Privacy policy

Last updated 15 October 2026

Qasid is a conversation CRM operated by Cubex Technologies SMC-Pvt Ltd, a company registered in Pakistan. This policy explains what we do with personal data when a business uses Qasid, and what we do with yours if you are one of their customers.

Our role

Qasid is used by businesses, mostly travel agencies, to handle enquiries their own customers send them on WhatsApp, Instagram and Facebook.

• For conversation data, the business using Qasid decides why and how that data is handled. They are the controller. We handle it on their instructions as a processor, under a written agreement.
• For account data about the business and its staff, we are the controller.

If you are a customer of a business that uses Qasid and you want your data removed, contact that business first. We will act on their instruction. You can also contact us and we will pass the request on.

What we handle

From a business using Qasid

• Names, work email addresses and roles of staff accounts
• Business name, registered address and contact details
• Sign-in records, including time and approximate location derived from IP address
• Billing and subscription records

From conversations handled through Qasid

• Message content, including text, images, documents, audio and video
• The phone number or platform identifier of the person messaging
• The display name their messaging profile provides
• Timestamps, delivery and read status
• Which staff member handled the conversation and when

Where a business connects an existing WhatsApp number using Meta Coexistence, Meta may transfer prior chat history for that number into Qasid at the point of connection. That history is handled on the same terms as everything else here.

Why we handle it

• To deliver the service the business is paying for: receiving messages, routing them to staff, and sending replies
• To show the business its own reporting, such as response times and volumes
• To record what each conversation costs in Meta messaging charges
• To keep the service secure, diagnose faults and prevent abuse
• To meet legal and accounting obligations

What we do not do

• We do not sell personal data, and we never have
• We do not use message content for advertising or ad targeting
• We do not use one business's conversation data to serve another business
• We do not use message content to train machine learning models

Who else is involved

• Meta Platforms delivers the messages themselves through the WhatsApp Business Platform, the Instagram Messaging API and the Messenger Platform. Their handling of that data is governed by their own terms and policies.
• Hetzner Online GmbH provides the servers and storage Qasid runs on.
• Payment and accounting providers, for billing records only. They receive no conversation data.

We do not share personal data with anyone else except where the law requires it.

Where it is kept

Qasid runs on dedicated servers operated by Hetzner. Media files are stored in Hetzner Object Storage in the European Union. A business is told which region its data sits in at onboarding.

How long we keep it

• Conversations and messages: 24 months by default. A business can set this as low as 6 months.
• Account records: for as long as the account is active, then 12 months.
• Billing records: 7 years, as required for accounting.
• Server and security logs: 90 days.

On request we will delete an individual contact and all their conversation data, and confirm when it is done.

Keeping it safe

• All data encrypted in transit using TLS
• Data encrypted at rest, with channel access tokens encrypted separately
• Isolation between businesses enforced at the database level, not only in the application
• Staff see only what their role allows: an agent sees their own conversations, a team lead sees their team
• Access to production systems restricted to named personnel with multi-factor authentication

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay.

Your rights

Depending on where you live, you may have the right to:

• Ask what personal data we hold about you
• Ask for a copy of it
• Ask us to correct it
• Ask us to delete it
• Object to or restrict how it is handled
• Complain to a data protection authority

Write to privacy@qasid.io. We respond within 30 days. If the data belongs to a business using Qasid, we will refer the request to them and support them in answering it.

Children

Qasid is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child's data has reached us, contact us and we will remove it.

Changes

If we change this policy we will update the date above. Where a change materially affects how we handle personal data, we will notify account holders by email before it takes effect.

Contact

Cubex Technologies SMC-Pvt Ltd
404, Al Rehman Corner, DMCHS, Karachi East Jamshed Town Shaheed e Millat Road Karachi
privacy@qasid.io