Privacy Policy

Last updated: 11 September 2026

FortuneCode CRM (“we”, “our”, or “us”) respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform and related services.


1. Information We Collect

We collect only the information necessary to provide the service.



a. Account Information

When you create or use an account, we may collect:



  • Name
  • Email address
  • Mobile number
  • Login credentials (encrypted)

b. Messaging & Usage Data

If you connect your WhatsApp account through official APIs or permitted integrations:



  • Message metadata (timestamps, delivery status)
  • Message content is stored in the customer's own workspace so that the customer and their team can read and answer their conversations; it is not sold, not shared with third parties for their own purposes, and not analyzed for any purpose other than the features the customer turns on, and it is deleted when the customer deletes it or closes their account
  • Media files you choose to send, receive, or store

We do not read, sell, or share message content for advertising purposes.



c. Device Information

  • Device type and operating system
  • App version
  • Crash logs and performance diagnostics

d. Notifications

If you choose to enable push notifications, we store a notification token to deliver alerts.

Notifications are optional and can be disabled at any time.


2. How We Use Information

We use collected information to:



  • Provide and operate the FortuneCode CRM app
  • Authenticate users
  • Display and manage chat inboxes
  • Send optional notifications
  • Improve app performance and reliability
  • Provide customer support

We do not use your data for advertising or marketing without consent.


3. WhatsApp & Third-Party Services

FortuneCode CRM integrates with:



  • Official WhatsApp Cloud API (by Meta)
  • Other optional third-party services configured by the user

Data shared with third-party services is limited to what is required for the selected integration and is governed by their respective privacy policies.


4. Payments & Subscriptions

FortuneCode CRM does not process payments, subscriptions, or in-app purchases within the mobile app.

Any account access or feature availability is provisioned externally by businesses or administrators and is not purchased inside the app.


5. Data Sharing

We do not sell or rent personal data.

We may share information only:



  • When required by law
  • To comply with legal obligations
  • To protect rights, safety, or security

6. Data Storage & Security

  • Data is stored securely using industry-standard safeguards
  • Access is restricted to authorized systems only
  • We use encryption where applicable

Despite best efforts, no system is 100% secure.


7. User Rights

You have the right to:



  • Access your personal data
  • Request correction or deletion of your data
  • Disable notifications at any time
  • Request account deletion

How to use these rights is explained in the section “Your data rights: export and deletion” below.


FortuneCode CRM does not store WhatsApp messages on Meta’s behalf and acts only as a data processor for user-initiated communications.


8. Children’s Privacy

FortuneCode CRM is not intended for users under the age of 13.

We do not knowingly collect data from children.


9. Changes to This Policy

We may update this Privacy Policy from time to time.

Any changes will be posted on this page with an updated date.


10. Contact Us

If you have any questions about this Privacy Policy or your data, contact us at:

Email: [email protected]

Website: https://fortunecode.org/

Your data rights: export and deletion

This section explains how to use the rights you have under the Saudi Personal Data Protection Law (PDPL), Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and similar laws: the right to access your data and receive a copy of it, the right to have it corrected, and the right to have it deleted.

Access and export (a copy of your data)

The account owner can download a copy of all the data the account holds at any time, free of charge: sign in, open Settings → General → My data and choose Export my data. You receive one machine-readable file (JSON) with your profile and every record your workspace holds, such as contacts, conversations, campaigns, deals, forms, bookings, team members and settings. Security credentials (password hashes, API keys, access tokens, two-factor secrets and encrypted connection settings) are replaced with “[redacted]”, and the file itself lists anything it leaves out and why. You can correct your profile details at any time under Settings → General.

Deleting your account

The account owner can delete the account at any time: open Settings → General → My data, choose Delete my account, type DELETE and confirm with your current password (and your two-factor code if two-factor authentication is on). Deletion is immediate and cannot be undone. Every session of the owner and of the team members ends, and the workspace’s contacts, conversations, media files, call recordings, team members, connected channels and settings are erased. We recommend exporting your data first. Team members cannot delete the account; only the owner can.

If you are a customer of a business that uses Flect, that business controls your data: ask it directly. The business can erase everything it holds about one person with Forget this person on the contact’s page.

What we keep after deletion, and for how long

  • Tax invoices and payment records (invoices, wallet movements, paid orders, affiliate commissions and payouts) are kept for as long as tax and accounting law requires, and then deleted: [[OWNER: retention period, e.g. the period required by the Saudi VAT / ZATCA rules and Egyptian tax law]]. Paid orders are detached from the deleted account.
  • The security audit log (a record of sign-ins and important account actions) is kept for at least 12 months for security and fraud prevention, and then deleted: [[OWNER: confirm the audit-log retention period configured in production]].
  • Backups: [[OWNER: state whether deleted data can remain in backups and for how long before they are overwritten]].

Who is responsible for your data, and how to contact us

The controller of your account data is [[OWNER: company legal name]], commercial registration no. [[OWNER: commercial registration number]], [[OWNER: registered address]]. For the data of your own customers that you keep in your workspace, you are the controller and we process it on your behalf.

For any privacy request, question or complaint, contact [[OWNER: data protection officer / privacy contact name]] at [[OWNER: privacy contact e-mail]] or [email protected]. We reply within [[OWNER: response time, e.g. 30 days]]. You also have the right to complain to the data protection authority, for example the Saudi Data and AI Authority (SDAIA) in Saudi Arabia or the Personal Data Protection Center in Egypt.