01 Introduction
Asaan Intelligence ("Asaan," "we," "us," "our") is committed to protecting the information it handles. This Privacy Policy explains how we collect, use, share, store, and protect information when you use our service, our website, and our communications, including over WhatsApp.
Asaan provides an intelligence service that connects to the point-of-sale (POS) and payment systems a restaurant or hospitality business (a "Client") already uses, and delivers insight and actions to the Client's authorised representatives through WhatsApp.
This Policy applies to all interactions with our service and website, including data processed by third parties on our behalf. It does not govern a Client's own handling of its data, nor the practices of third-party platforms we connect to, such as your POS provider or Meta's WhatsApp platform, each of which maintains its own policy.
The entity responsible for the service is Asaan Innovations SMC. By using the service or providing information to us, you accept the practices described in this Policy.
02 Definitions
- Personal data
- Information relating to an identified or identifiable individual, such as a name, phone number, or a transaction linked to a person.
- Client
- The business that engages Asaan and authorises us to connect to its systems.
- Authorised user
- An owner, partner, or manager the Client designates to receive intelligence and instruct our agents over WhatsApp.
- End customer
- A diner or guest of the Client whose personal data we may process strictly on the Client's behalf.
- Controller / Processor
- A controller decides why and how data is processed; a processor acts on the controller's instructions. As set out in section 03, our role depends on the data concerned.
- Sub-processor
- A third party we engage to help deliver the service, bound by confidentiality and data-protection obligations.
03 Our Role
For information we collect to operate our business and our relationship with you, including the contact details of authorised users, billing records, website logs, and the messages you exchange with us, Asaan acts as the controller.
For the operational data we ingest from your connected systems, including any end-customer personal data within it, the Client is the controller and Asaan is the processor. We process that data only on the Client's documented instructions and only to provide the service. As controller of that data, the Client is responsible for having a lawful basis to collect it and for giving its end customers any notices or obtaining any consents required by law before the data is provided to us.
04 Information We Collect
We do not seek to collect special categories of sensitive personal data, and we ask that you do not route such data to us.
- Account and authorised-user data. Name, role, business email, WhatsApp number, and credentials used to access the service.
- Business and transaction data. Sales, items, voids, comps, discounts, refunds, cash reconciliation, shift and timestamp data, table and check records, and staff identifiers as they appear in your systems.
- End-customer personal data (on the Client's behalf). Where present in your data: diner names, phone numbers, booking details, order and spend history, and loyalty or VIP flags.
- Communications data. The content and metadata of WhatsApp messages between you and our agents, including alerts and instructions.
- Public reputation and competitive data. Publicly available reviews, ratings, menus, prices, and promotions relating to your venue and competitors you name.
- Technical and usage data. Device and connection information, IP address, and access and integration logs.
05 How We Collect Information
Information may be submitted to us deliberately or automatically. There are inherent risks in transmitting information over the internet, and while we apply reasonable safeguards, any transmission is at your own risk.
- Through authorised connections to your POS and payment systems, using their official interfaces.
- Through the WhatsApp Business Platform, when we deliver intelligence and receive your instructions.
- From publicly available sources, for reviews and competitor information.
- Directly from you, during onboarding and in your communications with us.
06 Consent & Legal Basis
By providing information to us and continuing to use the service, you consent to our collection, processing, and storage of that information in accordance with this Policy. Where we act as processor, we rely on the Client's instructions and the Client's own lawful basis for the underlying data.
We process information on the basis of the performance of our contract with you, your consent and authorisation to connect to your systems, our legitimate interests in keeping the service secure and effective, and our legal obligations. Pakistan's applicable framework today includes the constitutional right to privacy and the Prevention of Electronic Crimes Act, 2016 (as amended in 2025); we also build toward the Personal Data Protection Bill, which is pending before Parliament.
07 How We Use Information
We use the information we hold to provide and operate the service, including to surface insight and act on it for you: detecting leakage through voids, comps and cash discrepancies; identifying lapsing regulars; analysing menu profitability; handling bookings and VIPs; monitoring reviews and competitors; delivering intelligence over WhatsApp; and providing support, security, and service improvement.
We do not sell personal data. We do not use one Client's data to benefit another Client. We do not use your data for advertising.
08 Automated Processing & AI
The service relies on automated processing and may use third-party artificial-intelligence model providers to analyse data and generate the outputs you receive. Where data is processed by such providers, it is handled under confidentiality and data-protection terms, minimised where feasible, and configured so your data is not used to train their models where the provider offers that option.
You control how far our agents act on their own, from being informed only, to receiving recommendations, to acting within limits you set, to full autonomy. Automated outputs are decision-support, and at lower levels the decision remains with you.
09 WhatsApp Messaging
We deliver intelligence and receive instructions through the WhatsApp Business Platform. Messages on this channel are encrypted in transit using the Signal protocol. Under the WhatsApp Business Platform, message content is decrypted so that it can be processed, by the platform and by our agents, and re-encrypted on delivery. The service is therefore not end-to-end encrypted in the consumer-messaging sense, because our agents are, by design, a participant in the conversation. Meta processes message data under its own terms.
Treat the WhatsApp thread as a business channel: keep the receiving device secured, and tell us promptly if a device or number is lost or compromised so we can suspend delivery.
10 Disclosure of Information
We do not sell your information. We share it only with the parties needed to provide the service, each bound by confidentiality and data-protection obligations:
- Each Client's data is logically segregated and accessible only to that Client and to our authorised personnel on a need-to-know basis. A current list of sub-processors is available on request.
- Cloud hosting and infrastructure providers that store and process data on our behalf.
- The WhatsApp Business Platform / Meta, and our Business Solution Provider where used, to deliver messages.
- AI model providers, to generate the analysis described in section 08.
- POS and payment integration partners, to establish and maintain your connection.
- Professional advisors, such as legal, accounting, and security providers.
- Authorities, only where we are legally required to disclose, and to the minimum extent required.
11 Cross-Border Transfers
Some processing, storage, or AI analysis may take place on infrastructure located outside Pakistan. Where data crosses a border, we take steps to keep it protected to a comparable standard through contractual safeguards, data processing agreements, and reputable providers, regardless of which jurisdiction that infrastructure sits in. We will comply with any localisation or transfer conditions imposed by the Personal Data Protection Bill once it is in force, and can offer in-country processing arrangements where required.
12 Data Security
No system can be guaranteed perfectly secure. We maintain safeguards appropriate to the risk.
- Encryption of data in transit (TLS) and at rest.
- Access control on a least-privilege basis, with authentication.
- Logical segregation of each Client's data.
- Monitoring and logging of access and activity, and due diligence on sub-processors.
- A breach-response procedure: if a breach affecting your data occurs, we will act to contain it and notify you without undue delay, alongside any reporting the law requires.
13 Data Retention
We retain Client data for the term of our agreement and for a limited period afterwards where needed to meet legal, accounting, or security obligations, after which we delete or anonymise it. WhatsApp message logs are retained for 90 days.
Two-week trial
For the complimentary two-week audit, we process the sales data you provide solely to produce your findings. If you do not proceed, we will delete or return that data within two weeks of the trial ending.
14 Your Rights
Subject to applicable law, individuals may request to access, correct, delete, or restrict the processing of their personal data, object to certain processing, withdraw consent where processing rests on it, and lodge a complaint with the relevant authority. To exercise these, contact us using the details in section 20. Requests concerning an end customer's data should generally be directed to the Client as controller, and we will assist the Client in responding.
16 Third-Party Links & Services
Our website and service may reference or connect to third-party platforms, such as your POS provider and the WhatsApp platform. We are not responsible for the privacy practices of those third parties, and we recommend reviewing their own policies.
17 Children's Privacy
The service is provided to businesses and is not directed at children. We do not knowingly collect data relating to children. End-customer data provided to us should not include data about minors except as the Client lawfully handles it.
18 Changes to This Policy
We may update this Policy as the service and the law evolve. We will post the updated version with a revised date and notify Clients of any material change. Your continued use of the service after an update constitutes acceptance of the revised Policy.
19 Governing Law & Complaints
This Policy is governed by the laws of Pakistan, including the constitutional right to privacy and the Prevention of Electronic Crimes Act, 2016 (as amended). We monitor and will align with the Personal Data Protection Bill once enacted, and with the National Commission for Personal Data Protection. Complaints may be raised using the contact details below and will be handled promptly and fairly.
20 Contact Us
For any question about this Policy, to exercise a right, or to request our current list of sub-processors, contact us directly.