Privacy

Last updated 30 October 2026. Applies to the SAM private beta.

The short version

SAM keeps what it needs to do what you asked and to show you what it did. It never sells your data, never shows you ads, never asks for a password, and never keeps a one-time code or a card number. Your messages are read by an AI, and by the one person who runs SAM when something needs a human. You can see, correct or delete what we hold, and "delete my account" does most of it in seconds.

SAM is run by SME Market Technologies Limited ("we"), the controller of your personal data. Questions: ask SAM in chat, or email privacy@conciergesam.com.

1. What we collect

• Account and contact. Your name, the WhatsApp number or Telegram account you message from, when you registered and what you wrote on the form, whether you are on the waiting list, invited or in, the plan you are on, and which version of the terms you agreed to and when.
• Messages, files and requests. Everything you send SAM: text, voice notes (turned into text), photos, documents, locations and links; what SAM replied and did; the files it made for you; and when each message was delivered.
• Tasks. Each task, its steps, what SAM checked and where, the screenshots it took to show you a result, the outcome, and what the task took to run (time, messages, AI work).
• Browser work. When SAM uses a website for you: the pages it opened, the steps it took, the result. From a successful run SAM keeps a recipe of the steps (which button, which field) so the next run is faster; a recipe holds the shape of the form, never what you typed into it.
• Purchases. Merchant, items, delivery address and recipient, amounts, the approval card and your answer, checkout status, order references and receipts. Your card lives with Stripe; we keep Stripe's reference plus the brand and last four digits, so a card can say "card ending 4821".
• Reminders and routines you set.
• Your Google account, if you connect it. Your Google email address, the permissions you granted, and the access tokens Google issues (stored encrypted). Your emails, calendar events and meeting notes stay in your Google account: SAM reads them when a task needs them and keeps only what the task produces, such as a summary, a draft or a reply it sent with your yes.
• Technical and safety. At registration, the IP address and the country it points to, to keep spam and abuse out; timestamps on everything; a tamper-evident log of every action SAM took; error logs. No advertising cookies or trackers on heysam.bot.
• Calls. SAM does not place calls yet. When it does, this page will say what is kept.

2. How we use it

• To do what you asked and report back, and to remember what you have asked before: your usual order, your address, your preferences.
• To know it is you. The platform you write from (Meta for WhatsApp, Telegram) authenticates your account; SAM never asks for a password to prove who you are.
• To show you every payment before it happens, and to trace every hold and charge to the yes it came from.
• To meter what each task costs us and keep you within your plan.
• To make SAM better at the next task. Recipes, scenario testing and reviews of what went wrong are done on SAM's own records; we only use AI providers that do not train their models on what you send.
• To keep abuse out, and to meet legal duties: tax and payment records, a lawful request.

We do not sell personal data, we do not advertise, and we do not message you about anything you did not ask for.

3. The sensitive parts

• Passwords. SAM never asks for one and never needs one. Do not send one in chat: messages are kept, so if you ever do, say "forget this" and that conversation is gone.
• One-time codes. When a site texts you a code and you pass it on, SAM types it once. The message is stored as "(one-time code)"; the digits are kept nowhere, not in the log and not in a recipe.
• Signed-in sessions. When you ask SAM to use your own account at a shop or a biller, the sign-in lives in a browser profile reserved for you on a machine we run ourselves, apart from the AI: the model sees pages, never cookies. "Log me out of noon" (or any site) clears that site; "sign me out everywhere" clears them all; deleting your account removes the profile.
• Cards. Entered on a private page served by Stripe, never in chat. Stripe stores the card; we keep a reference, the brand and the last four digits; the AI and SAM's browser never see the number. SAM pays merchants with its own card, so your card never reaches a merchant. When SAM's bank wants a code for SAM's card, it goes to SAM's cardholder, never to you.
• Payments fail closed. If the amount, the merchant or the outcome is unclear, SAM stops rather than retries, and you are not charged until the merchant has confirmed.

Google data (Gmail and Calendar)

Connecting Google is optional. When you connect it, SAM can search and read your Gmail, write drafts, send an email you have approved, and read and add events on your Google Calendar. It uses that access only to do what you ask in the chat: answering questions about your mail and schedule, drafting replies, booking meetings, and picking up notes from your calls. SAM never sends an email or invites anyone without a yes from you for that exact message or guest list.

Google data is not sold, not used for advertising, not used to build profiles of you for anyone else, and not used to train AI models, ours or anyone else's. People who run SAM do not read it, except with your permission, for security, or where the law requires. It is passed only to the service providers that run SAM for you, as described below, under the same limits.

SAM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Say "disconnect Google" in the chat at any time, or remove SAM at myaccount.google.com/permissions: SAM's access is revoked and the stored tokens are deleted at once. Deleting your SAM account does the same.

4. Who else handles your data

• Our service providers, only as far as running SAM needs: the AI providers that read and answer your messages, the providers that host SAM and store its data, and our payment processor (Stripe), which stores your card and processes payments. They act on our instructions, under contracts that limit what they can do with your data; none may use it for its own purposes or to train AI models.
• WhatsApp and Telegram carry the messages between you and SAM under their own terms.
• The merchants you send SAM to get what the order needs: your name, delivery address and contact number, nothing about your card.
• The people who run SAM see your messages when you ask for a human, when something breaks, or when a payment needs checking.
• When the law requires it, or if SAM's business changes hands, in which case you would be told and this page would change.

Each sees only what its part needs. Some of them operate outside the UAE, so your data may be processed abroad, under contracts that oblige them to protect it. Ask us and we will tell you who they are.

5. Tracking

None. heysam.bot has no analytics, no advertising pixels and no third-party cookies. The only thing it counts is sign-ups per connection for an hour, to stop floods. If that ever changes, this page will say so first.

6. How long we keep it

What you send SAM, and what SAM does with it, is stored encrypted, with a key that belongs to your account alone. Deleting your account destroys that key, so anything of yours still held anywhere, backups included, can no longer be read. While SAM works on something for you, the systems doing that work read it; the messaging apps you use read it too, on their side.

Messages, memory, files and signed-in sessions stay while your account does, so SAM keeps the context. Tell SAM "forget this" and the current conversation is deleted and the next one starts fresh. Tell SAM "delete my account", confirm, and your messages, memory, reminders, browser profile and card reference are removed right away and any membership is cancelled; backups roll off within 30 days. Records of purchases you approved, and the log of what SAM did, are kept for as long as UAE tax and payment rules require, currently five years, with your name and contact details removed once your account is gone.

7. Your choices and rights

In chat, any time: "stop" ends a task SAM is working on; "human" gets you a person; "log me out of" a site forgets that sign-in; "forget this" and "delete my account" do what they say. SAM only ever messages you about your own tasks, so there is no marketing to opt out of; deleting your account stops all messages.

You can ask for a copy of what we hold about you, have it corrected or deleted, object to a use of it, ask us to restrict it, or take it with you. Ask SAM in chat or email privacy@conciergesam.com; we may check it is you, and we answer within a month. Using these rights never costs you anything or changes how SAM treats you. We follow the UAE data protection law that applies to us, and if you think we have fallen short you can complain to the data protection authority with jurisdiction over us.

8. Age

SAM is for adults. If you are under 18, please do not use it; if we learn an account belongs to a minor, we close it and delete its data.

9. Security

Everything travels encrypted. Keys and tokens live in a secret store, not in code and not in chat. The AI that talks to you runs apart from the code that moves money: the conversation never touches your card, and the payment code does not think, it checks. Every action SAM takes is appended to a log that cannot be edited afterwards. Approvals expire after 15 minutes without an answer, and SAM does one job per person at a time. What you can do: keep your phone locked, never send a password or card number in chat, read every approval card before you say yes, and ask SAM to log out of accounts you no longer use. Suspect something? Email privacy@conciergesam.com with "Security" in the subject.

10. Changes

If this page changes in a way that matters, SAM tells you in chat before the change applies to you. The date at the top is the version.

SME Market Technologies Limited · privacy@conciergesam.com