Privacy Policy

i.What we hold, and why

To run your business we process your orders, customers, parcels, ad spend, WhatsApp conversations and courier settlements — synced from the platforms you connect (Shopify, Meta, couriers, WhatsApp Business). We hold them for one reason: to compute the truth about your business and act only where you've allowed it. We do not sell data, rent it, or train shared models on it.

ii.Isolation — your brand is a walled room, not a row in a table

• Per-client database isolation. Each tenant's data lives behind its own isolation rails. The build itself is checked: a deploy that could leak across tenants fails to ship — the wall is enforced by the pipeline, not by promises.
• Every AI answer is scoped before it speaks. The system resolves your tenant, then answers — and echoes your brand's name into the answer, so an operator running several brands physically cannot be told the wrong brand's number without seeing the wrong name attached.
• Our own brand plays by the same rule. Elyscents is a tenant behind the same walls. We eat what we serve.

iii.What the AI can and cannot do

• It cannot write. Not by policy — by privilege. Every AI query against your business data runs inside a read-only database transaction. The credential the AI uses does not have the power to change your data, so a bad answer can never become a bad write.
• PII redaction is on by default for client tokens. Where a token doesn't need names and phones to answer a question, it doesn't get them.
• Customer content is fenced as untrusted. Anything a customer writes — a WhatsApp message, a review — is wrapped in an ⟦UNTRUSTED⟧ fence before the model ever sees it, so a message can't instruct the AI to do something you didn't.
• Sends are earned, never assumed. Agents that can message customers graduate market-by-market through shadow mode and test phones, under a shared frequency cap — and the safety net (SENTRY) has no send path in the code at all today.

iv.The audit log includes refusals

Every AI call your business answers — and every one it refuses — lands in an audit log you can read yourself: ok, error, refused, rate-limited, with the parameters trimmed but reconstructible. A log of only successful calls answers "what did it do". Yours also answers "what did it try" — and the second question is the one that matters.

v.Credentials and access

• API tokens you create in Graymat — in settings, for the Chrome extension and for in-store devices — are stored only as SHA-256 hashes. If our database were read, those tokens would not be in it. The meetings intake link is the exception: its key is stored as it is, so it can be shown to you again. Credentials for the services you connect (such as Shopify, Meta and couriers) are a different thing: Graymat has to keep those usable in order to call those services for you.
• Human access is role-scoped. A rider, a packer, an agent and an owner see different numbers — the morning brief pushes each person only what their role is allowed to see.
• One revocation story. API tokens can be revoked from your settings, and revocation actually ends access — there aren't two token systems that disagree.

vi.Your customers' data

Your customers remain your customers. Their messages are used to serve them — confirmations, recoveries, support — and, where you've enabled it, to mine phrasing for creative. Our mining pipeline re-verifies every customer quote as a literal substring of the real message and deletes what it cannot prove; the rejected count is logged, not hidden.

vii.Facebook, Instagram, WhatsApp and Google Ads

You connect Meta accounts to Graymat in Meta's own window, and you choose exactly which ones: ad accounts, Facebook Pages, Instagram professional accounts and WhatsApp Business accounts. Meta lists what Graymat will be able to do before you agree. Graymat gets access to what you picked and nothing else. That access belongs to your business portfolio, not to the person who clicked, so a staff member leaving doesn't break it.

What we receive, and what it is for.

• Ad accounts. Your campaigns, ads and their results: spend, impressions, clicks and purchases. We use them to show what your ads cost per delivered order. This access is read-only: Graymat doesn't change your campaigns.
• Facebook Pages and Instagram accounts. Your posts and how they performed, the comments people leave on your posts and ads, and the messages people send you, with each sender's name. We use them to run your inbox, where your team reads, answers, hides or deletes, and to publish the posts your team approves.
• WhatsApp Business. Your number, its display name and status, and the messages sent and received on it. We use them to send your order confirmations and to run your WhatsApp inbox.

What we don't do with it. We don't sell it, and we don't share it with anyone beyond the companies listed at /subprocessors. We don't use it to target ads or to train shared models. Each Facebook Page and Instagram account you connect is registered to your workspace alone, and Graymat refuses to connect it to a second workspace.

Where it is kept, and for how long. In your workspace's database, in the region described in section x. We keep it while the account stays connected. When you disconnect, collection stops at once. What we already hold stays in your workspace until you ask us to delete it, or until you leave Graymat and the schedule in section x applies.

How to disconnect, and how to delete.

• In Graymat, for ad accounts. Settings → Connections → Disconnect. Graymat deletes its copy of that access at once and stops reading your ads. To end the access on Meta's side as well, remove Graymat in Meta too.
• In Meta. Your business settings → Integrations → Connected apps → Graymat → Remove. That ends Graymat's access immediately, even if you can no longer sign in to Graymat.
• By email. Write to [email protected] from the address on your account. We disconnect it, delete what we collected through it from live systems, and confirm in writing within 30 days. Backups age out within a further 90 days.

People who message or comment on your accounts are your customers, and their messages are your data: section vi applies. If one of them asks us about their data, we point them to you and tell you within 5 working days, as section x describes.

Google Ads. You connect it by signing in with Google and pressing Allow in Google's own window. Google describes this access as able to see, edit, create and delete your Google Ads data, because it offers no narrower permission. Graymat uses it to read your campaigns, ads and their results (spend, impressions, clicks and conversions), and the account's change history, which names the user behind each change, to show what your ads cost per delivered order. Graymat changes nothing in your Google Ads account unless someone on your team approves that specific change in Graymat. We don't sell this data or use it for advertising, and we share it only with the companies listed at /subprocessors. Graymat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. To disconnect, use Settings → Connections → Disconnect in Graymat, or remove Graymat from your Google Account's third-party connections.

viii.This website

Graymat’s own visit counter. Every page counts your visit on Graymat’s own server (app.graymat.ai), with no cookie and nothing stored in your browser. It records the page, how long it stayed open and how far down you read, which sections you reached, which buttons and links you pressed, the site that sent you and any campaign tag in the link, your country (from our network provider, nothing finer), the kind of device and browser, how fast the page loaded and any page error. On the waitlist form it records which fields were used and whether the form saved — never what you typed. To tell one visit from another without a cookie, the server mixes your IP address and browser name with a random code that changes every day and is then deleted: the IP address itself is never stored, and nothing links your visits on different days. Bots and link previews are only counted, not recorded. This is kept in Graymat’s own database in Singapore for up to 400 days, read only by Graymat’s team, and not shared with anyone.

Everything else is off until you allow it. On your first visit, the site offers a real choice: continue without analytics, or allow analytics. Allowing it loads Google Analytics and Microsoft Clarity, and lets the visit counter keep a random visitor number in this browser so it can recognise you when you come back. Declining loads neither service and keeps no visitor number. Your choice is stored only in this browser.

If you allow analytics, Google Analytics counts visits, pages read and approximate country. Microsoft Clarity is a session recorder: it captures scrolling, clicks and a replay of the page as you move through it. Both may set cookies and browser storage. Clarity’s text masking is on, and the waitlist form carries an additional masking instruction, so text entered into it is excluded from replays.

You can review or change that choice at any time using the control below. If you withdraw consent, Graymat stops loading both services and deletes its visitor number from this browser on future page views. Your browser may retain storage those services already placed; its privacy controls can remove that existing data.

Review analytics choice

The waitlist. Its record contains what you typed — brand, WhatsApp number, and whichever of market, orders per day and store link you chose to add — but no IP address or device fingerprint. If you allowed analytics before joining, the random visitor number from this browser is saved with your entry, so we can see which page or advert brought you and what you read before joining; if you did not, nothing joins your visits to your entry. The record is kept in Graymat’s own database in Singapore and is used for two things: to message you on WhatsApp when your group opens and, if you gave a store website, to make you a free review of it. For that review we take a picture of your website’s public first screen and an AI service writes four suggestions from it; the picture and the review are kept with your waitlist record and may be sent to your WhatsApp number. Nothing else about your store is read. Ask at [email protected] and the entry, its review and the visits joined to it are deleted.

Beyond that, the content delivery network that serves these pages counts requests and keeps short-lived operational logs including IP addresses, for delivery and abuse protection. That is aggregate infrastructure data, not a profile of you, and Graymat does not query it per visitor.

Two other requests leave your browser on some pages: the visit counter above, and the public proof figures read from app.graymat.ai (aggregate totals only — no order, customer or account identity is sent or received). The clips and typefaces are served from this same domain.

ix.What we don't do

• No selling or renting of data — yours or your customers'.
• No blended benchmarks that leak one client's economics into another's screen.
• No dark patterns around deletion: ask, and your tenant's data is exported or destroyed.

x.The formal parts, which this page used to skip

Who we are. Graymat is operated by Graymat (Private) Limited, a private limited company incorporated in Pakistan under company registration number 0355196, with its registered office at A-316, Block 2, Gulshan-e-Iqbal, Karachi. Privacy questions go to [email protected] and we answer within 30 days.

Two kinds of data, kept apart. Data about you — your account, your team’s emails, your billing — we are the controller of, and this page governs it. Data about your customers we hold only as your processor, on your instructions, under the Data Processing Agreement. That data is yours.

How long we keep it. While you are a customer, for as long as you keep it — we do not silently delete your order history. When you leave, your data stays exportable for 30 days, then it is deleted from live systems and ages out of backups within a further 90 days. We confirm in writing when it is gone, if you ask. We keep only invoices, tax records and a minimal access log longer, and none of those hold your customers’ contact details.

If one of your customers asks about their data, they should ask you — you are the controller and the relationship is yours. If they come to us we will point them to you and tell you it happened, within 5 working days. You have the tools to answer them: find everything held about one person by phone number, export it, delete it. If a request needs more than the interface can do, we do it for you at no charge.

If there is a breach affecting your data, we tell you within 72 hours of becoming aware — with what we know at the time, rather than waiting until the picture is complete.

Who else can touch it. The companies that may handle your data are listed at /subprocessors, described by what it does and where (the named list is sent on request): the platform that always applies, plus what applies only if you connect an integration, use a feature or use the mobile app. The providers Graymat itself chooses use your data only to provide their service to us, under their own data-protection and security terms; we remain responsible to you for what they do. Platforms and couriers you connect handle it under their own terms and your agreement with them, and the Federal Board of Revenue receives fiscal receipts because Pakistani law requires it. We give 30 days’ notice before adding or replacing one, and you can object.

The rest of the paperwork: Terms of Service · Data Processing Agreement · Sub-processors · Acceptable Use.

xi.The Graymat mobile app

The Graymat app for Android and iPhone is a work tool for the people who run a business on Graymat — owners, managers, order agents and packers. It is not for shoppers, and no shopper ever installs it. It shows the same data, behind the same isolation and the same role permissions, as Graymat on the web. This section covers what is different on a phone. Where a version is named, it is the app version shown under More → your account.

What the app collects about you.

• Your sign-in. Your work email, and a one-time code we email to it (an account given a password can use that instead). Your session is kept in the phone’s secure storage (the Keychain on iPhone, Keystore-protected storage on Android). Like any sign-in service, our authentication provider records each session’s IP address, the approximate city and country that implies, and the kind of device, to keep accounts secure.
• Identifiers and notifications. When the app starts, our authentication provider creates an identifier for the installation, and on Android so does Google’s notification service. If you allow notifications, the app asks the push-notification service it is built on for a delivery address, sending it the token Apple (iPhone) or Google (Android) issued and an identifier for this installation. We store that delivery address with whether the phone is iOS or Android, the app version, and when the phone first and last registered, and use it only for team alerts to you. Each alert’s title and text — which can include the start of a team-chat message, a teammate’s name, a task title, the day’s figures, or a customer’s name or phone number when a customer conversation is handed to you — passes from us through that service and Apple or Google to your phone. Versions before 1.0.12 also sent the phone’s name; a name already stored is cleared when that phone next registers. Your customers never receive anything from the app.
• Photos you choose to add, and only those: a photo of damaged stock when a returned parcel is checked in, or a receipt on an expense, taken with the camera or chosen from your gallery. From version 1.0.12 each photo is re-saved without its hidden metadata — no location, camera details or original file name — before it leaves the phone; earlier versions uploaded photos as the phone saved them, which can include where a photo was taken. Damage photos go to our object-storage provider and receipts to our file storage, both linked to your business’s records. Otherwise the camera only reads barcodes — when packing, handing parcels to a courier, checking in returns or searching; the image is read on the phone and neither stored nor sent, and the code it reads is sent to Graymat as if you had typed it. On Android the barcode reader Google supplies may send Google basic usage and performance figures.
• What you do, as on the web, recorded with your name: order actions; which order you have open, so a teammate sees “being handled by”; call-back times and notes; reasons and notes you type; messages you send in the team chat (Crew); a team-chat message you report, with the reason you pick — saved in the business’s own workspace with a short excerpt of the message, while Graymat’s support team is emailed the workspace, the message and conversation numbers, the reason, the time and the two user IDs, never the text — and the people you block there, whose messages and notifications then stop reaching you; expenses you add to the cashbook (amount, category, who was paid, a note and an optional receipt photo); payments you record against an order (method, amount and transaction reference); stock counts and adjustments; and what you search for, which is used to answer the search and not saved by Graymat’s own code, though service logs may keep it briefly. When you make a Leopards load sheet, the rider’s name — and their national ID (CNIC) number or phone number, if you type it — is sent to Leopards to print the sheet the rider signs, and recorded against each parcel handed over.
• Your business’s customers’ details are shown on orders: names, phone numbers, emails and delivery addresses, what they ordered and owe, their past orders and returns with your business and, where Graymat flagged it, a quote from a WhatsApp message they sent you. Contact details can be corrected in the app; a correction is saved to your business’s Shopify store when you confirm it, and booking a courier sends the name, phone number, address and amount to the courier you book. This is your customers’ data, held on your instructions (sections vi and x).

The services behind these — sign-in, push notifications, file and object storage, and the barcode reader — are listed by what they do and where at /subprocessors.

What the app does not collect. No precise location: there is no location permission, and from version 1.0.12 photos are stripped of it. The only location-like data is the approximate city and country our sign-in provider works out from your connection’s IP address. No contacts. No microphone — the app never uses it, and from version 1.0.13 it does not ask for it on either platform. No advertising identifier, no analytics or crash-reporting service of our own, and no tracking across other apps or websites. Call and WhatsApp open your phone’s own apps; the app does not record calls or read the messages on your phone.

What stays on the phone. So that it opens instantly, the app remembers its last answers — counts, totals, staff names and emails, order and parcel tracking numbers with city and amount, your own email and role — and discards them if they are more than 24 hours old when the app next opens. That remembered copy never includes a customer’s name, phone number or address. The app also remembers settings such as the market and courier you last chose. Some things sit on the phone while they are useful: courier labels and load sheets you open hold the customer’s name, phone number, address and amount, and you can pass them to another app (to print or send them); photos you take stay in the app’s temporary cache until the phone clears it; images opened in the team chat are cached; a call-back reminder shows the customer’s name and your note; hand-over receipts and saved load sheets keep order numbers, parcel counts and the rider’s name. From version 1.0.14, whenever the app finds itself signed out — by you, or because your session ended elsewhere — it cancels its call-back reminders and deletes the saved labels and load sheets, the remembered answers, settings and receipts; signing out with the button also asks Graymat to remove this phone’s notification registration. From version 1.0.13 the app’s data is excluded from Android backups. Uninstalling removes the rest, except that on iPhone your sign-in token can remain in the Keychain until you next sign out.

Deleting your account. In the app: More → your account → Delete my account. Or email [email protected] from the address on the account — the way to ask if the button is not available to your login — and graymat.ai/delete-account explains both. Every request is handled by a person, within 7 days, because a login is woven into a business’s order history and removing it should never be a side effect of a tap. We delete your login — your name and email in our sign-in system — your phones’ notification registrations and your browsers’ notification subscriptions, so you can no longer sign in and receive nothing more; we also delete your team-chat profile (phone, birthday, title and about text), your notification inbox, your read markers and your list of people you blocked in the team chat. The request record is deleted once carried out — our confirmation email to you, and the email thread if you wrote to us, is the record — and backups age out within a further 90 days. The record of work you did — for example which orders you confirmed (with your name), or messages you sent in the team chat (with your user ID; they show as “Teammate” once your login is deleted) — belongs to the business you did it for and stays in its history. We hold that record as the business’s processor (section x): ask the business about it, and if you write to us we pass your request on within 5 working days. If you are the only administrator of a workspace, the app asks you to hand administration to someone else first, so the business is never locked out of its own account. If we ever make deletion instant, this page will say so first.

xii.Talk to a human

Privacy questions, export or deletion requests: [email protected]. A data-processing agreement for your legal team, or anything else: [email protected]. A person answers — the same people who run Elyscents on this system every day.