Privacy Policy

1. Scope and responsible contact

Services are provided under the name Core, with registration in progress. This policy covers mustafaind.com, private demos, voice and text conversational agents associated with Madar-1, the Co-work system, customer relationship management, and their associated communications and automation. The services currently target clients in Iraq.

This policy does not describe data processing in cybersecurity or penetration-testing services, or by system-maintenance agents. Bringing those services into scope requires appropriate scoping and notice; permission to process data for the covered services does not automatically extend to them.

The Data Integrity Department handles questions and requests concerning this policy at contact@mustafaind.com.

2. Roles of Core and the business client

2.1 Processing for Core's own purposes. Core determines the purposes of processing demo requests, direct communications, and records of its relationship with business clients. It also determines the purposes of preparing eligible data to improve its models, subject to the restrictions in section 7.

2.2 Processing on the client's behalf. When a business uses Core to interact with its customers or operate its business, that client determines the business purpose and content of its records and its users' permissions. Core processes the data needed to deliver the service within the agreed scope and authorized instructions.

2.3 Respective responsibilities. The business client is responsible for providing notices and obtaining the permissions needed to collect its users' data and operate the agent. This policy does not relieve the client of those responsibilities, or Core of its responsibilities for the processing or hosting it performs. Client records hosted on Core's systems remain data that Core processes on the client's behalf; attributing those records to the client does not place them outside Core's technical responsibilities.

3. Data we process and its sources

The data depends on the channel, service, and content supplied by the user or business client, and includes the following categories:

3.1 Identity and contact details: name, telephone number, business name, account identifiers on WhatsApp, Facebook, and Instagram, and contact information supplied with a request.

3.2 Interaction content: incoming messages and responses, recorded calls, complete transcripts, conversation summaries, and uploaded documents and images. Content may include information about the user or other people mentioned during an interaction.

3.3 Operational and personal context: appointments, requests, customer records, and information the client connects to the service, together with context derived from previous interactions, conversational-style preferences, and conversational familiarity.

3.4 Demo-preparation information: information supplied by the business and publicly available information about its activities and services, used to prepare a relevant demo. Research is limited to the business context and does not aim to create profiles of the private lives of owners or employees.

We receive this data directly from you, from the business client, or through the communication channels and systems the client connects to the service. Information may be processed to carry out an interaction without being saved in a separate field; processing is therefore not limited to the data visible in a customer profile.

4. Purposes of use and personalization

We use data to operate conversations, understand requests, provide responses, manage appointments and follow-ups, connect customer records with operations, and carry out actions permitted by the service and its permissions. This includes viewing and updating business information where that capability is enabled and authorized.

We also use conversations and context to assess service quality, understand errors, maintain conversational continuity, and respond to data requests. Training and shared-model improvement are subject to the separate restrictions in section 7; processing content to provide a service does not automatically permit its use for training.

Familiarity and style preferences affect conversational tone only. They are not used to determine prices, eligibility, sales priority, or employee evaluations. We do not use callers' voices for biometric identification or to clone their voices.

Core does not sell data or license it to others for independent use, use customer content for its own advertising or marketing, or share that content with sister companies. We do not present one client's data or conversations as examples for another client. These restrictions do not prevent the necessary service-provider processing described in section 8.

5. Conversations, recording, and notice

The covered services retain calls, their transcripts and summaries, text conversations, and attachments in accordance with the retention periods in section 10. Before interacting, users must be informed that they are communicating with Core's Madar AI, that the conversation is recorded, and that voice and live-conversation processing are operated internally by Core. Any necessary service-provider processing is described in section 8.

Direct demos present a notice explaining recording, the purposes of use, and the possible use of eligible data to improve models. There is currently no separate option to opt out of the use of eligible data for training Core's models while continuing to use the same service; declining the demo terms ends the demo. This does not change the exclusion of Meta-originated data and minors' data from training, or replace any separate consent required by law.

When a conversation takes place on behalf of a business client, that client provides an appropriate notice to its users and identifies the business represented by the agent. Outbound calls and callbacks require the permissions and notices applicable to the channel. Publishing this policy, or merely having a telephone number, is not unlimited permission to record or call.

6. Sensitive data and users under eighteen

6.1 Particularly sensitive data. For this policy, this category includes medical information, academic records, grades and other academic information, and payment details. Academic information does not mean merely a name or contact number provided in a general inquiry.

These categories are deleted from Core's own data fields and are excluded from eligible training data. However, a client may retain them in its own data workspace for its business purposes. Deleting a field also does not automatically remove its contents from a recording, transcript, or original document; those copies remain subject to the retention and deletion provisions. This policy therefore does not promise that no sensitive data will pass through the service or exist in any retained copy.

Sensitive data beyond what the service needs should not be submitted. Passing such data to a provider must be permitted by the service scope and applicable agreements; later deletion from a field does not replace permission for the initial processing.

6.2 Minors. A business client must notify Core in advance when use will involve people under eighteen, so that appropriate service restrictions can be determined. Data of users known to be below that age is excluded from model training. Enabling such use is subject to verification of applicable legal requirements, necessary permissions, and providers' age restrictions; this policy does not grant general permission to override them.

If information indicates that a user is a minor but has not been classified as one, the Data Integrity Department must be notified to review the situation and the scope of use. The notification procedure does not mean that the system automatically verifies every user's age.

7. Model training and improvement

7.1 Purpose. Core uses eligible data to train and improve its shared Madar model, develop instructions, and conduct evaluations. Improvements may serve more than one client without making one client's data available to another.

7.2 Eligibility requirement. Data must not enter shared-model training until identity and contact information, account identifiers, and confidential business information have been removed, and the content has been anonymized and assessed so that individuals cannot reasonably be identified. Merely separating a sample from a person's profile is insufficient. Material that does not meet this requirement remains excluded from training until its assessment is complete.

7.3 Exclusions. Meta-originated data received through WhatsApp, Facebook, and Instagram is excluded from training and improving Core's models. This includes recordings, text, summaries, images, documents, and any derived data, even if transferred into Core's systems or stripped of identifiers. Data of known minors, sensitive data, and any material whose permissions or source terms do not allow such use are also excluded.

7.4 Evaluation and operation. The exclusion does not prevent operating a conversation or checking the quality of service delivery where the channel's terms permit it. It does prevent converting that material, or results derived from it, into data for training or developing shared models. These uses must remain separate.

7.5 Retention of training material. There is currently no fixed deletion period for material that has actually met the anonymization requirement; it is retained for development purposes. Deleting a person's profile does not automatically extend to material that can no longer be linked to them or to what a model has learned from it. This policy does not promise model unlearning. Information that can still identify a person remains personal data subject to review and data requests.

8. Data access, internal processing and service providers

A business client and its authorized users may access data relating to that business. Agents access customer-management information, such as names, telephone numbers, channel identifiers, and context, and other necessary data according to their granted permissions.

Authorized Core staff may review data to evaluate quality and prepare eligible material for model improvement. Automated coding and development agents are not given access to personally identifying information within their defined work scope. This is distinct from conversation evaluation through an external model provider, which is described separately below.

Depending on the service path used, internal processing and the roles of service providers are as follows:

8.1 Message and call transport: Meta processes the channel, message, and communication data needed to transport an interaction. Asiacell may participate in transporting cellular calls and the associated call data when its integration is activated.

8.2 Internal voice and conversation processing: Core operates voice processing and live conversations internally through Madar on infrastructure it operates. This includes processing incoming audio and text, producing transcripts and spoken responses, and managing recordings and conversation summaries. Transport, hosting and separate conversation evaluation are described in the other subsections of this section.

8.3 Conversation evaluation: Core uses OpenAI's API to process selected conversations and the context needed to evaluate performance quality. Stating this purpose does not mean that all submitted data has been anonymized, or permit excluded data to be used for Core's training.

8.4 Hosting and computation: Google Cloud and Oracle Cloud resources process the data needed to run Core's model. Core's infrastructure hosts data, content, and files as described in section 9.

A provider's use and retention of copies depend on the agreement, settings, and actual service. Provider processing is not described as a sale of data, and a deadline for deleting a record from Core's database does not automatically delete provider-held copies. Limited disclosure may also be necessary in response to a legally binding request; this policy does not grant unrestricted permission for voluntary disclosure to others.

9. Processing and storage locations

Core's data storage locations include Baghdad, Iraq; Doha, Qatar; and Berlin, Germany. Model processing uses cloud resources that Core aims to operate in Saudi Arabia, Oman, and the United Arab Emirates, with the possibility of using other locations, including countries in the European Union and the United States, depending on load distribution and network needs.

Data may therefore be transferred or accessed from outside Iraq even when the client and its users are in Iraq. Processing locations differ from storage locations, and communications, hosting, and evaluation providers may operate from other locations. This policy does not commit to keeping data within a single country; a location restriction requires a specific agreement and implementation before operation.

10. Data retention

Retention varies by the record type and the party determining its purpose, as follows:

10.1 Records of Core's relationship with a business client: throughout the relationship and for one year after contract termination, unless an in-scope deletion request is completed earlier or a specific applicable obligation requires retention.

10.2 Individual identity-linked records held by Core: one year from the person's last interaction with its systems. A later interaction restarts the retention period for the identity-linked record; it does not automatically set the retention period for each recording or raw file.

10.3 Recordings, raw transcripts, original documents and images, and backups held by Core: two years from the original recording or creation of the content within the service, or from receipt of an uploaded original. The content is automatically deleted when the two-year period expires, subject to the specific retention exceptions below. Backups follow the original content's recording, creation, or receipt time; copying, transferring, or creating a backup does not restart the period.

10.4 Business-client workspace data: the client's instructions and the agreed scope determine retention of the copy Core manages on its behalf. Deleting Core's own profile of a person does not automatically delete the client's record. Likewise, expiry of the one-year retention period for Core's client-relationship records does not mean all client-workspace data has been deleted.

10.5 Anonymized training material: section 7 applies, and the retention period for identity records does not automatically apply to it. Service providers' copies are governed by their retention periods, settings, and agreements; they are not all governed by Core's two-year period.

A limited record may need to be retained to evidence consent, address a dispute, or meet an applicable legal or contractual obligation. Its category, reason, and duration must be determined separately. This exception does not make every conversation eligible for indefinite retention.

11. Access, correction, deletion, and objections

Requests to access, correct, obtain a copy of, or delete data, or to object to a particular use, may be sent to contact@mustafaind.com. The Data Integrity Department reviews the request according to the data involved, the requester's authority, and applicable requirements. Verification of identity or authority to represent a business may be needed before disclosure or action.

If a request concerns your data held for a business using Core, contact that business first so it can identify its records and issue the necessary instructions. You may also contact Core to identify the responsible party, if the business cannot be reached, or if the request concerns Core's independent use. You do not need to go through the business client to object to processing Core determines for its own purposes.

11.1 Scope of deletion targets. Core aims to delete in-scope records linked to an individual's name from its databases within 24 hours, and in-scope records relating to a business client within 48 hours, starting on the business day the request is received, or the next business day if it arrives on a non-business day. When a client deletes its customer's record from the workspace it manages, Core aims to complete deletion of the corresponding in-scope record on its side within 24 hours.

11.2 Limits of those targets. These periods do not mean that every copy in every system will be deleted. They do not automatically include recordings, raw transcripts, uploaded originals, backups, provider-held copies, or training material that has actually been anonymized. Sections 7, 8, and 10 govern those categories, subject to review of any request or obligation requiring broader deletion. Removing a name or link does not automatically anonymize a retained recording.

11.3 Explaining the outcome. The response identifies the records covered by the action and, where applicable, what remains, why it remains, its retention period, or the party managing it. Partial database deletion is not described as complete erasure of personal data. This policy does not restrict any applicable right requiring broader action or deletion.

You may request that interactions or further calls stop. Stopping the service does not by itself erase earlier data; deletion requests and retention periods remain subject to the provisions above. This policy does not create a training opt-out that is not operationally available, while any legally required request remains subject to review.

12. Information protection and internal review

Core conducts internal reviews of its controls with reference to ISO/IEC 27001, the Trust Services Criteria relevant to SOC 2 reports, and the NIST CSF cybersecurity framework. This describes internal review, not independent certification or an external assurance report.

Access is tied to the work purpose, approved permissions, and service scope. Protective procedures and processing risks are reviewed as part of service management. Privacy concerns or suspected unauthorized access can be reported to the Data Integrity Department. Response and notification procedures depend on the incident and the relevant legal and contractual requirements.

13. Website and tracking technologies

Under the website configuration reported for this version, Core does not use analytics tools, advertising tracking, or cookies on its website. This statement does not extend to technologies used by social platforms or independent provider websites when you visit or interact with them.

This section must be updated before session cookies, similar storage, or analytics and tracking tools are enabled on the website, with the necessary notice or choices. The absence of cookies alone does not mean that no technical processing occurs when connecting to the service.

14. Policy updates and contact

The policy is updated when there is a material change to processing purposes, data sources, recipient categories, or retention periods. The updated version and its effective date are made available at mustafaind.com, with appropriate notice of material changes before implementation and additional consent where required. Updating this policy does not retroactively authorize training on excluded data.

Responsible contact: Core's Data Integrity Department.

Email: contact@mustafaind.com

Website: mustafaind.com