Privacy Policy

What this policy covers

DMAI Pro is made and sold by Nexorah AI in the United Arab Emirates. This page explains what data the DMAI Pro app (a Windows program) and the dmaipro.app website handle, where that data is kept and what leaves the computer.

In short: DMAI Pro runs on the business's own computer. Customer messages are stored on that computer and do not reach us.

Who is responsible for the data

DMAI Pro is software that each business installs and runs itself. The business connects its own Instagram, WhatsApp and Telegram accounts through its own Meta app and its own Telegram bot. The business is therefore the controller of its customers' data.

Nexorah AI does not receive, store or see your customers' messages, comments, forms or files. A customer of a business who has a question about their data should contact that business directly.

Data the app receives from Instagram, WhatsApp and Telegram

What: direct messages, comments, voice notes and files that customers send; the ID, username, name and profile picture as the platform provides them; form answers; and the tokens that connect the business's accounts.

Why: so the business can see its messages in one inbox, reply to them (automatically or by hand), take bookings and orders, and follow up.

Where: in the app's data folder on the business's own computer (a database and a media folder). Message texts and tokens are stored encrypted.

Security on the computer

The texts customers write, and keys and tokens, are encrypted with AES-256-GCM. The master key is held by Windows' own protection (DPAPI) for that user account, so a copy of the data folder on its own cannot be read.

Backups are encrypted too and open only on this computer or with the recovery code given to the owner. Log files do not keep message texts.

What leaves the computer

Replies are sent only to the platform the message came from (Meta for Instagram and WhatsApp, Telegram for Telegram). To receive messages, the app creates a public address: by default a Cloudflare tunnel, or, if the owner chooses, ngrok or the owner's own domain. Messages pass through that service's network, but the app does not store them there.

If the owner presses “fixed address”, the app asks our address service for a Cloudflare tunnel and a sub-domain of dmaipro.app. For this it sends the computer's code and, if there is one, the licence key. Our service keeps only the address name, the licence ID and a hashed form of the computer's code; messages pass through Cloudflare's network and our service does not see them.

By default the AI runs on this computer and sends nothing out. Turning voice notes into text is local too. Only if the owner enters a key for a cloud service themselves (Anthropic Claude, OpenAI or an OpenAI-compatible service, Google Gemini) is the conversation text sent to that service to write the reply; before that, names, phone numbers, e-mail addresses and card numbers are replaced with stand-ins.

Voice replies in the owner's voice are off by default; if the owner switches them on and chooses ElevenLabs or Google Gemini, the reply text and the owner's voice sample go to that service. If the business connects a payment gateway, the customer's payment details go to that gateway. Phone-app notifications pass encrypted through the browser's push service (Google, Apple or Mozilla).

What the app fetches from us

At start-up and every six hours, the app reads the new-version file and the licence status list from dl.dmaipro.app. This is a plain download: no customer data, licence key or computer code is sent (only your IP address reaches the server, as with any download). An update is installed only when the owner clicks.

AI models and engines are downloaded from their own official sources (Hugging Face, GitHub, NuGet and nodejs.org) and checked with sha256. The app sends us no usage statistics, crash reports or telemetry. The licence key is checked offline.

Retention and deletion

Conversation data stays on the business's computer for as long as the business keeps it. Raw webhook data and finished jobs are removed after 90 days (adjustable), and the 14 most recent automatic backups are kept.

Any customer can write “delete my data” in the chat or ask the business; the app then removes everything about that person. Older backups keep the data until they are replaced.

If an Instagram account removes the app or asks for deletion through Meta, the app removes that account's token and data and returns a confirmation code. For help deleting any data we ourselves hold, contact us.

The dmaipro.app website

The site is hosted on Cloudflare Pages. The site's code has no visitor-analytics scripts and no tracking cookies. Your light/dark choice is saved in your own browser, and a chat with the site assistant lasts only until you close that tab.

Questions you ask the site assistant are sent to our server, and Cloudflare Workers AI writes the answer from the text of the site's pages. We keep each question with its time, language, page and outcome in our database on Cloudflare, to see which answers the site is missing. Your IP address is not stored; only a hashed code that changes every day, used to limit the number of questions. Please do not type personal information into the assistant.

These questions are kept for 90 days and then deleted.

When you contact us or buy

When you message us on WhatsApp, Telegram or by e-mail, we receive what you send (such as your name, business name, contact number and payment receipt) and use it only to reply, issue your licence and give support. These messages are also kept by that messaging service.

A licence key contains the business name, the computer code (made from hashed hardware identifiers), the plan and the dates. We keep a record of the licences we issue. We do not sell your data.

Changes and contact

If this policy changes, we update the date at the top of the page. For any privacy question or request: WhatsApp +971503021844, Telegram @nexorahai, e-mail [email protected].