Privacy Policy

1. Who we are

Mohammad Ayman Aljonaidee Software Establishment is a sole proprietorship registered in the Hashemite Kingdom of Jordan, owned by Mohammad Ayman Olyan Al Jonaidee. We operate the start23 brand and the products listed at start23.io, including Replai — a WhatsApp-based AI receptionist sold to service businesses (salons, clinics, gyms, and similar). We are the data controller for visitor data on this website and a data processor for end-user messages handled on behalf of our business clients.

Registered address: Jubeiha, Amman, Jordan. For privacy questions, write to mohammad@start23.io.

2. Data we collect

2.1 Visitors of this website

When you visit start23.io we receive standard server log data (IP address, user agent, referrer, request path, timestamp). We use this for security and abuse prevention only. If you submit the contact form, we additionally collect the name, email, optional company, and the content of your message.

We do not use third-party analytics or advertising trackers on this site. We set a single non-tracking preference cookie in local storage to remember your language and theme choice; that preference never leaves your browser.

2.2 Customers of our products

When a business signs up for Replai, we collect the business name, owner contact details, WhatsApp number identifiers provided by Meta, and configuration the owner enters (services, hours, AI persona). We collect billing details only if applicable and only what is required for invoicing.

2.3 End-users who message a business through Replai

When a customer of one of our business clients sends a message on WhatsApp to a number powered by Replai, we receive on behalf of that business: the WhatsApp phone number, the WhatsApp profile name (if shared by Meta), the content of the message (text or voice note), media identifiers, message timestamps, and any booking details extracted by the AI to complete the customer's request.

For voice notes, audio is sent to OpenAI's Whisper service for transcription and is not retained by OpenAI for model training. The transcript is stored as a regular conversation message.

3. Why we use it

• To deliver the booking and reception service the business has hired us to provide.
• To respond to direct inquiries you send us through the contact form or email.
• To bill our business clients and keep accounting records as required by Jordanian law.
• To prevent abuse, fraud, and spam, and to keep the service stable.
• To improve the product (in aggregated, non-identifying form).

We do not sell personal data, ever. We do not use end-user message content to train AI models.

4. Who we share data with

Replai runs on top of the WhatsApp Business Platform and a handful of other infrastructure providers. We are bound by Meta's WhatsApp Business Solution Terms and the WhatsApp Business Messaging Policy and design Replai to comply with them. Each provider listed below receives only the data it needs to perform its specific function:

• Meta Platforms, Inc. (WhatsApp Cloud API, Instagram Messaging) — for inbound and outbound message delivery.
• OpenAI, L.L.C. — for the language model that drafts replies and for Whisper transcription. OpenAI does not retain our API content for training under their standard API terms.
• Resend, Inc. — for transactional email delivery (booking confirmations, contact-form receipts).
• Vercel, Inc. — hosting for this website.
• Our database provider — managed PostgreSQL for storing booking and conversation records.

We share data with public authorities only when compelled by a valid Jordanian legal order, and only to the minimum extent required.

5. International transfers

Some subprocessors process data outside Jordan. We rely on each provider's contractual safeguards and on our own contractual terms with our business clients. By using our services you acknowledge that data may be processed in the United States and the European Union.

6. Retention

• Server logs: up to 30 days, then deleted.
• Contact-form submissions: up to 24 months, then deleted.
• Booking and conversation records of our business clients: for the lifetime of the client account plus 90 days, after which they are deleted unless retained as required by tax or accounting law.
• Invoices and accounting records: 10 years, per Jordanian tax law.

7. Your rights and data deletion

You have the right to access the personal data we hold about you, ask us to correct it, ask us to delete it, or ask us to stop processing it. To exercise any of these rights, email mohammad@start23.io from the address associated with your account, or from the WhatsApp number you used to contact a Replai-powered business, and tell us what you want.

End-user data deletion (Replai conversations). If you have messaged a business that uses Replai and you want your conversation history deleted, send an email to mohammad@start23.io from your phone email or include your WhatsApp number in the message. We will identify and delete the conversation logs and any non-essential booking data tied to that number within 30 days. We may retain anonymised booking timestamps where deletion would conflict with our business client's accounting obligations.

We do not charge for these requests. We may ask for information to verify the request comes from you. If you believe we have mishandled your data you can complain to us first; if not resolved, you can contact the Jordanian Ministry of Digital Economy and Entrepreneurship.

8. Security

We use TLS in transit, encryption at rest at the database layer, JWT authentication with rotation, Row-Level Security for tenant isolation, rate limiting, request signature verification on the WhatsApp webhook, and a small set of hardened production defaults. No system is perfectly secure; if you believe you have found a vulnerability, please email mohammad@start23.io.

9. Children

Our products are intended for businesses and adult end-users. We do not knowingly process personal data of anyone under 16. If you believe a minor has used our services, contact us and we will delete the relevant data.

10. Changes

If we make material changes to this policy we will update the date at the top and, where appropriate, notify our business clients by email. Continued use of the services after a change constitutes acceptance.

11. Contact

Questions, requests, or complaints — write to mohammad@start23.io or by post to Mohammad Ayman Aljonaidee Software Establishment, Jubeiha, Amman, Jordan.