Privacy Policy
Last updated: 13 November 2026
1. Who we are
This policy covers All for One, a customer-support hub run by SMETOOLS LLC, a limited liability company registered in California, United States (address: 101 Dowd Ct, Folsom, CA 95630, United States). In this policy SMETOOLS LLC is "SMEtools", "we" or "us". Our website is smetools.io.
All for One receives WhatsApp messages and voice notes that people send to a business, and turns them into helpdesk tickets. AI drafts the replies. A named person on the business's team reviews each reply and approves it before it is sent.
Current status. All for One is in testing. Until our legal review of international transfers is signed off (see §6), we run it with test data only and do not process real customers' messages with it. We will update this policy before that changes.
Our role depends on whose WhatsApp number is involved: - Our own support line. When you message SMEtools' own WhatsApp support number, SMEtools decides how your data is used. We are the controller. - Businesses that use All for One. A business can connect its own WhatsApp Business number to All for One through Meta's Embedded Signup. When you message that business, the business is the controller of your data. We process it on the business's behalf and following its instructions (as a processor or service provider). For those messages, the business's own privacy notice also applies. The business is usually the best first contact for requests about your data. - Business account data. When a business signs up, we are the controller of the account and contact details it gives us, such as the administrator's name and email.
2. What data we collect
From people who message a business through WhatsApp: - your WhatsApp phone number and WhatsApp ID; - the profile name shown on your WhatsApp account; - the messages you send, their timestamps and the language they are in; - voice notes, images and other files you send; - written transcripts of your voice notes; - the replies sent to you, and their delivery status; - the ticket that is created for your request: its number, status, the team member it is assigned to, an internal analysis of the request, and the internal notes.
From businesses that connect their number: - the business name and the IDs Meta gives us for the WhatsApp Business Account and phone number; - the name and work email of the person who connects the account, and of the team members who use the hub; - records of who approved, edited or declined each reply.
From businesses that also use the WhatsApp Business app on the same number ("coexistence"): - copies ("echoes") of messages the business sends from its own WhatsApp Business app; - past chat history and contacts, only if the business chooses to share them when it connects.
Data we create: - an audit log of actions in the system. It holds IDs, timestamps and fingerprints (hashes) of content, not message text; - service metrics (for example, response times per team member). These do not contain phone numbers or message text; - learning records used to improve ticket routing and suggest answers. These do not contain phone numbers, but can include the text of resolved questions and answers.
We do not ask for sensitive data such as health, religion or financial account details. If you send it in a message, it becomes part of the ticket. Please send only what is needed to solve your request.
3. Why we use it
We use the data to: 1. receive your message and open a support ticket; 2. transcribe voice notes into text, so the team can read and search them; 3. send one automatic acknowledgement for each new ticket. No other message is sent without a person's approval; 4. use AI to draft replies, and to check draft quality, before a team member reviews them; 5. let an authorised team member approve, edit or decline each reply, and then send it; 6. route tickets to the right team member, and measure response times and service quality; 7. keep the service secure: verify that incoming data really comes from Meta, prevent duplicate or unauthorised sends, and keep an audit trail; 8. meet our legal obligations and handle disputes.
We do not sell personal data. We do not use your messages for advertising.
4. Legal bases
Where a law requires a legal basis (such as Egypt's Personal Data Protection Law, Law No. 151 of 2020, or GDPR-style laws), we rely on the following: - Providing the service you asked for. You contacted the business, and we process your message so the business can answer it. - Legitimate interests. Running, securing and improving the support service, including quality checks on AI drafts and team metrics. We weigh these interests against your rights. - Legal obligation. Where we must keep or disclose data by law. - Consent. Where the law requires it. You can withdraw consent at any time, for future processing.
When we act for a business (see §1), the business decides the legal basis.
5. Who processes data for us (sub-processors)
We share data only with the providers we need to run the service, and only what each one needs.
| Provider | What it does | Data it receives | Location |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivers messages to and from WhatsApp | Phone number, messages, media, delivery status | Meta's global infrastructure |
| Hetzner Online | Hosts our server | All hub data, stored on the server | Germany |
| Cloudflare | Secure network connection to our server; backup storage | Traffic in transit; encrypted database backups | Global network |
| Groq | Speech-to-text for voice notes | Voice note audio | United States |
| Anthropic (Claude API) | Analyses tickets and drafts replies | Ticket and message text | United States |
| Google (Vertex AI) | Scores the quality of AI drafts | Ticket text with personal details removed | Google Cloud |
| OpenAI | Back-up quality scoring, used only if Google is unavailable | Ticket text with personal details removed | United States |
| Odoo (helpdesk) | Stores the helpdesk tickets and contact records | Name, phone number, ticket content | Odoo's hosting |
| Telegram | Internal team chat where team members review and approve drafts | Ticket text and draft replies | Telegram's infrastructure |
| Sorted | Team performance dashboards | Metrics only, with no direct personal data | Sorted's hosting |
Each AI provider processes data under its own business or API terms. We choose provider settings that limit how long they keep data where the provider offers that.
Your phone number stays on our server and in the helpdesk (Odoo). It is not sent to the AI quality scorers (Google, OpenAI), the metrics dashboard or the learning records.
We may also disclose data if the law requires it, or to protect our rights, our users or the public.
6. International transfers
SMEtools is a US company. Our server is in Germany. Several providers are in the United States or other countries. Our clients and their customers are mostly in Egypt and the wider Middle East and North Africa. Using All for One therefore means your data is transferred across borders. In particular: - voice notes are processed by Groq in the United States. Audio cannot be redacted, so this is the main cross-border transfer; - ticket text is processed by AI providers in the United States; - data is hosted in Germany.
We are reviewing these transfers against Egypt's Personal Data Protection Law and similar laws. That review is not finished, and sign-off is pending. Until it is signed off, All for One runs with test data only, and no real customer data is transferred. We will update this section when the review is complete.
7. How long we keep data
| Data | How long |
|---|---|
| Raw incoming webhook data from Meta | 30 days |
| Voice note audio | 90 days after the ticket closes. The transcript is kept with the ticket. |
| Messages, transcripts and contact details | The life of the ticket plus 2 years, then anonymised |
| Helpdesk (Odoo) records | The life of the ticket plus 2 years, then anonymised by our support team |
| Learning records | Anonymised on the same schedule as messages |
| Completed internal processing jobs | 14 days |
| Audit log (IDs and fingerprints only, no message text) | 3 years |
| Service metrics (no direct personal data) | As long as needed for reporting |
| Database backups | Rolling 30 days |
Meta also keeps its own copies of WhatsApp messages under Meta's own terms. If a business uses the WhatsApp Business app alongside All for One, the business's app also keeps its own chat history. We do not control those copies.
8. Security
What we do: - Our server accepts no direct inbound internet connections. Traffic reaches it only through an encrypted Cloudflare Tunnel. - Data travels over encrypted connections (HTTPS/TLS). - We check that each incoming WhatsApp event is really from Meta (signature check) before we process it. - Only one component can send WhatsApp messages. - Every reply except the single acknowledgement needs a person's approval. Each approval is tied to that person, can be used once, and is checked again just before sending. - Keys and passwords are stored encrypted. Backups are encrypted. - An audit log records who did what.
No system is perfectly secure. We do not claim any security certification. If a personal data breach affects you, we will tell the business concerned, and you or the authorities where the law requires it, within the time the law sets.
9. Your rights
Depending on where you live, you may have the right to: - know whether we process your data, and get a copy of it; - correct inaccurate data; - have your data deleted or anonymised; - object to or restrict some processing; - withdraw consent, where we rely on consent; - receive your data in a portable format, where the law gives that right; - complain to a data protection authority. In Egypt this is the Personal Data Protection Center.
How to use your rights: - If you messaged a business that uses All for One, contact that business first. We will help it respond. - If you messaged SMEtools, or cannot reach the business, email info@smetools.io. Include the WhatsApp number you used, so we can find your records. We may ask you to prove the number is yours. - For deletion, see our Data Deletion page: legal.smetools.io/data-deletion.
We reply within 30 days.
10. Children
All for One is a business support service. It is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, contact info@smetools.io and we will delete it.
11. Contact
SMETOOLS LLC
101 Dowd Ct, Folsom, CA 95630, United States
Email: info@smetools.io
12. Changes to this policy
We may update this policy as the service changes, for example when the transfer review is finished or new features are added. We will change the "Last updated" date at the top. If a change is significant, we will also tell the businesses that use All for One before it takes effect.