Privacy Policy

Effective 29 August 2026 · Last updated 29 August 2026

Confirmy (“Confirmy”, “we”, “us”) is a service operated by Shipper Network Tunisia Branch, SARL, registered in Tunisia under RNE 1804872W, Avenue Hédi Nouira, Imm. Emna City, Bloc B, Apt 52, 3027 Sfax. Confirmy places and receives AI voice calls on behalf of businesses — online shops and delivery companies (“Businesses”) — to confirm orders and follow up on deliveries with their customers (“Customers”). This policy explains what personal data is involved, why, how long we keep it, and what rights you have. It applies to confirmy.ai, the Confirmy dashboard at app.confirmy.ai, the Confirmy API, and the calls themselves.

1. Who is responsible for your data

When a Business uses Confirmy to call its Customers, the Business decides which Customers to call, for which orders, and why. The Business is the data controller for those calls; Confirmy acts as its data processor, handling Customer data only on the Business’s instructions and under a data processing agreement. Questions about why you were called, or requests to stop being called by a particular shop, are best addressed to that shop first — and we will help them fulfil your request.

For the people who sign in to the Confirmy dashboard and for visitors of this website, Confirmy is the data controller.

2. If a Business called you through Confirmy

You received a call from a shop or delivery company that uses Confirmy. During and around that call we process:

• Your phone number, provided by the Business, and your name if the Business provided it.
• Order details the Business gave us for the call: the items, the cash-on-delivery total, the delivery address, preferred dates, and any notes the Business added.
• The call audio — your voice and the AI agent’s voice — which is streamed to a speech model in real time so the agent can understand and answer you.
• A recording and a transcript of the call, if the Business has recording enabled (it is enabled by default). These let the Business verify what was agreed and improve the service.
• The outcome of the call: whether you confirmed, declined, asked for a callback, changed the address or date, and a short summary written for the Business.
• Call metadata: when the call was placed, whether it was answered, how long it lasted, and technical quality measurements.

We use this data to conduct the call, to report the result to the Business, and to keep the service reliable and safe. We do not use your call data to build a profile of you, to advertise to you, or to sell to anyone.

The legal basis for processing is the Business’s legitimate interest in confirming and delivering an order you placed with it (and, where the Business relies on it, the performance of your contract with the Business). Where local law requires consent for call recording, the Business is responsible for obtaining it and Confirmy can be configured to run without recording.

3. If you use Confirmy for your business

To provide the service to a Business we process:

• Account data: the name and email address of each person who signs in to the dashboard, a password hash, their role, and sign-in sessions.
• Integration data: API keys (stored hashed), webhook endpoints and signing secrets (stored encrypted), WhatsApp Business Account identifiers and access tokens (stored encrypted), and the configuration of any order-lookup integration you connect.
• The calls placed on your behalf, as described in section 2, which you can review in the dashboard.
• Audit logs of actions taken in your account, for security and support.

The legal basis is the performance of our contract with you and our legitimate interest in securing the service.

4. WhatsApp and Meta platform data

Confirmy places and receives calls through the WhatsApp Business Platform operated by Meta Platforms, Inc. When a Business connects its WhatsApp Business number to Confirmy — either by pasting an access token or through Meta’s Embedded Signup — we receive and store:

• the WhatsApp Business Account (WABA) identifier and the phone number identifiers the Business chooses to manage through Confirmy;
• an access token issued by Meta for that account, stored encrypted and used only to place, accept and terminate calls on the connected numbers and to check the token’s health;
• call signalling events Meta sends to our webhook (call started, answered, ended), which identify the connected number and the Customer’s phone number.

We use Meta platform data solely to provide calling on the Business’s own numbers. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than the sub-processors listed in section 7 as needed to run the service. A Business can disconnect any number from the dashboard at any time; disconnecting stops all calling on that number immediately. Our use of Meta platform data is subject to Meta’s Platform Terms and WhatsApp Business Terms.

5. How the AI agent works with your data

Calls are conducted by an AI voice agent. During a call, audio is streamed to a third-party speech-to-speech model (see section 7) together with the order details the Business provided and the agent’s instructions. The model generates the agent’s replies in real time. Order details are used only within that call; they are not used to train the model provider’s models under our agreement with them.

The agent is instructed never to give medical, health or safety advice, never to invent stock, prices, discounts or delivery times, and to hand any question it should not decide to a human at the Business. Every call ends with a structured outcome that a person at the Business can review, together with the recording and transcript where enabled.

Where a Business has chosen to disclose it, the agent will say that it is an automated assistant. If you ask the agent directly whether you are speaking to a machine, it will not deny it and will offer a callback from a person.

6. How long we keep data

7. Who we share data with

We share data only with the providers we need to run the service, each bound by a contract that limits what they may do with it:

We also share a Business’s call results with that Business, through its dashboard, its webhook endpoint and its API — that is the service. We may disclose data if required by law or to protect the safety of people or the integrity of the service. We do not sell personal data.

8. How we protect data

• All traffic is encrypted in transit (TLS); WhatsApp call media is encrypted end to end between the Customer’s device and our media server (SRTP).
• Access tokens, webhook secrets and integration credentials are encrypted at rest with a key held outside the database. API keys are stored only as hashes.
• Recordings are stored in private object storage and served only through short-lived signed links.
• Every result we send to a Business is signed so the Business can verify it came from us.
• Access to production systems is limited to the people who operate the service and is logged.

9. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive a copy in a portable format. You also have the right to complain to your data protection authority — in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP).

If you are a Customer, the quickest route is the Business that called you: it can look up your calls, stop calling you, and ask us to delete your recordings. You can also contact us directly (section 14) and we will coordinate with the Business.

10. Data deletion

Customers: to have your recordings, transcripts and call data deleted, contact the Business that called you or email privacy@confirmy.ai from any address with the phone number that was called and the approximate date. We will identify the calls, delete the recordings and transcripts, and confirm to you within 30 days. Outcome records may be retained in anonymised form so the Business can keep its order history.

Businesses: disconnecting a WhatsApp number in the dashboard stops calling on it immediately and stops any further processing of Meta platform data for that number; you may ask us to delete the stored access token at the same time. Closing your account deletes all account, integration and call data within 30 days, except what we must keep for legal, accounting or security reasons.

Meta users: if you connected a WhatsApp Business Account through Facebook Login and want the data Confirmy received about it deleted, email privacy@confirmy.ai with the WhatsApp Business Account ID, or remove Confirmy from your Meta business settings — we will delete the stored token and identifiers within 30 days and confirm by email.

11. Cookies

This website sets no cookies and uses no analytics. The dashboard at app.confirmy.ai sets one strictly necessary cookie (confirmy_session) to keep you signed in; it holds a random session identifier and nothing else, and it expires after 30 days or when you sign out.

12. Children

Confirmy is a business service and is not directed at children. Businesses must not submit calls to people they know to be under 16. If you believe a child’s data has reached us, contact us and we will delete it.

13. Changes to this policy

When we change this policy we update the date at the top and, for material changes, notify Businesses through the dashboard or by email at least 14 days before the change takes effect.

14. Contact

Shipper Network Tunisia Branch, SARL — RNE 1804872W
Avenue Hédi Nouira, Imm. Emna City, Bloc B, Apt 52, 3027 Sfax, Tunisia
Tel. +216 31 383 670 · contact@shipper.network
Privacy and deletion requests: privacy@confirmy.ai
Everything else about Confirmy: hello@confirmy.ai