Privacy Policy

Lasani is provided by TravelDocx LLC ("TravelDocx", "we", "us"), a company of FLYLOP FZE LLC, a free-zone limited liability company registered in Sharjah, United Arab Emirates. Our website is https://www.lasani.site. You can reach us at privacy@lasani.site for privacy matters, or support@lasani.site for general support.

Our customers are businesses that use Lasani to communicate with their end customers over WhatsApp. When we handle the personal data of those end customers (for example, a WhatsApp phone number, display name, profile picture, or the content of a conversation), we act as a data processor on behalf of our business customer, who is the data controller of that data.

When we handle the personal data of the business itself — the admins and agents who sign up and use Lasani — we act as a data controller.

Business account data (controller)

• Workspace name and business details you enter at signup.
• Agent profile information: name, email address, avatar, role.
• Authentication data (hashed password, session tokens, device push tokens).
• App usage and diagnostic logs strictly needed to operate the service.

End-customer conversation data (processor, on behalf of the business)

• WhatsApp phone numbers of the business's contacts.
• Public WhatsApp profile name and profile picture, when made available by WhatsApp.
• The content of messages exchanged over WhatsApp (text, images, audio, video, documents, stickers, reactions, locations).
• Message metadata: timestamps, delivery / read status, error codes.
• Assignment, notes, tags and labels the business applies to a conversation.

We do not sell personal data. We do not use conversation content for advertising. We do not train third-party generative AI models on your or your customers' conversation data.

• Provide the Service — route inbound WhatsApp messages to the correct workspace, send outbound messages, store history, sync it to the business's team. Legal basis: performance of a contract with the business.
• Secure the Service — detect abuse, prevent fraud, enforce WhatsApp Business Messaging Policy. Legal basis: legitimate interest.
• Operational communications — send OTPs, invites, password resets, service notices. Legal basis: performance of contract.
• Comply with law — respond to lawful requests from competent authorities in the UAE. Legal basis: legal obligation.

We rely on a small set of vetted infrastructure providers to run the Service. These sub-processors act on our instructions and are bound by written data protection commitments.

We update this list when it changes. Contact us if you would like to be notified of updates in advance of new sub-processors.

Personal data processed by Lasani may be stored and processed in regions where our sub-processors operate, which include the United States, the European Union, and other regions. WhatsApp itself processes messages through Meta's global infrastructure under its own terms. When personal data is transferred outside its country of origin, we rely on the safeguards offered by our sub-processors, including standard contractual clauses where applicable.

• We retain workspace, agent, conversation and message data for as long as the business's account is active.
• A business can delete individual conversations, disconnect a WhatsApp Business number, remove agents, or request deletion of an entire workspace at any time.
• On a verified deletion request (see the Data Deletion page) we remove the affected data from our production systems within 30 days. Backups are purged on their normal rotation.
• A minimal audit record (for example, that a deletion request was received and completed) may be kept where required to comply with legal obligations.

• All traffic between clients, our services and sub-processors uses TLS in transit.
• Multi-tenant data is isolated at the database layer using per-workspace row-level security rules and workspace-scoped server-side queries.
• Access to production systems is restricted to authorised personnel and requires strong authentication.
• Media attachments are stored in a private object-storage bucket and served only via short-lived signed URLs.
• We continuously monitor for security issues and address them promptly. No online service can be guaranteed 100% secure.

Depending on where you live, you may have rights to access, correct, export or delete personal data we hold about you, and to object to or restrict certain processing.

• If you are an agent or admin of a business using Lasani, contact us at privacy@lasani.site.
• If you are an end customer whose WhatsApp conversation is being handled by a business through Lasani, please contact that business directly — they are the data controller of your conversation. We will support them in fulfilling your request.

Lasani is not directed to children under 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact privacy@lasani.site and we will delete it.

We may update this policy from time to time. Material changes will be posted on this page with a new "Last updated" date and, where appropriate, communicated in-app or by email.

TravelDocx LLC, a company of FLYLOP FZE LLC
Sharjah, United Arab Emirates
Privacy: privacy@lasani.site
Support: support@lasani.site