Who this policy covers

This policy covers RAFID CMS at rafid-crm.app, including its account, workspace, company email and WhatsApp features. Mircado LLC operates RAFID and handles information needed to administer the service. A company using RAFID decides what customer, employee and business information to put in its workspace and which employees may access it.

For information entered by a company, contact that company about its business decisions and privacy practices. You may also contact us at [email protected] for requests concerning RAFID or help identifying the responsible workspace.

Information we process

• Account and membership: email address, display name, account identifier, verification state, company memberships, assigned roles and invitations. Firebase Authentication manages account authentication; CRM records do not contain your Firebase account password.
• Workspace records: contacts, companies, opportunities, tasks, meetings, conversations, service requests, reports, products, quotes, workflow settings and company preferences. Enabled company operations may also contain purchase orders, inventory and shipment records, service engagements, accounting journals, invoices, collections, business payment evidence and private business documents. HR-enabled workspaces may contain recruitment, employee, attendance, leave, performance, compensation, payroll and bank details entered by authorized members. Scoped roles and sensitive-field controls determine access to those records.
• Company email: verified domains, DNS verification results, mailbox addresses and assignments, email messages, attachments, folders, drafts and delivery-related information for mailboxes connected through RAFID.
• WhatsApp and Meta: authorized business account and phone identifiers, number status, business profile details, templates, connection credentials, inbox access assignments, participant phone numbers, message content, supported attachments, timestamps, delivery/read events and recorded message statistics. Connection data comes from the business owner's Meta authorization. RAFID receives new message events after connection; it does not automatically import earlier WhatsApp history.
• Billing: company billing name, contact email, address and optional registration details, selected plan, purchased seats, checkout references, payment amounts, statuses and receipts. Card and wallet details entered at Wayl hosted checkout are handled by Wayl; RAFID does not collect those payment credentials.
• Operational information: request and error records needed to run the service, such as IP addresses, request paths, timestamps and response status. Your browser may store authentication state and workspace preferences.

Digital payroll payments

If a company enables ZainCash payroll distribution, RAFID sends approved payment amounts, employee wallet phone numbers, payment references and an operational description to ZainCash. Company-authorized payroll and finance staff can verify wallet details and track payment results within their permissions. Connection credentials are encrypted on the server and are not returned to employees. Each company funds its own business wallet and must complete ZainCash onboarding.

Payment history and accounting records remain with the company. Sandbox tests do not mark live salaries paid. Disconnecting removes the saved connection; it does not close the external wallet or delete records held by ZainCash. Outstanding live payments must be reconciled before company deletion.

Field-location maps

When a company enables field duty, RAFID displays permitted employee locations and assigned territories in Google Maps on the website and in the supported mobile map providers. Only the owner and explicitly assigned responsible managers can view team locations; employees can view their own permitted duty information.

Opening a map loads the map provider and map content for the displayed area. Supervisors do not need to share their own location. Current employee locations are hidden when stale, off duty or outside permitted access. Field locations are available online only and are not stored in RAFID's offline cache.

How we use information

We use this information to authenticate accounts, verify email addresses, isolate company workspaces, enforce roles and inbox access, save and display business records, deliver enabled email and WhatsApp functionality, process requested exports or deletion, provide support and protect the service against misuse.

Owners authorize WhatsApp connections through Meta's Embedded Signup. Authorized teammates can read or reply only to assigned numbers. Free-form WhatsApp replies follow the customer-service window; initiating a conversation outside that window requires an approved supported template and recorded customer permission. RAFID does not use WhatsApp message content for advertising profiles or sell it.

Service providers and disclosure

RAFID uses Google Firebase for authentication and database services, Cloudflare for website delivery and domain infrastructure, Contabo for the server hosting RAFID's integration and mail services, Meta/WhatsApp for authorized WhatsApp Business functionality, and Wayl for hosted payment checkout and payment-status verification. RAFID sends Wayl an opaque payment reference, amount and plan description. Company billing details stay in RAFID; information entered directly in Wayl checkout is processed by Wayl under its own policies. Company email runs on the mail infrastructure used by RAFID. These providers process information required for their respective functions and may operate in countries different from yours.

Data is available to members of your company according to their role and explicit inbox assignments. We may access information when necessary to provide requested support, investigate security or operational problems, or comply with applicable legal obligations. We do not sell personal information. A new optional integration may introduce another provider; its connection information and applicable privacy disclosures should be reviewed before it is enabled.

Meta and WhatsApp operate their own services under their own terms and privacy notices. See WhatsApp's privacy policy and Meta's privacy policy.

Optional AI assistance

When a company owner enables RAFID Assistant, OpenAI processes employee questions, the permitted company-record excerpts needed to answer them, and text extracted from PDFs selected for analysis. General assistant chat does not search private mailboxes or WhatsApp. When an authorized employee requests an inbox reply draft, OpenAI also processes the selected conversation, bounded correspondence with that customer in the same assigned mailbox or WhatsApp number, permitted customer history and accessible reference PDF excerpts. Inbox assignments and reply permissions apply. Employees with contact-edit permission may maintain shared contact context, approved customer facts, collection questions and reply instructions. A company owner may separately authorize inbox automation. An employee must review and authorize each contact/sender rule before automatic replies can be sent without per-message confirmation. OpenAI then processes bounded new correspondence, permitted customer records and explicitly selected company-shared PDF excerpts under that employee’s current access. Draft-only rules require individual reviewed send confirmation. Human requests, opt-outs and unsupported or uncertain requests stop automatic handling. Generated automation text and extracted answer evidence are retained for up to 30 days; minimal handoff and opt-out controls persist until authorized resumption or workspace deletion. Existing inbox history has separate retention. Do not place credentials or sensitive personnel data in shared contact context. When an employee requests a conversation summary, OpenAI processes a bounded excerpt of text readable in that assigned inbox to identify decisions, open questions and suggested follow-up tasks. Attachment contents are excluded from summaries. Summaries and suggestions remain private to that employee. Owners may separately enable scheduled Morning Briefs and select recipients, working days and delivery time. OpenAI Batch processes bounded operational-record snapshots filtered to each recipient’s current permissions; scheduled briefs exclude private inboxes, PDFs, salaries, bank details and personnel notes. Batch input files have a three-day expiry and output files a one-day expiry, with background cleanup after processing or workspace deletion. Private briefs follow platform-controlled retention; audit and usage metadata are separate. A budget-controlled standard API fallback may process the same permitted snapshot if Batch is late. Creating a follow-up requires task permission, review of the exact task text and explicit confirmation; confirmed task text then follows ordinary company task visibility, without attaching the private summary or transcript. RAFID applies current role, record-scope and sensitive-field checks before providing business data to the model.

Conversations are private to their employee within the company. PDF uploads are private by default; an owner may explicitly share a company reference with selected roles, granting those roles access to its contents. Original PDFs, extracted text and answers are retained with the workspace. Removing a PDF from the assistant archives it; complete company deletion removes its retained files and AI records. Requests disable OpenAI response storage using the API storage option; provider-side processing and retention remain subject to the OpenAI project settings and applicable provider policies. Owners can pause new company AI processing. Platform administrators control model availability and usage limits.

Retention and deletion

Workspace records and saved inbox history remain available while the workspace exists unless removed through a supported feature or a verified deletion request. Disconnecting a WhatsApp number stops that RAFID connection and removes its stored connection credential; it retains saved conversation history. It does not delete the business assets held in Meta.

Complete workspace deletion removes its RAFID records, nested WhatsApp data, stored connection credentials, invitations and member links, and its approved company mail accounts and mail storage. It does not delete other workspaces, users' separate login accounts, Meta-owned accounts or numbers, or copies already delivered to recipients. A limited deletion-completion record is retained to report cleanup status. Security records or information subject to a legal retention obligation may be retained where necessary.

Individual account deletion and requests concerning a specific person's records are handled through verified support requests. See our data-deletion instructions for the available actions and their scope. We explain any applicable retention limitations when responding.

Security

RAFID enforces workspace and role access in its database and server APIs. WhatsApp connection credentials and company mailbox passwords are encrypted on the server and are not included in the browser application. Public app traffic uses HTTPS. We verify signed WhatsApp webhooks before storing their events.

You are responsible for safeguarding your account, assigning appropriate roles and inbox permissions, and providing company data only when you have authority to do so. No service can guarantee absolute security.

Your choices and requests

You can update supported account and workspace settings, export permitted records, ask the owner to change your access, disconnect an authorized integration or request deletion. Privacy rights depend on your location and circumstances; contact [email protected] to request access, correction, export or deletion, or raise a concern.

Include your RAFID account email and enough detail to identify the relevant company or connection. We may verify your identity and authority before acting. Do not send account passwords, access tokens, app secrets or confidential message content in an initial request.

Browser storage and intended users

RAFID uses browser storage needed for authentication, session continuity and saved interface preferences. Its Meta SDK supports the owner's connection flow; automatic Meta app event logging is disabled in RAFID's SDK initialization. These public information pages do not initialize Firebase or the Meta SDK.

RAFID is a business service intended for authorized company users, not for children. If you believe a child has provided personal information to RAFID, contact us.

Changes and contact

We may update this policy as RAFID or its integrations change. The date at the top identifies the current version. Material changes will be communicated through an appropriate service notice. For privacy questions, contact Mircado LLC at [email protected].