Policy
Privacy Policy

1. What this document is about

Adminak is a Software-as-a-Service (SaaS) that gathers your business messages on Instagram, Telegram and Site into one clean panel, replies to customers with AI, and handles orders, payments and sales reporting.

This document explains what information Adminak collects and processes. Commercial terms and rules of use are set out on the Terms of Service page.

2. Roles: your data and your customers' data

Adminak handles two categories of data, each with different responsibilities:

• Your account data (name, phone, email, subscription and payment details): Adminak itself is responsible for this data.
• Your customers' data (messages, names, phone numbers, addresses, orders): this data belongs to your business. Adminak merely stores and processes it as a processor, on your instruction. Your business is responsible for obtaining customer consent and complying with the law regarding it.

3. What information we collect

Account information: name, phone number, email, password (hashed), profile picture, two-factor login settings and last activity time.

Business information: shop name and details, products, prices and stock, categories, shipping and return policies, and the instructions you define for the AI.

Messenger connections: Instagram, Telegram and Site page/bot tokens and identifiers needed to send and receive messages.

Conversations and message content: DMs, comments, story replies and mentions, message text, attachments (images, video, audio), reactions and — when a customer sends a location — the geographic coordinates and their approximate address. Received media is copied to our storage so it can be displayed reliably in the panel.

Your customers' data: name, username and profile picture on the source platform, phone number, addresses and postal code, date of birth (if given), internal notes and order history.

Orders and payment: order items, amounts, delivery address, postal tracking code, gateway transaction identifiers (authority, ref id, track id) and, for card-to-card payments, the receipt image the customer sent. Payer card numbers and banking details are not stored on our servers; payment is processed on the gateway.

Settlement and identity data: if you use Adminak's intermediary gateway, we collect national id, IBAN, account holder name and, if needed, card number so we can settle to your account. The national id is encrypted at rest in the database.

Inbound SMS: SMS sent to Adminak's dedicated lines (sender number and body) is stored for follow-up and support.

Technical information: IP address, browser and device details, active sessions, error logs and audit logs of activities performed in the panel.

Support and marketing: support ticket content and attachments, contact-form messages, and your email if you subscribe to the blog newsletter.

4. How we use this information

• To deliver the service itself: receiving and sending messages, generating smart replies, placing orders and processing payment
• Authentication, account security and prevention of abuse and fraud
• Calculating subscription limits, invoicing and settlement
• Sending essential service notifications (SMS, email, push, Telegram)
• Support and troubleshooting
• System health monitoring and aggregate quality improvement

Adminak does not sell your data or your customers' data, and does not share it for third-party advertising.

5. AI processing — important

Smart replies are at the heart of Adminak, and they are produced by language models. We describe this processing openly:

• To produce each reply, part of the data is sent to the model provider: the recent messages of that conversation, shop information, the product and price list, and information the customer gives during checkout (such as name, phone number and address).
• Model providers are selectable and may include Google Gemini, OpenAI, Anthropic Claude or DeepSeek. These services are hosted outside your region, so this data may cross international borders. In specific configurations, a self-hosted model (Ollama) is also available.
• Adminak does not use your conversation content to train its own models.
• You can switch this processing off. AI can be disabled team-wide or per conversation. When it is off, that conversation's content is not sent to any model provider.
• For each request, only usage information (model, token count, time) is logged for subscription-limit calculations; message text is not stored in these logs, and the logs are cleared after 30 days.

If your business does not want customer conversation content processed by third-party services, disable the AI feature before using the service.

6. Sharing with third-party services (processors)

To deliver the service, some data is transferred to the following services, each with access to only the minimum data required:

• Messaging platforms: Instagram, Telegram and Site (Instagram is operated by Meta) — to receive and send messages
• AI providers: per section 5
• SMS providers: Kavenegar, Melipayamak, Ghasedak, Faraz SMS and SMS.ir — recipient number and message body
• Mobile push: Firebase Cloud Messaging (Google) — device token and notification text
• Payment gateways: connected gateways — amount and transaction id
• Identity checks: Zohal (zohal.io) for matching national id with phone number (Shahkar) when settlement is enabled
• Infrastructure and storage: cloud servers and object storage that host the files and database

Outside these cases, your data is disclosed to others only when required by law and pursuant to an order from a competent judicial authority.

7. Where data is stored

Your database and files are held on the cloud infrastructure Adminak uses. However, as explained in sections 5 and 6, some processing (especially AI and mobile push) is inevitably performed by services outside the country and its traffic goes over international routes.

8. Security

• Passwords are stored hashed and irreversibly, and two-factor login is available
• Sensitive connection tokens and national id are stored encrypted in the database
• All communications use HTTPS, and inbound webhooks are validated with a per-team signature
• Each business's data is scoped at the database level to its team, and users from other teams have no access

No system is 100% impenetrable; in the event of a breach that puts your data at risk, we will notify you as soon as possible.

9. Support team access

In limited cases and for troubleshooting, Adminak staff may temporarily access your panel. Every such access is logged along with the staff id, start and end times and IP address.

10. Retention and deletion

While your account is active, data is kept to deliver the service. Details:

• After a subscription ends, feature access is restricted but your data is not deleted immediately, so your business information is not lost if you renew
• When you request account deletion or delete a team from the panel, that team's conversations, customers, orders and files are removed
• Technical logs are cleared automatically on a schedule (AI usage logs after 30 days, search analytics after 60 days, activity logs after 180 days)
• Certain financial records and invoices may be retained to comply with legal and accounting requirements

For complete data deletion you may submit a request via support.

11. Your rights

• View and correct account and business information from within the panel
• Export orders, products and reports as Excel and PDF
• Disable AI processing
• Request account and associated data deletion
• Unsubscribe from the newsletter via the link at the bottom of each email

12. Cookies

Adminak uses only essential cookies: a session cookie to keep your login state and a CSRF cookie for form security. We place no advertising or third-party tracking cookies on the site.

13. Underage users

Adminak is a service for businesses and is not designed for people under 18. If we learn an account belongs to a minor, we will remove it.

14. Changes to this policy

This document is updated when features or partner services change. Material changes are announced via the panel or email, and continued use of the service means acceptance of the new version.

15. Contact us

For any question or request about your data, please use the Contact page or the in-panel ticket system.

Last updated: Mordad 1404