Privacy Policy

Last updated: 1 October 2026

MangoReply is a product of Fikra Ventures FZE LLC ("Fikra Ventures", "we", "us"), a free zone company registered with Ajman NuVentures Centre Free Zone, United Arab Emirates (licence no. 2629617609888), with its registered office at BC-892072, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates. We're responsible for the personal data of our customers and website visitors. This policy explains what we collect when you visit our website, use MangoReply, or message a business that uses a MangoReply agent, and what we do with it. Sections 1 to 9 describe our website and our WhatsApp agents. Section 10 covers MangoReply's LinkedIn agent on its own.

1. What we collect

Website visitors. We don't use analytics, advertising or tracking cookies. Our hosting providers may keep standard request logs (such as IP address, browser and pages requested) for security and reliability. The website loads fonts from Google Fonts, which receives your IP address.

Customers who set up an agent.

• Your email address, name and time zone, your plan and its dates, and your dashboard password, stored only as a salted hash.
• Owner and admin WhatsApp numbers, names and time zones.
• Your agent's settings and business information.
• The keys that keep your WhatsApp number linked to the agent.
• Your chats with your assistant, including the notifications it sends you and a running summary of older chats, and what it keeps for you: notes, facts it remembers, to-dos, reminders, calendar events, automations, scheduled messages and drafts.
• Usage records: how many conversations and requests your agent handled, and what each reply cost us to produce. These don't contain message text.
• Payment is handled by our payment provider. We don't receive or store your card details.

People who message an agent, or share a group with one.

• WhatsApp number and profile name.
• The messages sent to the agent's number, and the agent's replies.
• Messages in groups the agent reads.
• Details the agent saves when you're interested in something (for example your name, what you need, dates or budget).

Personal numbers linked for reply drafts. An owner can have their own personal WhatsApp number linked, so the assistant can suggest replies. We then keep the messages in that number's one-to-one chats, sent and received, and the names of the people in them.

Technical logs and administrator records. Our servers log events such as dashboard requests, errors, and messages arriving or being sent. These logs can include phone numbers. We also keep a record of the changes our administrators make to customers' accounts and of when they view a customer's data, naming what was touched but never its contents.

2. How we use it

• To run the agent: reply to messages, save leads, pass messages to the business, summarise groups and carry out the owner's requests.
• To show the business its conversations, leads and groups in the dashboard.
• To keep the service secure, prevent abuse, and apply usage limits.
• To bill customers and give support.

We don't sell personal data, and we don't use it for advertising.

3. AI processing

Replies, summaries and suggestions are written by AI. To write them, the relevant messages, conversation history and the business's information are sent to AI service providers, which process them to generate the reply. These providers aren't allowed to use that data to train their models.

When an owner asks their assistant about something current, such as opening hours or the weather, the assistant may search the web. Those searches are also carried out through our AI service providers.

4. Businesses and their contacts

When a business uses MangoReply, that business decides how its contacts' data is used and is the controller of it. We process that data on the business's behalf and only to provide the service. If you messaged a business's agent and want to access or delete your data, contact the business. It can delete your conversation with its agent, and what the agent saved about you, from its dashboard or by asking its assistant on WhatsApp. You can also email us at ravi@fikraventures.co, and we'll handle the request as section 9 describes.

5. Who we share it with

• Trusted cloud hosting providers, which host our servers, stored data and backups.
• AI service providers, which process messages to generate replies and aren't allowed to use them to train their models.
• Our payment provider, for billing.
• WhatsApp, which delivers messages sent and received by the linked number, under WhatsApp's own policies.
• Authorities, where the law requires it.

MangoReply runs on secure cloud infrastructure. Some of our providers may process data outside your country. Where the law requires it, we rely on appropriate safeguards for those transfers.

6. How long we keep it

For our WhatsApp agents, we only delete data automatically where this section says so. Everything else is kept with no set time limit, including after a free trial or a plan ends, until it's deleted as described here or in section 9.

• Group messages are deleted automatically 30 days after they were sent. Messages in groups the agent is set to ignore aren't stored. Digests and summaries you've received stay in your WhatsApp.
• Conversations with an agent, with their leads and summaries, are kept with no set time limit. A customer can delete one person's conversation and lead at any time. If a customer removes one of their account's WhatsApp numbers in the dashboard, that number's conversations, groups, group messages and settings are deleted with it. Unlinking a number doesn't delete them.
• Owners' chats with their assistant, including the notifications it sends them and a running summary of older chats, and the notes, facts, to-dos, reminders, calendar events, automations, scheduled messages and drafts it keeps, are kept with no set time limit. An owner can ask the assistant to delete a note or a fact. To-dos that are done, and reminders, events, automations, scheduled messages and drafts that are cancelled, stay stored.
• Chats from a linked personal number, and the names in them, are kept with no set time limit, including after the number is unlinked.
• Account details and usage records are kept while the account is open.
• WhatsApp link keys are kept while a number is linked. They're deleted when the number is unlinked in the dashboard, removed from WhatsApp's Linked devices screen, or logged out by WhatsApp.
• Records of which WhatsApp message ids we've already handled, without their content, are deleted after 7 days.
• Technical logs on our servers are deleted after 30 days.
• Records of our administrators' changes and views are kept with no set time limit, including after an account closes.
• When a customer closes their account, we log out its WhatsApp numbers and delete their link keys. We delete straight away its agents, conversations, leads, groups and group messages, its sign-ins and reset links, and the reminders, events and automations made through its agents. Owner numbers that don't also manage another account's agent are deleted too, with their chats, assistant data and linked-number chats; owner numbers that do lose everything they kept through the closed account. The account's email, name and password are removed at once, and the emptied account record and its usage records are deleted 30 days after closing.
• Backups: a copy of our database and the WhatsApp link keys is made every night and kept for 30 days. Data deleted from the service can stay in a backup until that backup is deleted, up to 30 days later.
• Copies made before an upgrade: before we upgrade the structure of our database, our server keeps a copy of it, and the three most recent copies are kept with no set time limit.

7. Security

Our website and dashboard are served over HTTPS. Passwords are stored only as salted hashes, and we keep only a hash of each sign-in and password reset link. Dashboard sign-ins use secure cookies, and access to our servers is restricted. Password reset links work once, within 24 hours. No system is perfectly secure, but we work to protect your data and will tell affected customers about a breach as the law requires.

8. Cookies

The dashboard uses one strictly necessary cookie to keep you signed in, until you sign out or for up to 30 days. The website sets no cookies.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how it's used.

• In the dashboard, customers can change their name, time zone and password, change their agent's settings, see its conversations, leads and groups, and delete one person's conversation.
• Downloading your data: customers can download their data as a file from the dashboard. It holds the account details, agent settings and owner numbers, conversations with their leads, groups and group messages, and the main owner's assistant data. It doesn't include chats from a linked personal number or usage records.
• Closing your account: customers can close their account from the dashboard with their password. Section 6 says what that deletes and when.
• On WhatsApp, owners can ask their assistant to show, change or delete their notes and facts, to change or finish their to-dos, to change or cancel their reminders, events and automations, and to forget one person who messaged the agent.
• Anything else, such as data the download doesn't include, a request from someone who isn't a customer, or a question about how we use your data: email ravi@fikraventures.co, and we'll answer within 30 days, deleting the data or sending you a copy if that's what you ask for, except anything the law requires us to keep. We may first ask you to confirm the request from the email address on the account or from its verified WhatsApp number.

You can also complain to your local data protection authority.

10. MangoReply's LinkedIn agent

This section covers MangoReply's LinkedIn agent: what it keeps about the LinkedIn member it works for, and about other LinkedIn members whose posts and comments it deals with. It has two parts. The first describes the agent as it runs today, on one LinkedIn account, our CEO's own. No one else can connect an account to it. The second sets out the limits that MangoReply's LinkedIn features for professionals' profiles and for company pages will keep. Those features aren't available yet, and nothing for LinkedIn can be bought from us today. Fikra Ventures is responsible for the data the agent keeps. Where this section differs from sections 1 to 9, this section applies to the LinkedIn agent. MangoReply isn't affiliated with, endorsed by or sponsored by LinkedIn.

The agent as it runs today

In this part, "you" means the member whose LinkedIn account is connected to the agent. The agent drafts your own LinkedIn posts, and publishes a post only after you've approved that post. It reacts to or comments on another member's post only when you give it that post's link and ask it to, one link at a time, and it replies to a comment under your own post the same way. It posts a comment or reply only after you've approved its text. The one exception, off unless you turn it on, is a first comment under your own new post naming the source of a figure in it. Its software works only through LinkedIn's official API, and only on the account that connected it.

What the agent keeps.

• Your LinkedIn sign-in token, and a refresh token if LinkedIn issues one, with the date each expires and the permissions LinkedIn granted.
• Your LinkedIn member id and your name, as LinkedIn gives them when you connect.
• The posts it drafts and publishes for you: their text, the material each was written from, when each is due, whether you approved it, whether it went out, and the id LinkedIn gave it.
• A record of every reaction, comment and reply it has made for you: when you asked and when it acted, the text of your own comments and replies, and LinkedIn's id for each comment and reply when LinkedIn returns one.
• For the other member's post an action was on: the post's id, and a link to the post that leaves out the part naming its author. For a reply, the link you gave and the id of the comment you answered. The author's name isn't kept: the record notes only that you gave one.
• Posts you list to look at later: the link, the post's id, the author's name as you supplied it, and a region you pick. The agent never acts on them by itself.
• Records from before 27 September 2026, when the agent also reacted to and commented on posts found for it in a browser, without a link from you for each one. What's left of each is when it was added, the region and search topic it was filed under, whether and when the agent reacted or commented and any error it met, the text of the agent's own comments, and a fingerprint of the post's id, which "How long it's kept" explains. They no longer hold the author's name or headline, or the post's text, date or link.
• Daily counts of what it did, of the requests it made to LinkedIn and of the profiles visited in your browser (see below).
• Totals of what other members did on your posts, such as reactions, comments and impressions: recorded by you, or, once LinkedIn grants that permission, read from LinkedIn's analytics for your own posts once a day.
• The email address the agent's notices go to, such as a reminder to connect again.

Text you paste so the agent can draft a comment or reply, such as the post or comment you're answering, is used for that one draft and isn't kept in the agent's records. A draft you haven't posted yet stays on the computer that made it, with the id of the post or comment it's for and without the author's name. If the record of a reaction, comment or reply can't get to our storage when it's made, it waits on that computer until the next run there sends it on.

Posts, comments and replies are drafted by AI. To write them, we send our AI service provider the material a post is written from; for a comment, the text of the other member's post as you paste it, and the author's name when you give it; for a reply, the other member's comment and name in the same way, with your own post and the material behind it; and the agent's recent comments, so it doesn't repeat itself. So another member's words, and their name when you give it, are shared with that provider to write the draft. The provider isn't allowed to use them to train its models. What it retains afterwards is governed by its terms with us, not by the limits in this section.

What the agent doesn't do.

• It doesn't publish a post you haven't approved.
• It doesn't read your feed, your messages, your connections or other members' profiles through LinkedIn's API, and it doesn't ask LinkedIn for permission to.
• Its software doesn't open LinkedIn's web pages. It uses only LinkedIn's API, apart from LinkedIn's sign-in page, which opens in your own browser when you connect.
• It doesn't react, comment or reply on a post unless you asked it to. The one exception is the first comment under your own new post described above.
• It sends no messages or connection requests, and doesn't answer your inbox.
• It doesn't sell LinkedIn data, use it for advertising, sales or recruiting, or combine it with our WhatsApp agents' data.

Browsing in your own browser. Visiting profiles, searching for posts and reading them happen in your own signed-in browser, done by you or by an AI assistant working in that browser for you, and not through the agent's software. What's read there gets to the agent only when you give it to the agent: the number of profiles visited each day, the links of posts you list to look at later with their authors' names, text you paste for a draft, and totals from your own activity page.

Where it's kept, and who it's shared with. Your LinkedIn tokens are kept in an encrypted secret store. The agent's other records are kept in private cloud storage, also encrypted. Both are kept apart from our WhatsApp agents' data. What the agent keeps or handles goes to three kinds of recipient: LinkedIn, which receives the posts, reactions, comments and replies the agent sends; our AI service provider, which receives what the paragraph on drafting lists, other members' words and names included; and our cloud hosting providers, which run the agent, store its records and logs, and send its email notices.

How long it's kept. The agent's scheduled run applies the first two limits below to our storage each time it starts, before it does anything else.

• Other members' names and profile links: the author's name on a post you list to look at later, and any link that carries an author's profile name, are removed from the agent's records within 24 hours.
• Other members' posts and comments: the ids of their posts and the links to them, the ids of their comments, the posts you list to look at later, and the counts of reactions, comments and impressions your posts received are removed from the agent's records within 48 hours. After that, the record of a reaction, comment or reply keeps only a fingerprint of the id: a short code worked out from the id that can't be turned back into it, kept so the agent can refuse to act twice on the same post.
• Drafts and pasted text on your computer: a draft you haven't posted, and a pasted file that was never used for a draft, are deleted once they pass the same limit, the next time the agent is used on that computer. Nothing runs there on a timer, so on a computer left unused they wait until its next use.
• Earlier versions: when the agent changes a record, our storage holds on to the version from before the change, and deletes that version 1 day after the newer one replaced it. Our storage provider counts that in whole days and deletes at times of its own choosing, so something removed from a record can last in an earlier version for up to about 2 days more.
• Tokens are kept until you connect again, which replaces the one in use, or until we delete them at your request. Earlier tokens stay in the secret store's history until then. LinkedIn stops accepting a token when it expires, or when you remove the agent's access in your LinkedIn settings.
• Your own content and records: your member id and name, your posts, the text of your own comments and replies with when each was made, the daily counts of what the agent did and of profile visits, and the email address for notices are kept with no set time limit. Of your posts, the latest 400 are kept, and older ones leave the record. If you addressed someone by name in a comment, the name stays in your text.
• Counts of the requests the agent made to LinkedIn are kept for 90 days.
• The agent's run logs are deleted after 30 days.

Disconnecting and deleting. To stop the agent acting for you, remove its access in your LinkedIn settings, where LinkedIn lists the apps and services you've allowed. That doesn't delete what the agent has kept. To have it deleted, including earlier versions and tokens, or to get a copy, email ravi@fikraventures.co. If you're another LinkedIn member and the agent reacted to, commented on or replied to your post or comment, or keeps your name, you can ask the same way. We delete what the agent keeps about you within 10 days of your request, and tell you when it's done. Before acting on a request, we may ask you to show that the LinkedIn account it's about is yours.

For professionals' profiles and company pages, when they're available

We're building LinkedIn features into MangoReply for professionals, who will connect their own LinkedIn profile, and for the teams that run a company page. They aren't available yet: no one can sign up for them, and they have no plan or price. We won't sell them until we've applied for and received LinkedIn's Standard tier of API access. Nothing in this part describes software you can use today. It sets out the limits these features will keep when they open.

• Approval. A person will approve every post and every reply before it's published. Nothing will be published without that approval.
• Approval notices. Approvals will be given in MangoReply's web app. A person who approves will also be able to get a notice on their own verified WhatsApp number. The notice will carry only the customer's own draft and a link, never another LinkedIn member's name or words.
• Other people's posts. A member will be able to give MangoReply the link of one post and ask it to like or comment on that post, one post at a time, and the member will approve each comment first. MangoReply won't read anyone's feed, search LinkedIn, view profiles, or send messages or connection requests.
• Drafting a comment. To have a comment drafted, the member will paste the post's text. The pasted text, which may include the author's name, will go to our AI service provider for that one draft. MangoReply will hold the pasted text in memory only, for at most 48 hours, and will never store it.
• AI. Posts will be drafted by AI from material the customer supplies, which goes to our AI service provider to write the draft. Suggested replies to comments on a company page's posts will be off unless the customer turns them on. When they're on, only the comment's text and the page's own post text will go to the AI model, never the commenter's name or identity. We'll keep suggested replies switched off for customers until we've confirmed that our agreement with our AI service provider meets LinkedIn's API terms.
• Who sees it. Among a customer's own people, what's read from LinkedIn for a profile will be shown only to that profile's owner and the people they add, and what's read for a company page only to the team members assigned to that page. Any view by our own administrators is recorded, as section 1 describes.
• Comment text on a page's posts will be kept for at most 48 hours.
• Commenters' names will be held in memory only, for at most 24 hours, and never stored.
• Posts that mention a page. When LinkedIn notifies us that a member's post mentions a connected company page, that post will be shown to the team members assigned to that page, with the comments on the page's posts. The text of a post that mentions a page will be kept for at most 48 hours. The name of its author will be held in memory only, for at most 24 hours, and never stored. This will be built only after LinkedIn has granted us its Standard tier of API access.
• A page's own posts, read back from LinkedIn, will be kept for up to 182 days.
• Page statistics will be kept for up to 365 days.
• A member's own post statistics will be read from LinkedIn when they're opened in MangoReply, and won't be stored.
• A connected organisation's own profile will be refreshed from LinkedIn every 56 days.
• The name LinkedIn gives for an organisation that hasn't connected will be kept for up to 30 days.
• LinkedIn members' data. MangoReply won't export LinkedIn members' data. The one exception will be a customer's own data download, which will name the LinkedIn account that customer connected and hold no other member's data. It won't use LinkedIn members' data for advertising, sales or recruiting, or combine it with our WhatsApp agents' data or with any other data.
• One workspace. One LinkedIn member will connect to one MangoReply workspace only, meaning one customer's account, and one company page will belong to one workspace only. MangoReply won't use one member's profile to manage several customers' accounts.
• What our AI service provider retains after it writes a draft or suggests a reply will be governed by its terms with us, not by the limits in this part.
• Deletion requests will be met within the same limit as in the first part.

11. Children

MangoReply is for businesses and adults. Customers must be 18 or older.

12. Changes

We'll update this policy when our practices change and show the date at the top. If a change is significant, we'll tell customers before it takes effect.

13. Contact

This policy is published by Fikra Ventures FZE LLC, the company behind MangoReply, at BC-892072, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates. For privacy questions or requests, email ravi@fikraventures.co or message us on WhatsApp.