Privacy Policy

Effective Date: 14 August 2026 Last Updated: 14 August 2026

1. Introduction

StoreAgent is a WhatsApp-first commerce platform operated by BarqAI (“BarqAI”, “we”, “us”, or “our”) for businesses that sell and manage customer orders through conversational channels such as WhatsApp.

StoreAgent helps merchants manage commerce workflows including customer conversations, product information, carts and orders, customer records, payments and payment-proof workflows, fulfilment, local delivery, human handoff, and operational analytics.

This Privacy Policy explains how personal data is collected, used, shared, stored, and protected when:

• a business uses StoreAgent;

• an authorized employee, owner, or team member accesses the StoreAgent dashboard;

• a customer communicates with a merchant through WhatsApp and that merchant uses StoreAgent to manage the conversation or order;

• a person contacts BarqAI for support, sales, onboarding, or other StoreAgent-related purposes; or

• a person visits a StoreAgent or BarqAI webpage that links to this Privacy Policy.

This Privacy Policy should be read together with any applicable merchant agreement, data-processing agreement, terms of service, and the merchant’s own privacy notice.

2. Who StoreAgent Is For

StoreAgent is a business-to-business software service.

Our primary customers are merchants and businesses that use StoreAgent to manage WhatsApp commerce.

There are therefore two important categories of people whose personal data may be processed:

2.1 Merchant Users

These are business owners, employees, administrators, operators, or other authorized users who access or configure StoreAgent.

2.2 Merchant Customers

These are individuals who communicate with a merchant through WhatsApp or another supported channel and whose conversation, order, delivery, payment-workflow, or support information is processed through StoreAgent.

3. Our Role and the Merchant’s Role

Privacy responsibilities depend on whose data is being processed and why.

3.1 Merchant Account and BarqAI Relationship Data

For information BarqAI collects directly to create, manage, secure, bill, support, or administer a merchant’s StoreAgent account, BarqAI generally determines why and how that information is processed.

Examples include:

• account registration information;

• merchant contact information;

• billing and subscription records;

• StoreAgent support communications;

• security and access logs; and

• product usage information used to operate and secure the service.

3.2 Merchant Customer Data

When a merchant uses StoreAgent to communicate with its own customers and manage their orders, the merchant generally determines the business purpose for collecting and using that customer’s information.

In that context, StoreAgent processes customer information to provide the service to the merchant.

The merchant remains responsible for:

• giving its customers any privacy notices required by law;

• ensuring it has an appropriate legal basis for processing customer data;

• deciding what customer information should be collected;

• responding to customer privacy requests where required;

• configuring StoreAgent in a lawful way; and

• ensuring its use of WhatsApp, marketing communications, delivery services, and other connected services complies with applicable law.

If you are a customer of a merchant that uses StoreAgent, you may need to contact that merchant directly regarding how the merchant uses your information.

4. Personal Data We May Process

The personal data processed through StoreAgent depends on how a merchant configures and uses the service.

4.1 Merchant and Account Information

We may process information such as:

• name;

• business name;

• email address;

• phone number;

• job title or role;

• login and authentication information;

• team membership and permissions;

• store profile information;

• business settings;

• preferred language;

• support requests;

• onboarding information;

• subscription and billing records; and

• communications with BarqAI.

4.2 Merchant Business and Catalog Information

StoreAgent may process business information uploaded or configured by a merchant, including:

• product names;

• product descriptions;

• SKUs;

• product variants;

• prices;

• discounts;

• product images and media;

• inventory information;

• delivery settings;

• payment methods;

• fulfilment settings;

• business rules; and

• internal notes.

Some of this information may not be personal data, but it can become associated with personal data in orders, conversations, or account activity.

4.3 WhatsApp Conversation Data

When a merchant uses StoreAgent to manage customer conversations, StoreAgent may process:

• WhatsApp phone number;

• display name or profile information made available through the messaging channel;

• message content;

• message timestamps;

• product questions;

• product preferences;

• size, color, or variant selections;

• order intent;

• delivery questions;

• payment questions;

• support requests;

• cancellation or return requests;

• attachments or media sent through the conversation;

• conversation status;

• whether AI or a human is handling the conversation; and

• escalation or handoff information.

4.4 Customer and Order Information

StoreAgent may process customer and order data such as:

• customer name;

• phone number;

• email address if provided;

• delivery address;

• area or neighborhood;

• building, floor, unit, or delivery notes;

• location information voluntarily provided for delivery;

• products ordered;

• variants;

• quantities;

• prices;

• cart information;

• order totals;

• order status;

• payment method;

• fulfilment status;

• return or cancellation information;

• customer notes;

• previous order history; and

• conversation history.

4.5 Payment-Workflow Information

StoreAgent is designed to support commerce workflows such as Cash on Delivery and bank transfer.

Depending on the merchant’s configuration, we may process:

• selected payment method;

• amount due;

• payment status;

• Cash on Delivery status;

• payment-proof images or screenshots;

• transfer reference information contained in a payment proof;

• payment-review status;

• merchant approval, rejection, or pending status; and

• payment-related communications.

StoreAgent is not intended to collect passwords, PINs, card security codes, online-banking credentials, or other unnecessary financial credentials.

Customers should not send such information through WhatsApp or StoreAgent.

A payment-proof screenshot may contain financial information beyond what is needed to confirm a transfer. Merchants should instruct customers to avoid sharing unnecessary financial information where possible.

4.6 Fulfilment and Delivery Information

StoreAgent may process fulfilment information such as:

• delivery address;

• customer phone number;

• delivery notes;

• assigned driver or fulfilment operator;

• driver name and contact details where entered by the merchant;

• vehicle information where configured;

• delivery status;

• failed-delivery status;

• delivery timestamps; and

• Cash on Delivery collection status.

4.7 Technical, Security, and Usage Information

When merchant users access StoreAgent, we may process technical information such as:

• IP address;

• browser type;

• device type;

• operating system;

• session information;

• login activity;

• authentication events;

• security events;

• request and error logs;

• timestamps;

• pages or product features used; and

• diagnostic information.

We use this information primarily to operate, secure, troubleshoot, and improve StoreAgent.

4.8 Support, Sales, and Business Communications

If you contact BarqAI, we may process:

• name;

• email;

• phone number;

• business name;

• message content;

• demo requests;

• onboarding information;

• support tickets;

• troubleshooting details; and

• records of our communications with you.

5. How We Obtain Personal Data

We may receive personal data:

• directly from merchant users;

• directly from merchant customers through WhatsApp;

• from a merchant that uploads or enters information into StoreAgent;

• through supported messaging providers such as WhatsApp;

• from systems or service providers connected by the merchant;

• automatically when a merchant user accesses the StoreAgent dashboard; or

• when a person contacts BarqAI for sales, onboarding, support, or other business purposes.

6. How We Use Personal Data

We may process personal data to:

6.1 Provide StoreAgent

This includes:

• receiving and managing WhatsApp conversations;

• understanding customer messages;

• answering product questions;

• helping customers select products or variants;

• building carts;

• creating and managing orders;

• recording customer details;

• managing payment workflows;

• associating payment proof with an order;

• supporting merchant payment review;

• managing fulfilment and delivery status;

• providing order updates;

• handling returns or cancellations;

• maintaining customer and order history; and

• providing merchant dashboard functionality.

6.2 Provide AI-Assisted Conversation Features

StoreAgent may use AI systems to:

• interpret customer language;

• detect customer intent;

• extract structured information from messages;

• identify relevant products or order context;

• ask clarification questions;

• generate customer-facing responses;

• classify conversations;

• identify situations that may require human attention; and

• assist merchant users with operational workflows.

See Section 7 for more information.

6.3 Provide Human Handoff and Escalation

We may process conversation and order information to:

• identify situations requiring human review;

• route a conversation to a merchant operator;

• preserve relevant context during a takeover;

• record escalation and resolution events; and

• allow the conversation to return to normal StoreAgent operation after resolution.

6.4 Operate the Merchant Account

We may process merchant-user data to:

• create and manage accounts;

• authenticate users;

• manage team roles and permissions;

• provide onboarding;

• provide customer support;

• communicate about service changes;

• manage subscriptions and billing; and

• administer merchant settings.

6.5 Maintain Security and Reliability

We may process information to:

• authenticate users;

• prevent unauthorized access;

• detect misuse or suspicious activity;

• investigate incidents;

• debug failures;

• protect merchants and customers;

• maintain audit and security logs; and

• comply with legal obligations.

6.6 Provide Analytics

StoreAgent may generate merchant-facing analytics using commerce and conversation activity.

Examples may include:

• order volume;

• revenue;

• average order value;

• product performance;

• repeat-customer activity;

• conversion activity;

• response metrics;

• automation metrics;

• payment status; and

• fulfilment status.

Where appropriate, analytics may be aggregated or de-identified.

6.7 Improve StoreAgent

We may use service, diagnostic, and usage information to improve product reliability, usability, performance, security, and workflows.

Before publication, BarqAI should confirm and document whether any merchant customer conversation content is used for general-purpose AI model training or product-model training. This policy should be updated to describe that practice precisely.

7. AI Processing and Automated Features

StoreAgent uses AI as a conversational and interpretation layer.

AI may help:

• understand natural-language messages;

• support Arabic and English conversations;

• identify products or variants;

• extract customer-provided order details;

• recognize customer intent;

• ask follow-up questions;

• generate replies; and

• identify low-confidence or exceptional cases.

However, StoreAgent is designed so that AI is not the sole authority for high-risk transactional decisions.

For example:

• product price and inventory should come from structured merchant data;

• payment proof may be collected by StoreAgent, but merchant approval may still be required;

• order and fulfilment states should be controlled by StoreAgent’s structured operational logic;

• a human can take over when appropriate.

To provide AI-assisted features, relevant message or order context may be processed by AI infrastructure or AI service providers used by BarqAI.

BarqAI should contractually and technically limit such processing to what is necessary for providing the StoreAgent service and apply appropriate privacy and security safeguards.

8. Legal Grounds for Processing

We process personal data only where there is an appropriate legal basis under applicable law.

Depending on the context, this may include:

• the individual’s consent where required;

• processing necessary to provide StoreAgent or perform contractual obligations;

• processing required to comply with applicable law or legal obligations;

• processing needed to protect StoreAgent, merchants, users, or systems from fraud, misuse, or security threats; or

• another lawful basis permitted under applicable privacy law.

Merchants are responsible for ensuring that their own collection and use of merchant-customer data through StoreAgent has an appropriate legal basis.

9. When We Share Personal Data

We do not disclose personal data indiscriminately.

Personal data may be shared with the following categories of recipients when necessary.

9.1 The Merchant and Its Authorized Users

Merchant customer data is made available to the merchant and authorized merchant team members as necessary to manage:

• conversations;

• orders;

• approvals;

• payments;

• customer support;

• fulfilment;

• delivery;

• returns; and

• analytics.

9.2 Messaging Providers

StoreAgent relies on messaging infrastructure to receive and send customer communications.

Where StoreAgent is used with WhatsApp, message data may be processed through services provided by Meta / WhatsApp and any approved messaging infrastructure used for the merchant’s WhatsApp Business connection.

Their own terms and privacy practices may apply to their processing.

9.3 Technology Service Providers

We may use trusted vendors to provide services such as:

• cloud hosting;

• databases;

• infrastructure;

• AI processing;

• message delivery;

• security;

• monitoring;

• authentication;

• support;

• analytics; and

• error reporting.

These providers may process personal data only to the extent necessary to provide services to BarqAI and subject to applicable contractual and legal safeguards.

9.4 Delivery or Fulfilment Participants

Where configured by the merchant, relevant order information may be made available to:

• merchant employees;

• assigned drivers;

• fulfilment personnel; or

• delivery service providers.

Only information reasonably necessary to fulfil the order should be shared.

9.5 Professional Advisers

We may disclose information to professional advisers such as:

• lawyers;

• accountants;

• auditors; or

• security specialists,

where reasonably necessary and subject to confidentiality obligations.

9.6 Legal and Regulatory Disclosures

We may disclose personal data if required to:

• comply with applicable law;

• respond to a lawful government, regulator, court, or law-enforcement request;

• protect legal rights;

• investigate fraud, abuse, or security incidents; or

• establish, exercise, or defend legal claims.

9.7 Corporate Transactions

If BarqAI is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, personal data may be disclosed as part of the transaction subject to appropriate confidentiality and legal safeguards.

10. International and Cross-Border Processing

StoreAgent may rely on messaging, cloud, infrastructure, security, or AI service providers whose systems operate outside Qatar.

As a result, personal data may be processed or stored in countries outside Qatar.

Where cross-border processing occurs, BarqAI will take steps intended to ensure that the transfer and processing are handled in accordance with applicable data-protection requirements, contractual safeguards, and risk-management obligations.

Merchants should also consider whether their own StoreAgent configuration results in cross-border transfers and whether additional notices, consents, or safeguards are required.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to:

• provide StoreAgent;

• maintain order and customer history requested by the merchant;

• comply with merchant instructions;

• meet contractual obligations;

• satisfy legal, accounting, tax, or regulatory requirements;

• maintain security and audit records;

• resolve disputes; and

• enforce agreements.

Different categories of data may have different retention periods.

For merchant-customer data processed on behalf of a merchant, retention may depend on:

• the merchant’s settings;

• the merchant agreement;

• the merchant’s lawful instructions;

• the status of the merchant account; and

• applicable legal obligations.

When personal data is no longer required, we may delete, anonymize, or securely isolate it, subject to legal and technical requirements.

Before publication, BarqAI should confirm whether StoreAgent has fixed default retention periods for conversations, payment proof, orders, security logs, deleted accounts, and backups, and add those periods here if appropriate.

12. Security

BarqAI uses administrative, technical, and organizational safeguards intended to protect personal data against:

• unauthorized access;

• unauthorized disclosure;

• alteration;

• loss;

• misuse;

• accidental destruction; and

• unlawful processing.

Safeguards may include, as appropriate:

• access controls;

• role-based permissions;

• authentication controls;

• tenant isolation;

• logging and audit controls;

• security monitoring;

• protected network and application infrastructure;

• backups;

• incident-response procedures; and

• encryption or equivalent protections where appropriate.

No internet-based service can guarantee absolute security.

Merchant users are responsible for protecting their own account credentials, configuring permissions appropriately, and promptly informing BarqAI of suspected unauthorized access.

13. Personal Data Breaches

If BarqAI becomes aware of a personal data breach affecting StoreAgent, we will investigate and respond in accordance with applicable law and contractual obligations.

Where legally required, BarqAI will notify the relevant regulator, affected merchant, or affected individuals within the required timeframe.

Merchants must notify BarqAI promptly if they become aware of a security incident involving StoreAgent, their StoreAgent account, or customer information processed through StoreAgent.

14. Privacy Rights

Depending on applicable law and the circumstances, individuals may have rights relating to their personal data, including the right to:

• request information about how their personal data is processed;

• request access to personal data;

• request correction of inaccurate or incomplete data;

• request deletion or erasure where applicable;

• withdraw previously given consent where processing relies on consent;

• object to certain processing where applicable; and

• raise a complaint regarding the handling of personal data.

These rights may be subject to legal limitations, verification requirements, and exceptions.

15. Requests from Merchant Customers

If you are a customer of a merchant using StoreAgent and want to:

• access your order information;

• correct your address or customer details;

• delete information;

• withdraw consent;

• object to processing; or

• ask how your information is being used,

you should normally contact the merchant first.

The merchant controls the commercial relationship with you and determines many of the purposes for which your information is processed.

Where BarqAI processes the relevant information on behalf of the merchant, we may assist the merchant in responding to a valid privacy request.

If you contact BarqAI directly about merchant-controlled data, we may need to identify the relevant merchant and refer the request to them.

16. Cookies and Similar Technologies

StoreAgent web applications may use cookies, session technologies, local storage, or similar technologies that are necessary to:

• keep users signed in;

• maintain secure sessions;

• protect against abuse;

• remember essential preferences; and

• operate the StoreAgent dashboard.

BarqAI may also use optional analytics technologies if implemented.

Where non-essential cookies or similar technologies require notice or consent under applicable law, BarqAI should provide appropriate controls.

Before publication, BarqAI should confirm the exact analytics, cookie, tracking, and session technologies used on the current StoreAgent website and dashboard.

17. Marketing Communications

BarqAI may send merchants or prospective merchants information about:

• StoreAgent;

• product updates;

• demos;

• onboarding;

• related BarqAI products; or

• commercial offers,

where permitted by law.

Where consent is required for direct electronic marketing, BarqAI should obtain that consent and provide a way to withdraw it.

Merchants are independently responsible for ensuring that any marketing messages they send to their own customers through WhatsApp or other channels comply with applicable law, customer consent requirements, and platform rules.

18. Children

StoreAgent is designed as business software and is not directed to children.

Merchants should not use StoreAgent to collect personal data from children unless doing so is lawful, necessary for the merchant’s legitimate business activity, and all required parental, guardian, notice, or consent requirements have been satisfied.

If BarqAI becomes aware that personal data relating to a child has been processed unlawfully through StoreAgent, we may take appropriate steps in coordination with the relevant merchant.

19. Special or Highly Sensitive Information

StoreAgent is designed primarily for ordinary commerce data.

Merchants and customers should avoid using StoreAgent to transmit information that is not necessary for the commerce transaction, especially:

• passwords;

• PINs;

• card security codes;

• online-banking credentials;

• government identification documents unless specifically required and lawfully configured;

• health information;

• biometric information; or

• other sensitive or special-nature data.

If a merchant intends to use StoreAgent for a workflow involving sensitive or specially regulated data, that use should be separately reviewed by BarqAI before deployment.

20. Third-Party Services and Links

StoreAgent may interact with or link to services operated by third parties.

Examples may include:

• WhatsApp;

• merchant websites;

• payment providers;

• delivery providers; or

• other merchant-selected services.

BarqAI is not responsible for the independent privacy practices of third-party services.

Users should review the privacy information provided by those third parties.

21. Account Closure and Merchant Termination

When a merchant closes or terminates its StoreAgent account:

• access to StoreAgent may be disabled;

• merchant data may be deleted, exported, anonymized, or retained according to the merchant agreement, applicable retention rules, and legal obligations;

• backups may persist for a limited period as part of secure backup and disaster-recovery procedures; and

• certain records may be retained where required for legal, security, billing, fraud-prevention, dispute-resolution, or audit purposes.

The exact offboarding and deletion process may be described in the applicable merchant agreement or data-processing terms.

22. Changes to This Privacy Policy

We may update this Privacy Policy when:

• StoreAgent changes;

• our data practices change;

• we use new categories of service providers;

• applicable law changes; or

• we need to clarify our practices.

When we make material changes, we will update the “Last Updated” date and provide additional notice where required by law.

23. Contacting BarqAI About Privacy

For questions, complaints, or requests relating to this Privacy Policy or BarqAI’s processing of personal data, contact:

BarqAI / StoreAgent Legal Entity: [INSERT LEGAL ENTITY NAME] Country: Qatar Privacy Email: [INSERT PRIVACY CONTACT EMAIL] Business Address: [INSERT REGISTERED OR BUSINESS ADDRESS]

If your request concerns a merchant’s customer data, please identify the merchant or StoreAgent business involved so that the request can be routed appropriately.

24. Qatar Privacy Law

StoreAgent is Qatar-focused and this Privacy Policy is intended to support BarqAI’s compliance framework under applicable privacy and data-protection requirements, including Qatar Law No. 13 of 2016 on Protecting Personal Data Privacy and guidance issued by Qatar’s competent data-privacy authorities.

Qatar’s privacy framework includes principles and obligations concerning matters such as:

• transparency;

• lawful processing;

• purpose limitation;

• data minimization;

• data accuracy;

• storage limitation;

• confidentiality and security;

• individual rights;

• controller and processor responsibilities;

• direct electronic marketing;

• personal-data sharing;

• cross-border processing; and

• personal data breach management.

Individuals may also have the right to submit complaints to Qatar’s competent data-privacy authority where applicable.