SAPARAI PRIVACY AND PERSONAL DATA PROCESSING POLICY

The Service is provided by:

hereinafter referred to as "SaparAI", "we", "us", and "our".

Depending on the specific operation, SaparAI may act as the owner and (or) operator of a digital object containing personal data, or as a third party within the meaning of the legislation of the Republic of Kazakhstan.

This Policy has been developed taking into account the applicable provisions of the legislation of the Republic of Kazakhstan, including legislation:

• on personal data and their protection;
• on the digital environment and digital objects;
• on consumer rights protection;
• on the regulation of trading activities;
• on online platforms and online advertising;
• on advertising;
• on entrepreneurial activities;
• on e-commerce;
• as well as other applicable regulatory legal acts of the Republic of Kazakhstan.

If a mandatory provision of law provides the data subject with broader protection than this Policy, that mandatory provision applies.

The Policy may apply to the following categories of persons:

• users of the SaparAI website;
• account holders;
• employees and representatives of SaparAI clients;
• workspace participants;
• users of advertising accounts connected to SaparAI;
• leads and customers of SaparAI users;
• persons interacting with connected WhatsApp Business accounts;
• customers of SaparAI users;
• individuals whose information is lawfully transferred to the CRM;
• persons whose information is received through advertising and analytics integrations;
• other personal data subjects whose information is lawfully processed through SaparAI.

When processing the user's own data, SaparAI independently determines the purposes and methods of processing necessary to provide the account, security, support, billing, operation of the Service, and compliance with the law.

When processing through SaparAI the data of the client's customers, leads, buyers, or other persons, the purposes of commercial processing are primarily determined by the relevant client.

For example, a company may connect its WhatsApp Business, advertising account, or CRM to SaparAI.

In such a case, the company must have its own lawful basis for processing the relevant data.

Use of SaparAI does not relieve the client of its obligations under personal data legislation.

SaparAI retains its obligations for its own processing; the customer’s acceptance of a contract does not replace necessary grounds for processing data of its buyers, workers or correspondents.

SaparAI follows the principle of the minimum necessary volume of data.

We do not intend to collect personal data that is objectively not required to provide the Service or for another lawful purpose.

Users are prohibited from using SaparAI as a repository for excessive information about individuals.

When an account is created and used, the following may be processed:

• first name;
• last name;
• email;
• phone number, if provided;
• account identifier;
• avatar, if provided;
• organization name;
• role;
• workspace;
• user settings;
• language;
• time zone;
• information about connected features;
• account creation and modification history.

To protect SaparAI, the following may be processed:

• IP address;
• browser information;
• device type;
• operating system;
• session information;
• date and time of authorization;
• security events;
• data about failed login attempts;
• request identifiers;
• MFA status;
• one-time codes;
• TOTP-related technical information;
• OAuth state information;
• data about changes to security settings;
• information about potentially suspicious actions.

Passwords are not intended to be stored in readable plaintext.

The user may provide:

• company name;
• company description;
• website;
• information about products;
• information about services;
• prices;
• target audience;
• geographic area of operation;
• positioning;
• brand materials;
• logos;
• photographs;
• video materials;
• advertising materials;
• presentations;
• documents;
• marketing strategy;
• competitive information;
• business metrics;
• other materials necessary for the user to work with SaparAI.

When an advertising account is voluntarily connected, SaparAI may receive and process, within the permissions granted by the user:

• advertising account ID;
• Business Account ID;
• campaign ID;
• ad set ID;
• ad ID;
• creative ID;
• page ID;
• Instagram Account ID;
• pixel/dataset identifiers;
• campaigns;
• creatives;
• ads;
• statuses;
• budgets;
• bid settings;
• audience-related settings;
• impressions;
• reach;
• clicks;
• CTR;
• CPM;
• CPC;
• CPL;
• CPA;
• spend;
• conversions;
• ROAS;
• revenue-related information;
• other performance metrics provided by the relevant advertising platform.

If the user connects Meta, SaparAI may interact, within the user's permissions, with:

• Meta Business;
• Meta Ads;
• Facebook Pages;
• Instagram Business or Creator Accounts;
• Meta datasets;
• Conversions API;
• WhatsApp Business;
• related advertising objects.

SaparAI does not acquire ownership of the user's Meta accounts.

The user may revoke permissions through SaparAI or Meta interfaces, if the relevant mechanism is available.

Depending on the permissions actually granted, Instagram data may include professional account IDs and usernames, media IDs, captions and media, comments and commenter identifiers, message content and participants, delivery events, and account/media insights. SaparAI uses this data to show connected content and insights, match a user-configured comment rule, send a configured public or private reply where the platform permits it, and record that interaction and its CRM source.

Access credentials authorize server-side API requests. SaparAI does not ask for your Facebook or Instagram password. Revoking access prevents subsequent authorized API use; deletion of previously stored copies is a separate request described in the deletion instructions.

When TikTok Advertising and related services are connected, information about the following may be processed:

• advertising account;
• campaigns;
• ad groups;
• ads;
• creatives;
• spend;
• impressions;
• clicks;
• conversions;
• statuses;
• other available statistics.

When the relevant features are available and connected, SaparAI may interact with Google Ads, YouTube Ads, Google Calendar, and other Google services only after the necessary permissions have been granted by the user.

The categories of available data are determined by the specific Google API and the OAuth scope granted.

Connecting one Google service does not mean that SaparAI is automatically granted access to all Google Account data.

When WhatsApp Business is connected, SaparAI may receive:

• sender's phone number;
• profile name;
• WhatsApp identifiers;
• message text;
• media metadata;
• attachments, when their processing is necessary;
• message date and time;
• delivery/read status;
• conversation identifiers;
• referral information;
• Meta advertising identifiers;
• information linking the conversation to advertising;
• data entered by the user during the conversation.

SaparAI may link the relevant message to:

• CRM customer;
• lead;
• order;
• advertising;
• campaign;
• creative;
• acquisition source.

SaparAI may process CRM information, including:

• name;
• phone number;
• email;
• CRM ID;
• lead ID;
• customer ID;
• deal stage;
• status;
• source;
• communication history;
• comments;
• responsible employee;
• orders;
• amount;
• currency;
• purchase information;
• purchase date;
• repeat purchases;
• conversion status.

Data may come both from SaparAI's CRM and from connected CRMs, such as amoCRM.

For attribution and marketing analytics, the following may be processed:

• order number;
• customer reference;
• products;
• quantity;
• cost;
• total amount;
• currency;
• date;
• order status;
• payment status;
• order source;
• attribution information;
• campaign/ad/creative relationship.

SaparAI should not process the user's full bank card data unless a separate payment function expressly provides otherwise.

The planned payment method for SaparAI services is Kaspi QR. When available for a particular order, payment is confirmed in the Kaspi.kz application. Banking processing is governed by the applicable Kaspi service terms; this Policy describes processing by SaparAI and does not replace the bank’s terms.

For invoicing, reconciliation, access, refunds and mandatory records, SaparAI processes invoice and transaction references, amount, currency, date and time, status, the associated account or organization and confirmation details. The payer’s name and message may be received through a Kaspi Pay notification where the selected payment method provides them. Additional refund information is requested only when necessary.

SaparAI does not require a card number, CVV/CVC, PIN, Kaspi password or SMS code to be entered in the service. Do not send statements showing unrelated transactions, balances or other people’s data: reconciliation only needs details of the particular payment. Payment is not consent to marketing, AI training or advertising matching of payment data.

SaparAI may use technical signals to determine the source of a customer or order.

Such data includes:

• UTM;
• click ID;
• fbclid;
• fbc;
• advertising identifiers;
• referral data;
• tracked link identifiers;
• creative ID;
• ad ID;
• campaign ID;
• timestamp;
• session-related attribution information;
• order-linked click evidence.

Attribution may be:

• confirmed;
• probable;
• ambiguous;
• undetermined.

If the technical evidence is insufficient, SaparAI is not required to assign a source artificially.

The attribution result is an analytical conclusion and does not guarantee the existence of a direct causal relationship between an advertising impression and a purchase.

If the client enables the relevant feature, SaparAI may transmit conversion events to Meta or another supported advertising platform.

For example:

• Purchase;
• Lead;
• other supported events.

Platform-permitted identifiers may be used for matching, including hashed or otherwise protected identifying information.

The client must have a lawful basis for this transfer of data to the advertising platform.

SaparAI uses artificial intelligence technologies.

The following may be processed:

• request text;
• AI conversation;
• uploaded document;
• image;
• video;
• audio;
• transcription;
• business description;
• marketing information;
• performance data;
• creatives;
• previous AI output;
• other information that the user has provided to the AI feature.

To implement AI features, SaparAI may use its own systems and third-party providers, including, where the relevant feature is available:

• OpenAI;
• Google;
• other AI/API infrastructure providers.

SaparAI strives to transfer to a provider only the information necessary to perform the specific function.

The user should not place third-party personal data in an AI prompt if such data is not needed for a lawful purpose.

The conversation context and saved business memory may be transmitted, not only the latest prompt. Provider retention, staff access and training use depend on the applicable agreement and settings; this Policy does not promise that all providers have no logs or have training disabled.

Some SaparAI features may perform automated data processing.

This may include:

• classification;
• attribution;
• AI analysis;
• assessment of advertising effectiveness;
• task prioritization;
• creation of recommendations;
• detection of anomalies;
• preparation of proposals;
• automatic execution of pre-authorized advertising operations.

Article 19-1 prohibits automated processing that creates, changes or terminates a subject’s rights or lawful interests, except with the subject’s consent or where legislation permits it. The procedure, consequences, objections and remedies must be explained. Human involvement alone does not rule out application of this article.

SaparAI's AI and automated systems may analyze advertising effectiveness and propose:

• budget changes;
• suspension;
• launch;
• status change;
• a new creative;
• a new campaign;
• a change to the advertising campaign structure;
• other supported actions.

Such operations are not intended for making decisions about the legal rights of individuals.

SaparAI strives to use authorization mechanisms, limits, policy checks, approval flow, and audit records for financially significant operations.

Data may be received:

• directly from the subject;
• from the user's organization;
• from the workspace administrator;
• from a CRM connected by the user;
• from WhatsApp;
• from Meta;
• from Instagram;
• from TikTok;
• from Google;
• from the user's files;
• from an order form;
• through an API;
• through webhooks;
• from advertising referrals;
• from other systems connected by the user.

SaparAI does not assume that any information published online may automatically be freely used without restrictions.

When using publicly available personal data, SaparAI and the user must take into account applicable legislation, including requirements for the lawfulness of subsequent collection and processing.

SaparAI prohibits using the Service for non-targeted mass extraction of personal data from public sources for the purpose of creating or expanding unlawful databases.

Personal data may be processed for:

• providing the Service;
• creating an account;
• authentication;
• MFA;
• ensuring security;
• support;
• synchronizing integrations;
• analyzing advertising;
• creating advertising;
• managing advertising;
• CRM;
• WhatsApp;
• attribution;
• working with orders;
• matching advertising with sales;
• preparing reports;
• AI features;
• detecting errors;
• preventing abuse;
• compliance with the law;
• resolving disputes;
• protecting the rights of SaparAI, the user, and third parties;
• ensuring the operability of the infrastructure.

Where the law requires consent, processing is carried out after the relevant consent has been obtained.

Processing without consent is carried out only in cases expressly permitted by the legislation of the Republic of Kazakhstan.

SaparAI does not treat an abstract 'commercial interest' as an automatic basis for ignoring a consent requirement.

This Policy explains processing and does not replace required consent. Registration, OAuth, scanning a QR code, payment and continued use do not by themselves constitute consent to every use of personal data.

Where consent is required, before processing starts it must identify the operator and its IIN/BIN, the subject’s full name, its duration or period, the data collected, third-party transfers, cross-border transfers and disclosure in public sources. Purposes must be specific and determined in advance. Receipt and content of consent must be provable; a separate choice is needed where a purpose requires independent consent.

To provide SaparAI features, certain data may be transferred to technology providers.

Depending on the features used by the user, these may include:

• Supabase;
• Railway;
• OpenAI;
• Google;
• Meta Platforms;
• TikTok;
• amoCRM;
• Resend;
• payment infrastructure providers;
• cloud infrastructure providers;
• providers of security/monitoring tools;
• other processors and subprocessors.

The transfer is limited to the information necessary for the relevant function.

Payment through Kaspi QR also involves the relevant Kaspi services. Their banking obligations and independent processing are governed by the applicable Kaspi terms.

Transfers outside Kazakhstan are governed separately from local storage. Article 16 of Kazakhstan’s Law on Personal Data and their Protection requires protection of personal data by the destination state; transfers to states that do not provide such protection require consent to the cross-border transfer or another exception expressly provided by that article. Other requirements for lawful processing still apply.

Recipients, countries, data categories, purposes and grounds must be established before transfer. A blanket permission for any future foreign service is insufficient. Consent to a foreign transfer does not remove the local storage obligation.

Sapar uses cloud providers to store data and operate the service. Personal data is stored and processed, including outside the Republic of Kazakhstan.

Depending on the features used, data is transferred to infrastructure providers, artificial intelligence providers and connected integrations to perform the corresponding tasks. Transfers take place with the necessary consent or another legal basis provided by law.

Information about recipients, countries of processing and the data transferred can be requested from Sapar support at admin@saparai.com.

Article 12(2) of Kazakhstan’s Law on Personal Data and their Protection requires personal data to be stored in a database and/or digital object located in the Republic of Kazakhstan. This concerns data storage location, not merely where the operator is registered.

SaparAI may use:

• cookies;
• localStorage;
• sessionStorage;
• similar browser technologies.

They may be used for:

• sessions;
• authentication;
• CSRF/security protections;
• user settings;
• language;
• interface state;
• attribution;
• saving the user's choice;
• analytics where the necessary consent is available.

Strictly necessary technologies may be used without separate marketing consent within the limits permitted by law.

SaparAI may use analytics systems only in accordance with applicable requirements.

Optional analytics for which consent is required must be activated after the relevant consent has been obtained.

SaparAI does not intend to transfer to analytics systems:

• passwords;
• access tokens;
• OAuth authorization codes;
• full WhatsApp content;
• user secrets;
• banking data;
• other clearly confidential information.

When enabled, SaparAI uses PostHog for optional onboarding analytics only after your separate permission. We send the names of onboarding steps and confirmed actions, timestamps, interface language, result status and technical account, workspace and onboarding identifiers. These identifiers are pseudonymous, not anonymous. We do not send form text, search phrases, business reports, conversations, email addresses or page URLs. Session recording, automatic click collection and automatic page views are disabled.

Your choice is stored for this account in this browser and can be changed using Analytics settings in the application. Declining or withdrawing permission does not restrict the application. Withdrawal stops subsequent collection; it does not by itself delete events already received. You can request deletion through admin@saparai.com. PostHog receives network information needed to deliver requests; geolocation enrichment is disabled. The project region and international-transfer conditions must be checked before analytics is enabled. Under the initial free-plan configuration, event retention is up to one year, unless deleted earlier.

To measure its own advertising, SaparAI may separately offer sending confirmed registration and first-result-view events to Meta during the first week of setup. Sending starts only after separate permission in Measure our advertising in onboarding or workspace settings. We send the event name and time, a random event identifier, a page URL without parameters, browser information and a SHA-256 hash of the verified email for ad matching. Hashing does not make the data anonymous. Profile content, queries, conversations and research results are not shared. Your choice is stored on the server for your account; declining does not restrict the product. Withdrawal cancels events that have not been sent, although a transfer already in progress may complete. Event queue records are retained for up to 90 days after delivery settles; deleting the account deletes them and the permission record. For deletion of data already received by Meta, contact admin@saparai.com. This transfer does not use the connected advertising accounts of other SaparAI customers.

SaparAI may send necessary service messages related to:

• security;
• the account;
• integrations;
• payment;
• changes to the Service;
• legal notices.

Marketing messages are sent in compliance with applicable law and available opt-out mechanisms.

Opting out of marketing messages does not necessarily stop mandatory service notifications.

SaparAI does not sell personal data as a standalone product and does not give third parties the right to purchase the customer databases of SaparAI users.

The transfer of data to a technology provider to provide a service is not considered by SaparAI to be a sale of data.

SaparAI is not intended to store, without necessity:

• copies of identity documents;
• IINs of clients;
• medical diagnoses;
• biometric templates;
• health data;
• bank card credentials;
• passwords for third-party services;
• special state secrets;
• other high-risk information,

unless the relevant feature expressly provides for its lawful and protected processing.

The user must not upload such information without necessity and a lawful basis.

SaparAI is primarily intended for the professional and commercial activities of persons who have reached adulthood.

Creation of an independent commercial account by a person under 18 is not permitted if that person does not have the necessary legal capacity and authorization in accordance with the law.

SaparAI is not intended for unlawful profiling of minors.

SaparAI is prohibited from being used for discriminatory or other unlawful targeting.

The user must take into account legislation, advertising platform rules, and restrictions relating to:

• minors;
• health;
• financial situation;
• political and other sensitive topics;
• other regulated categories.

SaparAI stores data no longer than necessary for a lawful purpose, unless a longer period is required by law or is related to an outstanding obligation.

The period depends on the category of data.

Account information is generally stored while the account exists.

After disconnection, active integration tokens must be revoked or deleted when access is no longer lawfully needed. Audit records should retain minimum action details rather than a secret capable of authorizing new operations.

CRM and order data are stored while the relevant organization uses them for a lawful business purpose.

Attribution evidence is stored while necessary for analytics, reporting, and confirmation of the source.

Security logs are stored for the period reasonably necessary for security and investigation.

Financial and other documentation that the law requires to be retained is stored for the period established by law.

Data deleted from the primary system may temporarily remain in protected backups until the next overwrite or deletion cycle.

It must not be used for ordinary activities after deletion from the primary system.

If a backup is restored, SaparAI takes reasonable measures to reapply the deletion previously carried out.

SaparAI applies organizational and technical protection measures appropriate to the nature of the information.

They may include:

• TLS;
• access controls;
• workspace permissions;
• MFA;
• row-level security;
• encryption;
• protection of integration tokens;
• signature verification;
• OAuth protections;
• audit logs;
• rate limiting;
• environment separation;
• backups;
• security monitoring;
• administrative access control;
• webhook protection;
• production environment isolation;
• idempotency controls;
• other measures.

A description of the measures is not a guarantee of absolute security.

When a personal data security breach is detected, SaparAI:

• takes measures to contain the incident;
• conducts an analysis;
• identifies the affected systems;
• takes measures to prevent further harm;
• retains the necessary information about the incident;
• performs the notification obligations to competent authorities and subjects provided by law.

Article 25(2)(8) requires notification of the competent authority within one working day of discovering a personal data security breach. Subjects are notified in the applicable cases and manner; an internal investigation must not delay mandatory notification.

A subject may contact SaparAI to exercise rights provided by law.

A request may be sent to:

admin@saparai.com

or by phone:

+7 775 072 20 82

To prevent data from being provided to an unauthorized person, SaparAI may request reasonable identity verification.

In the cases and within the limits provided by law, a subject may:

• learn whether their personal data exists;
• receive information about processing provided by law;
• review their data;
• request correction;
• request supplementation;
• request blocking;
• request termination of unlawful processing;
• withdraw consent;
• request deletion or destruction;
• request anonymization in cases provided by law;
• object to certain forms of automated processing;
• challenge the operator's actions;
• contact a government authority;
• bring an action in court.

Article 25(2)(8) of Kazakhstan’s Law on Personal Data and their Protection sets a one-working-day deadline for the cases it covers: correcting or supplementing data on supporting documents, or deleting it where correction is impossible; blocking upon information about unlawful processing conditions; destroying or deleting upon confirmation of a violation; and unblocking where a violation is not confirmed. A general technical cleanup period does not extend these deadlines.

Consent may be withdrawn by contacting admin@saparai.com. Under Article 8(7), within fifteen working days SaparAI must stop the relevant processing unless Kazakhstan law requires it to continue, or provide a reasoned refusal.

Restrictions where withdrawal conflicts with law or an outstanding obligation apply within the statutory limits. They do not permit retention of all data or unrelated marketing. Withdrawal does not invalidate earlier lawful processing.

Objections to automated processing covered by Article 19-1 of Kazakhstan’s Law on Personal Data and their Protection may be sent to admin@saparai.com. They are considered within three working days of receipt and the subject is notified of the outcome. Actions or inaction may be challenged through the procedures established by law.

Request account or integration-data deletion by emailing admin@saparai.com. The steps, verification and scope are explained in the Data Deletion Instructions. Email requests remain available if you cannot sign in or do not have an account.

SaparAI may reasonably verify the requester’s identity and authority before deleting data.

When lawful grounds cease, data must be deleted, destroyed or otherwise handled as required by law. Technical architecture, the absence of a deletion button and archiving do not limit the subject’s rights. Account deletion must end its authority to execute new tasks; associated active tokens and jobs require separate handling.

After account closure only necessary data may be retained on a specific lawful ground, such as mandatory records, an outstanding obligation, an existing dispute or an investigation. Each category requires a duration or ending event, access limits and deletion procedure. Generic security needs or hypothetical future disputes do not justify indefinite retention of all data.

Historical identifiers and hashes that can link a record to a person are not automatically anonymous. They must not authorize new operations by a deleted user. Payment records may be retained under applicable recordkeeping requirements; that does not justify retaining the entire account, conversations or materials.

Deletion from SaparAI does not mean automatic deletion of data from:

• Meta;
• Facebook;
• Instagram;
• WhatsApp;
• TikTok;
• Google;
• amoCRM;
• another independent system.

If necessary, the user must separately use the tools of the relevant platform.

Where a recipient acts on SaparAI’s instructions, SaparAI must arrange compliance with applicable deletion requirements at that recipient. Referring the subject to a supplier does not remove SaparAI’s own obligations.

SaparAI may disclose information to a competent government authority or court if such disclosure is mandatory under the law.

SaparAI is not required to voluntarily disclose more information than is necessary to comply with a lawful requirement.

If SaparAI's business is transferred to a successor in the future, the relevant data may be transferred as part of the succession or another lawful corporate transaction in compliance with the law.

Such a transaction must not be used as a means of unlawfully selling personal data.

SaparAI may update this Policy in connection with:

• changes in law;
• the introduction of a new feature;
• a new integration;
• changes to the infrastructure;
• changes to processing methods;
• security requirements.

The new version contains an update date.

For material changes, SaparAI may notify the user through the account interface, email, or another reasonable channel.

If the law requires new consent, simply continuing to use SaparAI does not replace obtaining that consent.

Where law requires notice of a material change, SaparAI must provide it. A new version does not retroactively legitimize processing that lacked necessary grounds.

This Policy is published in full in Russian, Kazakh and English. The same numbered sections describe the same processing in each language.

Translations do not limit rights provided by mandatory law. If a wording difference affects your understanding, contact support for clarification; mandatory provisions of applicable law prevail.

For personal data matters:

The subject may also use the administrative and judicial remedies provided by the legislation of the Republic of Kazakhstan.