Privacy Policy

Last updated: 25 September 2026

1. Who we are

SamurAI (getsamurai.ai) is a conversational AI platform operated by Murad Logistics LLC (Общество с ограниченной ответственностью «Мурад Логистикс»), registration number 308582-3301-ООО, Tax ID (ИНН) 01909202410621, registered at 1 Kalyk Akiev Street, Sverdlovsky District, Bishkek, Kyrgyz Republic (ул. Калык Акиева 1, Свердловский район, г. Бишкек, Кыргызская Республика).

In this policy, "we", "us" and "SamurAI" mean Murad Logistics LLC. You can reach us at support@getsamurai.ai or +996 500 888 240.

2. Three kinds of people this policy covers

Business Customers. Businesses that hold a SamurAI account, and the team members they invite. For their account data, we are the data controller.

End Users. People who send messages to a Business Customer through a connected channel and receive replies generated by SamurAI. For End User data, the Business Customer is the data controller and SamurAI acts as the data processor on their instructions.

Visitors. People who visit getsamurai.ai or use its contact form. For their data, we are the data controller.

3. Data we collect from Business Customers

• Account details: name, email address, password (stored only as a hash by our authentication provider), profile picture and language. If you sign in with Google, the name and picture Google shares with us.
• Workspace details: business name, time zone and currency, and the email addresses and roles of team members you invite.
• Billing details: your plan, subscription status and renewal date, and a record of your acceptance of the purchase terms. To set up a subscription we share your name, email address and a suggested billing country with Dodo Payments, our Merchant of Record (see section 8). The suggested country is the one our hosting provider locates your connection in; we do not keep your IP address for this, and you can change the country on the checkout form. Dodo collects your card and billing address itself. We never see or store your card number.
• Configuration you create: agent instructions, and the business documents, FAQs and policies you upload as knowledge for your agent.
• Connected tools: when you connect a tool such as Gmail or HubSpot, the account name or address you connect, and the access credentials, which we store encrypted.
• Support: the support tickets you open and the messages in them.
• Technical data: error reports from your browser (the error message and the page it happened on). Our hosting provider records IP addresses, browser type and request times in its server logs.

Visitors who use the contact form give us their name, email address, company and message. These are emailed to our support mailbox so we can reply; they are not stored in the SamurAI platform.

4. Data we receive through connected channels

When a Business Customer connects a channel, we receive only what is needed to deliver the service:

WhatsApp Business Platform (via Meta):

• The WhatsApp Business Account (WABA) ID and business phone number ID
• The business display name and profile details
• Message content, media, timestamps and delivery status for conversations in that account
• End User phone numbers and WhatsApp profile names

Instagram Messaging (instagram_business_basic, instagram_business_manage_messages):

• Connected Instagram Business account username, account ID and profile picture
• Direct message content, media, timestamps and message IDs
• Sender username, Instagram-scoped ID and profile picture

Telegram (via a bot the Business Customer connects):

• The bot's username
• End User Telegram ID, first and last name, username and profile photo
• Message content, media and timestamps

Photos, voice notes, videos and documents that End Users send are stored so the Business Customer can see them in their inbox. Voice notes are also transcribed to text.

We use End User data only to provide the service to the Business Customer:

• routing each message to the right Business Customer's inbox and displaying it there;
• generating AI replies, which includes searching the Business Customer's knowledge base and transcribing voice notes;
• keeping the Business Customer's contact records, such as a contact's stage, tags and notes;
• when the Business Customer has connected them, sending lead and booking details (name, phone, email and the request) to the tools they chose, such as HubSpot, Google Calendar, Gmail, Slack, Google Sheets, Microsoft Excel or Notion. A booking in Google Calendar sends the End User a calendar invitation from Google;
• counting AI replies against the Business Customer's plan, and keeping the service secure and working.

5. What we never do

• We never sell, rent or trade personal data.
• We never use Meta platform data for advertising, ad targeting or audience building.
• We do not train AI models on your business documents, conversations or End User messages. To generate replies, they are sent to our AI provider, OpenAI (see sections 6 and 8).
• We never scrape Instagram, WhatsApp, Telegram or Facebook, and we never send unsolicited or cold messages. SamurAI only replies inside conversations an End User has started, or sends messages a Business Customer is permitted to send under the channel's policies.
• We never share data between Business Customers. Every account is logically isolated.

6. Automated replies and AI disclosure

Replies are generated by OpenAI's language models, following the Business Customer's instructions and knowledge base. To write a reply, the model receives the agent's instructions, the recent messages in that conversation, relevant passages from the knowledge base and the text of any document the End User sent. Photos and videos are not analysed.

The first message SamurAI sends in every conversation says that the End User is talking to an automated assistant. Business Customers can change its wording but cannot remove it. An End User can ask for a person at any time: the AI then stops replying in that conversation and the Business Customer's team is notified.

SamurAI does not use End User data to make decisions about End Users that have legal or similarly significant effects on them.

7. How long we keep data

Deleted data can remain for a short time in our database provider's encrypted backups until they expire.

Deleting a message inside WhatsApp, Instagram or Telegram removes it on that platform. It does not by itself guarantee removal of the copy stored in the Business Customer's SamurAI inbox, which is deleted under the retention period above, when the Business Customer deletes the contact, or on request: see our data deletion page.

8. Who else processes data

Our service providers, which handle data on our behalf so that we can provide the service:

• Supabase Inc.: database, authentication and file storage
• Vercel Inc.: application hosting
• OpenAI, L.L.C.: AI replies, voice-note transcription and knowledge-base search
• Upstash, Inc.: background job queue, which carries messages while they are processed
• Railway Corp.: hosting for background workers
• Composio Inc.: connecting agents to the tools a Business Customer chooses to authorise
• Namecheap, Inc. (Private Email): sending our emails, and our support mailbox

Messaging platforms the Business Customer connects, which process messages under their own terms and privacy policies: Meta Platforms, Inc. (WhatsApp and Instagram; the Facebook sign-in window used to connect WhatsApp is also provided by Meta) and Telegram FZ-LLC.

Dodo Payments is our Merchant of Record: it sells SamurAI subscriptions to you, takes the payment, charges applicable taxes and issues invoices. It processes your payment data as an independent controller under its own privacy policy.

Google provides "Sign in with Google", if you choose to use it.

Tools a Business Customer connects, such as HubSpot, Google (Calendar, Gmail, Sheets), Slack, Microsoft (Excel) or Notion, receive the lead and booking details described in section 4 under the Business Customer's own agreement with them.

9. Where data is processed

We are based in the Kyrgyz Republic, and our team accesses data from there. Our providers process data outside the Kyrgyz Republic, including in South Korea (our database), the United States and the European Union. Where the law of your country requires a safeguard for these transfers, such as in the EU or UK, we rely on the Standard Contractual Clauses in our providers' data processing terms. Business Customers who need transfer terms with us directly can contact us.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our database provider. Access credentials for connected channels and tools are additionally encrypted by SamurAI (AES-256-GCM). Each Business Customer's data is separated by row-level security in the database. Private files are served only through links that expire after one hour. Passwords are stored as hashes and cannot be recovered.

SamurAI staff can open a Business Customer's workspace only through a support session, to provide support or to investigate a fault or misuse. The start of every support session is logged, and every change made during one is recorded in the workspace's audit log.

11. Why we are allowed to use Business Customer data

• To provide the service and bill for it: to perform our contract with you.
• To keep the service secure, prevent misuse, fix faults and answer support requests: our legitimate interest in running a reliable service.
• To meet legal obligations, such as responding to lawful requests from authorities.
• Where we ask for your consent, on that consent, which you can withdraw at any time.

For End User data, the Business Customer decides the purposes and is responsible for having a lawful basis for them.

12. Your rights

You may ask for access to your data, a copy of it in a portable format, its correction or deletion, or restriction of its processing. You may object to processing based on our legitimate interests, and withdraw any consent you have given. Email support@getsamurai.ai and we will respond within 30 days. You also have the right to complain to the data protection authority in your country.

End Users: contact the business you were messaging, since they control that conversation. If you cannot reach them, email us and we will act on your request or route it to them.

Deletion instructions are on our Data Deletion page.

13. Cookies

SamurAI uses only cookies that are strictly necessary for the service: one that keeps you signed in, one that remembers which workspace you are working in, one that remembers your language, and one that SamurAI staff use during a support session. We use no analytics, advertising or tracking cookies. Two windows provided by third parties can set their own cookies: the Facebook window used to connect WhatsApp, and the Dodo Payments checkout.

14. Children

SamurAI accounts are for people aged 18 or over who act for a business, as our Terms of Service require. We do not knowingly collect data from children for our own purposes. If a Business Customer's End Users may include children, that Business Customer is responsible for any consent the law requires. If you believe we hold a child's data that we should not, email us and we will delete it.

15. Changes

We will post any change on this page and update the date above. Material changes are emailed to Business Customers at least 30 days before they take effect.

16. Contact