadata: WhatsApp phone number (in E.164 international format), WhatsApp user display name (profile name), and unique WhatsApp message identifier (wamid).
• Factory Operational Messages: Text messages, voice memos, or document captions submitted by factory personnel in authorized factory WhatsApp operational groups or direct messages to FaktoriBOT (e.g., machine status updates, defect notices, production output counts, SOP instructions).
• Voice Audio Recordings: Audio voice notes sent by factory supervisors are temporarily processed via speech-to-text engines solely to transcribe operational instructions into text for classification.
• Technical Logs: Server access logs, request timestamps, response status codes, and IP addresses used for security auditing and preventing denial-of-service abuse.

3. How We Use Your Information

All collected data is processed strictly for the following industrial manufacturing purposes:

1. AI Message Classification: Categorizing incoming factory messages into operational classes (e.g., machine_breakdown, quality_defect, production_gap, sop_instruction) using AI models.
2. Automated Emergency Alerting: Instantly notifying designated factory General Managers, Maintenance Engineers, or QC Leads when critical machine breakdowns or quality defects occur.
3. Standard Operating Procedure (SOP) Indexing: Extracting procedural instructions into a searchable vector knowledge base (pgvector) so factory technicians can retrieve verified machine adjustments.
4. Shift & Daily Digests: Generating morning and end-of-shift operational summaries for factory leadership.
5. Security & Abuse Prevention: Verifying Meta HMAC SHA-256 webhook signatures and enforcing rate limits to protect factory infrastructure.

4. Data Sharing & Third-Party Processors

We do NOT sell, rent, trade, or monetize your data under any circumstances. We share data only with verified, enterprise-grade cloud service providers necessary to deliver the service:

• Meta Platforms, Inc. (WhatsApp Business Cloud API): Used as the communication transport to receive inbound webhooks and deliver outbound alert messages.
• Microsoft Azure (Azure OpenAI Service): Used for secure, enterprise-grade text classification and vector embedding generation under strict Microsoft privacy terms (customer data is not used to train global AI models).
• Supabase / PostgreSQL: Hosted relational and vector database with Row-Level Security (RLS) enabled for storing structured factory records.

5. Data Retention & Security

We implement defense-in-depth technical and organizational security controls:

• Encryption in Transit: All data exchanged between Meta, our API servers, and database instances is encrypted using industry-standard TLS 1.3 / HTTPS.
• HMAC Webhook Signatures: Every incoming payload from Meta is cryptographically verified using SHA-256 HMAC tokens before processing.
• Retention Schedule: Operational raw message logs are retained for 90 days to provide factory trend analysis, after which they are systematically purged or anonymized. SOP knowledge cards remain active until deleted or modified by authorized factory administrators.

6. User Rights & Data Deletion Instructions

In accordance with Meta Platform Terms, GDPR principles, and local data protection regulations, all users and factory partners possess the following rights:

• Right to Access & Portability: Request a full export of stored operational logs associated with your phone number or factory.
• Right to Rectification: Request correction of inaccurate factory records or SOP cards.
• Right to Erasure (Data Deletion): Request the permanent deletion of your phone number, messages, and associated records.

To exercise your data deletion rights, visit our dedicated User Data Deletion Page or submit a request directly to our Data Protection Officer at privacy@faktoribot.tech. Deletion requests are processed within 48 business hours.

7. Children's Privacy

FaktoriBOT is strictly an enterprise B2B operational tool for commercial textile and apparel manufacturing facilities. We do not knowingly collect or solicit data from individuals under the age of 18.

8. Changes to This Privacy Policy

We may update this policy periodically to reflect enhancements in our architecture or regulatory compliance standards. Material changes will be posted on this page with an updated revision date.

9. Contact Information

For questions, privacy inquiries, or regulatory compliance verification, please contact us: