Privacy Policy — DragonSocial

Last updated: 1 November 2026

Who we are

DragonSocial is an operations tool run by Dragon International (DRAGON FOR IMPORTS AND EXPORTS AND MULTIPLE ACTIVITIES CO.LTD), Sudan. Registered office: Port Sudan, Airport District, Block 7, Property 887, 1st floor, Apt 3 (Certificate of Incorporation No. ش/6010, Red Sea State, 9 October 2025). Place of business: Dragon Building, Airport Street, Atbara. It works only for the company's own accounts: our Facebook Page and our Instagram professional account. It does not operate for anyone else. Dragon International (DRAGON FOR IMPORTS AND EXPORTS AND MULTIPLE ACTIVITIES CO.LTD) is responsible for the processing described here. Contact: info@dragonsudan.com or 0999813333.

Data we process

When you comment on a post on our Page or Instagram account, or send either of them a private message, we process:

• Your Page-Scoped ID or Instagram-Scoped ID.
• Your public name as shown on the platform (Facebook profile name or Instagram username).
• The text and time of your comment or message.
• A short log of your private conversation with us: the time, direction and sender of each message (you, our automatic reply, or a member of our staff) and its message ID. We keep the text of your own messages only, cut at 1,000 characters; we do not keep the text of our replies in this log. We also record conversation state (whether automatic replies are paused, and the time of last activity).
• A log of the automatic messages we sent you (keyword replies, quick-reply button replies, the fallback reply and the confirmation of a request for a person), and of what happens when you tap a button in our messages.
• If you open our chat from an m.me or ig.me link or an ad: your ID, the ref tag in the link, the source as sent by Meta, and the event type and time. The source may also be noted on your lead record.
• A contact list: name, username, ID, subscription date and the subscription details in the import file, and labels our team puts on contacts for organisation. A large part of it was carried over from our previous tool (ArabyBot) for the subscribers of our Facebook Page and Instagram account.
• Only if you choose to send them in a private message so we can prepare a quote or invoice: your full name, city, product or machine type, quantity, contact phone number and WhatsApp number, and an alternate contact name and number if you optionally share them with us.

We do not ask for passwords or payment details. If you write extra details in a message, the text of your messages may be stored as you sent it, together with your request record. Our sales team may also add text notes to your request record.

The posts, images and videos we publish from the company's accounts, and aggregate Page statistics (public totals without names), are company content, not personal data about you. Company images we upload are served at public, hard-to-guess links so that Meta can fetch them.

Why we process it

• To reply to your enquiry with product information and our sales team's WhatsApp number.
• To prepare the quote or invoice you asked for.
• To prevent duplicate replies caused by receiving the same event more than once.
• Administrators can retain company and published-content text batches for review. Originals and excerpts are retained for 30 days, then cleared by periodic cleanup; source labels, hashes and derived templates remain until separately deleted. If the name is left blank, it is derived from the first 60 Unicode characters of the first nonempty input line; this excerpt remains as the label until the source is deleted. This path does not support customer data, mixed files or OCR. Batch deletion is blocked for review if a linked template was edited or activated, and does not automatically erase backups.
• For sales follow-up by our team.
• To answer your private messages with prepared replies matched to the words in your message, to pause automatic replies when a person takes over, and to show our team the conversations waiting for a reply.
• To know which link or ad your conversation came from, and to organise contacts.
• To moderate comments on our Page and account (see "Comment moderation" below).

How processing works

Some features use preset rules (keywords and saved messages) on our servers. When AI features are enabled, an authorised administrator who approves sending the selected content can send a selected comment or a limited portion of a WhatsApp conversation handled through YCloud, together with selected company sources, to OpenAI to prepare a draft for staff review before use. When the automated WhatsApp reply workflow through YCloud is enabled and its configuration and sources are approved, it can also use OpenAI to prepare replies that are sent after automated checks without staff reviewing each reply.

Before sending comment or conversation text to OpenAI, we mask common patterns of contact details such as phone numbers, email addresses, links and usernames. The model context excludes account and message identifier fields, but other personal details may remain in the text; this does not fully anonymise it. We make no automated decisions about you that have legal effect. Our sales team reviews requests and contacts customers.

Automatic messages

We may reply publicly to your comment under company rules and may send you a private message. We may answer your private message with a saved message if the words of your message match a rule set by our team; it may include quick-reply buttons (up to 13) or an image. When you tap a button we send the message linked to it. Automatic messages are limited:

• At most one automatic message for each message you send.
• At most 2 automatic follow-up messages asking for missing details in any 24 hours, and one confirmation message when your details are complete.
• Only within Meta's messaging window, which is 24 hours after your last message to us. A private reply to a comment is sent within 7 days of the comment.

Automated-reply disclosure: the first automatic message we send you in a conversation, the first one after a member of staff took over or automatic replies were paused, and the first one after 24 hours without automatic messages start with the line «(رد آلي من دراغون، ولو عايز تكلم موظف اكتب: موظف)» ("automatic reply from Dragon; to talk to a member of staff, type: موظف") inside the same message, so you know the reply is automated. Public replies to comments do not carry this line. We record the time of the last disclosure in the conversation state.

Ask for a person: send «موظف» (or a short phrase such as «عايز اتكلم مع موظف», «خدمة العملاء» or "agent") on its own, or tap the «كلّم موظف» / «تواصل مع موظف» button. We then pause automatic replies in your conversation (12 hours by default), put your conversation at the top of our team's waiting list with an alert to staff, and send you one short confirmation within the messaging window. We record the time of the request and the ID of your message in the conversation state. If it is urgent: WhatsApp 0999813333.

Opt out: send «توقف» or "stop" as a message on its own (or a similar short word on its own, such as «وقف» or «كفاية»), and we will send no further automatic private messages. We record your request on your record with us, and our team can still see your enquiry.

Handover to a person

When a member of our staff replies to you from the Page inbox, or from another tool connected to the Page, Meta sends us a copy of that reply (a message echo). We then pause automatic replies in your conversation for a limited time (12 hours by default) so that the bot does not talk over the person. The same pause happens when you ask for a person yourself (see "Ask for a person" above). Our team can also pause or resume the automatic replies by hand. In the conversation log we record the time and message ID of the staff reply, not its text.

Comment moderation

When the moderation feature ("the guard") is switched on for a rule, comments that contain a link, an image or a video (we can detect this on Facebook only, because Instagram sends us the text alone), or a word from a list of unacceptable words chosen by our team, may be hidden from the public automatically, and we may not reply to them. The default action is hiding; the company can set a rule to delete instead. We record the action and its reason (link, image or word) with the comment. If you think your comment was hidden by mistake, write to info@dragonsudan.com.

Sharing and sale

We do not sell your data and do not share it for advertising. We process data on the company's servers and use our hosting provider to run the service. When the AI features described above are used, we send the selected content to OpenAI for processing. Meta's platforms (Facebook and Instagram) are the source of comments and messages and the channel through which our replies are sent; when the WhatsApp integration is used, its messages are processed through YCloud and WhatsApp for sending and receiving.

Page insights and published content

Through Meta's Graph API we read aggregate performance metrics for our Page and professional Instagram account, such as reach, views and engagement. These are aggregated figures that contain no personal data about individuals, and they are shown only to company staff inside the tool's dashboard.

Our staff also use the tool to publish and schedule the company's own content on its Page and account (posts, stories and reels). Staff write and approve this content; it is the company's content, not that of visitors.

Requests from public authorities

We disclose your data to a government or public authority only when the law requires us to. We first check that the request is valid and has a legal basis, challenge requests that are unlawful or broader than necessary, disclose only the minimum data the request needs, and keep a record of the request and our response.

Retention

• Raw events received from Meta (including names and comment text): 30 days.
• Comments (name and text) and the reply records linked to them: 365 days (12 months) from the comment date.
• The temporary processing queue (it carries the content of the comment or message, and may include part of a staff reply): 30 days after the job finishes.
• The message log (time, direction, ID, and the text of your own messages cut at 1,000 characters) and the log of automatic messages sent to you: 90 days.
• Conversation state (pause of automatic replies and last-activity times): 90 days after the last activity.
• Lead records (name, city, product, quantity, phone and WhatsApp numbers, optional alternate contact details, the text of the customer's messages and the conversation source) and the sales notes attached to them: 365 days after the last activity.
• The log of chats opened from m.me and ig.me links (ID, tag, source, time): 365 days.
• The contact list carried over from our previous tool (name, username, ID and their labels): 12 months from the date it was imported, then deleted automatically.
• The comment decision log (the platform comment ID, the outcome and the rule number only, with no name, text or your ID): 365 days.
• The "once per person" marker (your ID and a rule number only): 365 days from when it was recorded.
• Unverified requests we reject: 7 days, technical metadata only (size, hash, network address, reason), no content.
• Operational logs: 30 days for the send success/failure log and 90 days for the maintenance log; acknowledged operational alerts are deleted 90 days after they were created. They contain no message text or names.
• Encrypted backups: the latest 14 daily copies. A backup may still hold data deleted after it was taken until it is replaced, within 14 days.

These periods are the settings currently applied in our system. Any change will be published on this page.

Deleting your data

You can ask us to delete your data at any time in either of two ways: through the data deletion notice Meta sends us when you remove the app from your account settings, or by emailing info@dragonsudan.com. We complete requests within 30 days. Details and status tracking are on the data deletion page.

After deletion we keep only a one-way SHA-256 hash of your ID on a suppression list, so your data is not collected again if a late event arrives or a backup is restored. This hash is an identifier that can be matched to your ID, so we do not describe the result as complete erasure. The deletion request record itself also remains so we can tell you its status; the ID Meta sent with the request is erased from it 30 days after the request is completed. The comment decision log (which holds no ID of yours) is not deleted on request; it expires automatically after 365 days. Details of what is deleted and what remains are on the data deletion page.

Your rights

You may ask to access, correct or delete the data we hold about you. Send your request to info@dragonsudan.com, call 0999813333, or message us on WhatsApp: https://wa.me/249999813333. How deletion works is described above.

The service is not directed to children under 13, and we do not knowingly collect their data. If we learn that a child under 13 has contacted us, we will delete that child's data.

Privacy questions

Dragon International (DRAGON FOR IMPORTS AND EXPORTS AND MULTIPLE ACTIVITIES CO.LTD).
Registered office: Port Sudan, Airport District, Block 7, Property 887, 1st floor, Apt 3 (Certificate of Incorporation No. ش/6010, Red Sea State, 9 October 2025). Place of business: Dragon Building, Airport Street, Atbara, Sudan.
Email: info@dragonsudan.com
Phone: 0999813333