mirsal

Privacy policy

Last updated 21 October 2026

Who we are

Mirsal ("we", "us") is a messaging platform for businesses. Businesses use it to manage their contacts, send WhatsApp messages and campaigns, answer Messenger, Instagram and email conversations, and publish to their social pages. It is available at https://mirsal.fairscale.ae.

Mirsal is operated by FAIRSCALE FOR WEB-DESIGN, a sole establishment licensed by Dubai's Department of Economy and Tourism (trade licence no. 1619550). FAIRSCALE FOR WEB-DESIGN is responsible for the account data described below.

This policy explains what personal data we handle, why, and the choices you have. Questions go to support@fairscale.ae.

Two kinds of data, two roles

  • Account data — about the people who sign up and use Mirsal for their business. For this data we decide how it is used and are responsible for it.
  • Customer data — the contacts, messages and other records a business brings into Mirsal or exchanges through it. We handle this only on that business's instructions and to provide the service to it. The business decides why it contacts people and is responsible for having a lawful basis and any consent needed to message them.

If a business messaged you through Mirsal and you want to know what it holds about you, ask that business first. We will help it answer, and you can also write to us.

What we collect

  • Account details: your name, work email, a hashed password (we never store it in readable form), your workspace, your role, and your language and display settings.
  • Workspace content: contacts and the fields a business imports or adds (such as names, phone numbers, email addresses, property or unit details and custom fields), segments, templates, flows, campaigns, notes and files a business uploads.
  • Messages: the content and delivery status of WhatsApp, Messenger, Instagram and email messages sent and received through a connected account, and comments on connected Facebook and Instagram pages.
  • Connected platform data: when a business connects its WhatsApp Business Account, Facebook Page or Instagram account, we receive the identifiers, phone numbers, message templates, page details, posts, comments and lead form submissions the platform shares for the permissions granted, together with the access tokens needed to act for that business.
  • Demo requests: the name, email and other details someone enters in our request-a-demo form.
  • Technical data: IP address, browser type, and the times and pages of requests, kept in server logs for security and troubleshooting, and the notification subscription of a browser that turns on push notifications.
  • Mobile app: when you use our iPhone, iPad or Android app, the device's push notification token, its platform, app version, language and name (such as "Sara's iPhone"), so we can send the notifications you choose and stop when you sign out. The app keeps your sign-in in the device's secure storage and a copy of recently opened screens on the device so it opens quickly; signing out removes them. Face ID and fingerprint unlock happen on the device: we never receive biometric data.

We do not use advertising or analytics trackers. The cookies we set are the ones needed to keep you signed in and to remember your language and theme. The screen where a business connects WhatsApp loads Facebook's sign-in script so it can sign in with Facebook; Meta's own privacy policy covers that script.

Cookies

We set only the cookies the service needs to work, and we ask once in each browser which cookies you accept:

  • Sign-in: keeps you signed in to your account, until you sign out or for up to 30 days.
  • Language: remembers whether you read the site in English or Arabic.
  • Cookie choice: remembers your answer to the cookie question for a year.

Your colour theme is kept in your browser's own storage, not in a cookie. We do not set advertising or analytics cookies. If we ever add an optional cookie, it will be set only after you choose "Accept all", and you will be asked again first. The screen where a business connects WhatsApp loads Facebook's sign-in script only when someone chooses to connect with Facebook; Meta's own privacy policy covers that script.

How we use it

  • To provide the service: storing a workspace's data, sending the messages and campaigns a business tells us to send, receiving replies and delivery updates, and publishing the posts it schedules.
  • To keep the service secure and working: authentication, preventing abuse, diagnosing faults and enforcing platform rules such as opt-outs and messaging limits.
  • To communicate with account holders: sign-in and password emails, invitations, notifications they ask for, and replies to support and demo requests.
  • To meet legal obligations.

We do not sell personal data, and we do not use customer data or data from Meta to advertise, to build profiles, or for any purpose other than providing the service to the business that connected it.

Data from Meta (WhatsApp, Facebook and Instagram)

A business connects its WhatsApp Business Account, Facebook Page and Instagram account to Mirsal by signing in with Facebook. We then receive, through Meta's APIs and webhooks, the data needed for the features it uses: account and phone number identifiers, message templates and their review status, messages and their delivery status, Page and Instagram conversations and comments, and lead form submissions.

We use this data only to provide Mirsal to that business. Access tokens are encrypted before they are stored. Disconnecting a channel stops us from using its token, and the business can remove Mirsal's access at any time in its Meta Business settings, and we are told when it does.

AI features

AI features are off unless a business connects its own account with an AI provider and turns them on. When it does, the message content, knowledge and instructions needed for a reply are sent to that provider under the business's own account and that provider's terms. Mirsal provides no AI model of its own.

Fields a business marks as health information are never included in what is sent.

Who we share it with

  • The messaging and social platforms a business connects (Meta), to deliver its messages and posts.
  • The email servers a business configures, to send and receive its email.
  • The AI provider a business connects, as described above.
  • Expo, Apple and Google, to deliver push notifications to the mobile app. A notification carries a short title, such as a contact's name, and never the text of a message or a phone number.
  • Service providers that host and run the platform, and our payment processor for paid plans. They act on our instructions and are bound to protect the data. We never receive full card numbers.
  • Authorities, when the law requires it.

Within a workspace, people see what their role allows: phone numbers, for example, can be masked from team members who do not need them.

How we protect it

Connections to the service are encrypted in transit. Access tokens, app secrets and passwords for connected accounts are encrypted at rest with AES-256-GCM, each one bound to the record it belongs to. Access inside a workspace is controlled by roles, and sensitive actions are recorded in an audit log.

How long we keep it

We keep account and workspace data for as long as the account is open. When a business deletes something in the product — a contact list, an import, a campaign, a flow, a template — it is erased, not hidden. When a workspace is closed, we delete its data, except anything we must keep to meet a legal obligation. Backups are kept for a limited time so the service can recover from a failure, and are then overwritten.

Deleting your data

Any of these will do:

  • Account holders can delete records directly in Mirsal, disconnect a WhatsApp, Facebook or Instagram account in Settings, or ask us to close the workspace and delete everything in it.
  • If you signed in with Facebook to connect a Facebook Page or Instagram account, you can remove Mirsal in Facebook's settings under Business Integrations (or Apps and Websites). Facebook tells us when you do, and we then disconnect that sign-in in every workspace it was used in and stop using the access it gave. If you also ask Facebook to have your data deleted, we erase your name and Facebook ID from our records at once, and Facebook gives you a confirmation code and a link to https://mirsal.fairscale.ae/privacy/deletion, where you can check the status of your request. Pages, posts and conversations belong to the business that connected them and stay with it.
  • A WhatsApp Business Account connected with Facebook belongs to the business. If the business removes Mirsal from it in Meta's business settings, or the account is deleted, Meta tells us and we switch the connection off and pause its campaigns. To have the data it brought in deleted, the business can delete it in Mirsal or email us as below.
  • Anyone can email support@fairscale.ae with the subject "Data deletion request", saying which account, phone number or email address it concerns. We confirm the request and complete it within 30 days, and tell you if the law requires us to keep anything.

If a business sent you WhatsApp messages through Mirsal, replying STOP opts you out of its marketing messages, and the business can delete your details at your request.

Your rights

Depending on where you live — including under the UAE's Personal Data Protection Law — you may ask to access, correct, delete or receive a copy of your personal data, and object to or restrict how it is used. Email support@fairscale.ae. For customer data, we pass your request to the business responsible and help it respond.

Children

Mirsal is a business service and is not meant for anyone under 18.

Changes to this policy

When we change this policy we update the date at the top, and tell account holders by email or in the product before a significant change takes effect.

Contact

Questions, requests and complaints: support@fairscale.ae.

support@fairscale.ae · Mirsal