Privacy Policy

Tawwash is the trading name of the service. It is operated from Kuwait by its owner, who is the party responsible for your data and acts as its controller.

Full details of the operator are provided on request to the competent supervisory authorities, and to any user who needs them to exercise their rights. Contact: [email protected]

Subscriptions are purchased from Lemon Squeezy as Merchant of Record; they issue your invoice and control the payment data.

Account data: your name, email, and phone number at sign-up.

Business data: your store name, description, brand identity, and the products you enter to generate content.

Contact data you upload for email and messaging campaigns, including names, phone numbers, and email addresses.

Technical usage data: browser type, network address, and access logs, for security and service improvement.

We use your data to operate the service: generating marketing content, sending campaigns on your behalf, managing your subscription, providing support, and improving and protecting the platform.

We do not sell your personal data to any third party, and we do not use your store content to train general-purpose AI models.

We rely on trusted providers to run parts of the service, and your data is processed by them under their own policies:

Vercel — hosting and infrastructure that run the site and servers.

Supabase — database and authentication that store your account securely (EU servers).

Google (Gemini) and Anthropic (Claude) — generating text, images and video from your inputs.

Lemon Squeezy — processing subscriptions in US dollars as Merchant of Record; we never store your card details, they are handled directly by the provider.

Resend — delivering campaign and operational email.

Meta and the publishing platforms you optionally connect to your account.

Some of these providers sit outside your region, so data reaches them under the Standard Contractual Clauses or their equivalent in our agreements with them.

Performance of a contract: running your account and subscription and generating the content you ask for.

Legitimate interests: platform security, abuse prevention, and improving the service.

Legal obligation: keeping accounting and tax records.

Consent: when you ask us to connect your publishing and advertising accounts.

We use essential cookies to keep you signed in and secure your account. We do not use third-party advertising or tracking cookies.

We keep your data while your account is active. When you request account deletion we carry it out within 30 days.

Two exceptions: accounting records and invoices are kept for the period tax rules require, and security logs are kept for up to 12 months.

You have the right to access, correct or delete your data, to receive a copy of it in a portable format, to object to or restrict processing, and to withdraw consent at any time. To exercise any of these rights, email us at the address below; we respond within 30 days.

If you live somewhere that grants it, you also have the right to complain to your national data-protection authority.

You also confirm that the contacts you upload for campaigns have agreed to receive your messages, and that you are responsible for complying with applicable data-protection laws.

The contacts you upload for campaigns remain your data. We process them on your behalf and on your instructions alone; we never use them for our own purposes and never sell them.

Everyone with access is bound to confidentiality, we use only the providers named above, we help you answer data-subject requests, and we delete the contacts when your account is deleted.

Every campaign email carries a one-click unsubscribe link, and we honour an opt-out automatically on every later send.

You remain responsible for confirming that these people agreed to receive your messages. If you need a signed Data Processing Agreement, email us at the address below.

We apply technical and organizational measures to protect your data, including encryption in transit, access controls, and per-account isolation enforced at the database level. No system on the internet can guarantee absolute security, but we always aim for the highest possible standard.

We may update this policy from time to time, and will post the updated version on this page with a revised last-updated date.

For any privacy question, email us at:

[email protected]