Last updated: 21 September 2026 · Version 2.0
Sahulatcart is a service of Nubrix Technologies (Pvt) Ltd, a company registered in Pakistan, providing an automated WhatsApp sales assistant to merchants. This policy explains what personal data we handle, why, who it is shared with, how long we keep it and how to have it deleted.
Our customers — the shop owners who sign up, connect a WhatsApp number and use the admin portal.
People who message a merchant on WhatsApp. We process your data on that merchant's behalf.
The merchant decides what their shop sells, what it charges, and how long they keep their records. Your relationship for an order is with them, not with us.
| Data | Who decides how it is used | Our role |
|---|---|---|
| Buyer conversations, orders, delivery details, payment screenshots | The merchant | Processor — we act on the merchant's instructions only |
| Merchant account, billing, support and usage data | Sahulatcart | Controller |
| Website analytics and enquiry forms on sahulatcart.com | Sahulatcart | Controller |
Where we are a processor, requests about a specific shop's records are for that merchant to decide, and we will pass your request to them. Where we are a controller, you can come to us directly.
| Data | Why |
|---|---|
| WhatsApp phone number and profile name | To identify the conversation and route replies |
| Message content — text, voice notes, images | To understand the request and reply |
| Voice note transcripts | So a spoken message can be understood and answered |
| Delivery name, address, area and city | To create and fulfil the order |
| Payment screenshots (bank transfer) | So the merchant can verify payment manually |
| Order, negotiation and price history | To maintain the conversation and the merchant's records |
| Opt-out status | To stop messaging you when you ask us to |
Business name, owner name, email address, login credentials (stored hashed by our authentication provider — we never see your password), staff user accounts and roles, product catalogue, pricing and discount rules, knowledge-base content, and the bank account details you choose to show buyers.
Technical logs needed to run and secure the service: IP address, timestamps, request paths, error traces, and message delivery status from WhatsApp. On our marketing website we use only what is necessary to serve the pages; we do not run advertising or cross-site tracking cookies.
Replies are produced with help from an AI language model, which is used to interpret incoming messages, transcribe voice notes, read images, and phrase replies.
Prices are not decided by the AI. All pricing and discount limits are computed by deterministic code from the rules the merchant sets. Every reply that states a price is checked against that code's figure before sending; if they disagree the AI's wording is discarded in favour of a fixed template. The model cannot invent or exceed a discount.
Message content, voice notes and images are sent to our AI provider solely to produce that reply. We use a paid, commercial processing tier under which the provider does not use this content to train or improve its models and does not make it available for human review.
A buyer can ask to speak to a human at any point, and the merchant can take over the conversation. No decision with a legal or similarly significant effect is made about you by automated means.
These commitments are binding on us and reflect the requirements of the WhatsApp Business Solution Terms:
We use the following sub-processors. We do not add a sub-processor that handles buyer data without updating this list.
| Provider | What is shared | Purpose | Where |
|---|---|---|---|
| Meta Platforms / WhatsApp | Messages and media | Sending and receiving WhatsApp messages | USA, EU |
| Google (Gemini API) | Message text, voice notes, product and payment images | Understanding messages and drafting replies | USA |
| Supabase | Database records, uploaded files, authentication | Database, file storage and merchant login | Per project region |
| Railway | Application traffic and logs | Hosting the service | USA |
We may also disclose data where we are legally required to — for example under a valid court order or a lawful request from a competent authority — or where necessary to establish, exercise or defend legal claims. If we are ever party to a merger or acquisition, data may transfer to the successor, who will remain bound by this policy.
Messages sent through the WhatsApp Business Platform are processed on Meta's Cloud API infrastructure and stored in Meta's data centres, currently located in North America and Europe. Meta acts as a processor for the merchant in respect of that content. Data localisation within Pakistan is not available for WhatsApp Business Platform messaging, and neither we nor the merchant can change where Meta processes it.
Sahulatcart is an independent technology provider. We are not affiliated with, endorsed by, or operated by WhatsApp LLC or Meta Platforms, Inc.
We never take custody of money and we are not a payment processor. Orders are Cash on Delivery, or a bank transfer made directly to the merchant's own account. Payment screenshots are stored in a private bucket so the merchant can verify them manually; we do not read, verify or act on them automatically beyond describing the image so the merchant can find it. We do not collect or process card numbers or banking credentials from buyers.
| Data | Retention |
|---|---|
| Conversations and messages | While the merchant's account is active, unless they delete them sooner |
| Orders and order slips | While the account is active, or longer where the merchant must keep records for tax |
| Payment screenshots and inbound media | 12 months, then deleted unless attached to an unresolved dispute |
| Voice notes | Deleted after transcription; the transcript follows the message retention above |
| Opt-out records | Kept indefinitely — we must remember not to message you |
| Technical and security logs | 90 days |
| Merchant account and billing records | Duration of the account, plus the period required by tax law |
| After account closure | 30 days to allow export, then deleted or anonymised |
Merchants control how long their own conversation and order records are kept within these limits and may delete them at any time.
We maintain administrative, physical and technical safeguards appropriate to the sensitivity of the data, including:
No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we will notify the affected merchants without undue delay and support them in notifying buyers where that is appropriate.
You may ask us to:
Buyers: to stop the assistant immediately, reply STOP on WhatsApp. That opts your number out of further messages from that merchant. You can also ask for a human at any time and the assistant will hand the conversation over.
Because we process buyer data on a merchant's behalf, a request about a specific shop's records will be passed to that merchant, who decides it. We will help them act on it. We respond to requests within 30 days.
Full instructions, including what gets deleted and how long it takes, are on our dedicated Data Deletion page. In summary: buyers should contact the merchant they messaged, or us at sahulatcart2026@gmail.com; merchants can close their account from the admin portal or request deletion in writing.
Our sub-processors operate outside Pakistan, principally in the United States and the European Union. Using this service necessarily involves transferring personal data to those countries. We rely on the contractual protections in our agreements with each provider, including their standard data processing terms, to protect that data.
The service is intended for business use by adults and is not directed at children. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it.
At the date of this policy, Pakistan has no comprehensive enacted personal data protection statute; the Personal Data Protection Bill remains in draft before the legislature. We have written this policy to the principles that bill sets out — lawful basis, purpose limitation, data minimisation, retention limits, security and data subject rights — so that the service is ready when it comes into force. We also comply with the Prevention of Electronic Crimes Act 2016 and with Meta's platform requirements, which apply to us contractually regardless of local law.
We may update this policy. For material changes affecting merchants we will give notice by email or in the admin portal before they take effect. The revision date at the top shows when it last changed.
Nubrix Technologies (Pvt) Ltd
Lahore, Pakistan
+92 333 3051094
sahulatcart2026@gmail.com
Or use our contact page. We respond to data requests within 30 days.
Related pages: User Agreement · Data Deletion