Who we are

Zahy is a platform by Acryna (Egypt) that helps doctors, clinics and businesses create social media designs and reels with AI, and publish or schedule them on their own accounts. This policy covers the Studio only (designs, montage, ads, calendar and publishing, and the Communication Center); Acryna's main website has its own policy.

For any privacy question or request, contact us through our contact page.

What we collect and why

• Account: email, name, a password hash (never the password itself) or your Google sign-in (email, name, Google account id). Used to sign you in, confirm your email and keep your credit balance.
• Brand kit: logo, colours, the doctor's name and title, clinic name, phone and address. Used on your designs, reels and captions.
• Design and caption requests: what you type, and a person's photo if you choose to feature one. Sent to an AI provider to produce the result; the photo is not stored by us.
• Montage videos: the raw video you upload, the reels made from it and their transcript. The raw video is deleted as soon as the montage is done.
• Facebook and Instagram accounts you connect: Page id and name, Instagram account id and username, and the publishing access token Facebook gives us when you approve. Used only to publish the posts you schedule, on the accounts you chose.
• Brand analysis (when you run it): the links you give us, what we read on your website (name, logo, colours, contact details and its text), and on your Page and Instagram account (follower count, recent posts with their captions and like and comment counts, and the pictures of the 6 best posts). Used to fill your Brand Kit, show you what works on your social media and suggest posts. The website text and captions sent to the AI have phone numbers, links and emails removed.
• Posts: the image or reel, caption, time, publishing status and the post's link once published.
• Communication Center (when you connect your channels): the messages your customers send to your Page on Messenger, your Instagram account and your WhatsApp Business number, the comments on your posts, the writer's name and username or number, your replies, and the labels and notes you add. Used to show them to you so you can answer. Message and comment texts are deleted after 90 days, or at once when you disconnect the channel.
• AI assistant (if you switch it on, or click “suggest a reply” or “try”): the conversation's text and the business information you wrote for it are sent to our AI provider to draft an answer from that information only, without the customer's name and with phone numbers, links and emails removed. Your own phone and address are added to the reply by us, not by the model.
• Operational data: short technical logs (time, request type, errors) without the content of your requests, and a log of actions our support team takes on accounts. Used for security, troubleshooting and abuse prevention.

Your design projects themselves are saved on your device (in the browser), not on our servers.

Data from Facebook and Instagram (Meta)

• When you click “Connect Facebook and Instagram”, you sign in on Facebook yourself and choose the Pages. We never see your password.
• We request only what is needed to list and publish to your Pages and Instagram accounts: pages_show_list, pages_manage_posts, pages_read_engagement, instagram_basic, instagram_content_publish, instagram_manage_insights and business_management.
• Communication Center: when you connect your Page, Instagram account and WhatsApp Business number there, we request the messaging and comments permissions (pages_messaging, pages_manage_metadata, pages_read_user_content, pages_manage_engagement, instagram_manage_messages, instagram_manage_comments, whatsapp_business_management, whatsapp_business_messaging) so your customers' messages and comments reach you and you can answer them, and hide or delete a comment when you choose. We only answer people who wrote first, within the time Meta allows (24 hours after their last message), and never send marketing messages.
• The Communication Center's AI assistant is off until you switch it on, and you choose per channel whether it drafts answers for you to approve or answers by itself. Every reply it writes is marked in the conversation, and medical questions and complaints are handed to you, never answered automatically.
• Brand analysis: when you run it yourself, we read your Page's and Instagram account's name, description and follower count, and their latest posts (text, picture, date, like, comment and share counts). If you type an Instagram Business or Creator username without connecting it, we read the same public data through Meta (Business Discovery). In this analysis we never read comment texts or any data about the people who follow or interact with you.
• We store the Page id and name, the Instagram account id and username, the WhatsApp number and its name, and the access tokens. Tokens are encrypted at rest (AES-256-GCM) and never sent to your browser or anyone else.
• We publish only what you schedule or publish yourself. We read your Page's messages and comments only when you connect it to the Communication Center, and show them only to you so you can answer. We do not read your followers' data, do not use Facebook, Instagram or WhatsApp data for advertising, do not sell it, and do not use it to train any model.
• You can disconnect any account at any time in Settings → Connected accounts; its token, scheduled posts and Communication Center conversations are deleted immediately; a WhatsApp number is disconnected from Communication Center → Channels. If you remove our app in your Facebook settings, Facebook notifies us and we delete the same data automatically. See data deletion.
• Our use of Meta data complies with the Meta Platform Terms.

Who processes data with us

• Cloudflare: hosting, database and file storage (images, videos, reels).
• AI providers (through OpenRouter: Anthropic Claude and OpenAI models; Google Gemini for montage): receive the text of your request, or the image or video to be processed, to return the result. Phone numbers and addresses are never sent to AI models. If you switch on the Communication Center's assistant, the conversation's text is sent without the customer's name, numbers and links.
• Meta (Facebook, Instagram, WhatsApp): when we publish, we send the post (image or reel and caption) to the account you chose; Meta fetches the file from a temporary link. When you reply from the Communication Center, the reply is sent to Meta to reach the customer.
• Google: if you sign in with Google. Resend: to email you confirmation and password reset codes.

Some of these providers store or process data outside Egypt. We choose providers committed to data protection, and we never sell your data.

Retention

• Account and brand kit: while your account exists, or until you ask us to delete it.
• Raw montage video: deleted when the montage is done. Finished reels: deleted after 30 days.
• Post images: deleted after at most 75 days.
• Facebook, Instagram and WhatsApp tokens: until you disconnect the account or remove our app on Facebook, then deleted immediately.
• Communication Center messages and comments: texts deleted after 90 days; all of a channel's conversations deleted at once when you disconnect it.
• Brand analysis: only the latest one (each new analysis replaces the last), while your account exists.
• Sessions: 30 days, or until you sign out or change your password.

Security, your rights, patients, cookies

All traffic is encrypted (HTTPS). Passwords are stored as salted hashes with a separate secret; tokens and keys are encrypted; files are private to their owner and reached through temporary links. Nobody on our team can see tokens or passwords.

You can access, correct or delete your data and object to its processing under Egypt's Personal Data Protection Law (No. 151 of 2020). Ask through our contact page; we reply within 30 days at most.

The Studio is for marketing and educational content, not for patient records. Do not include data or images that identify a patient without their written consent. Patients' messages in the Communication Center are shown only to you, and the AI assistant never answers a medical question by itself.

We use strictly necessary cookies only: the sign-in session (HttpOnly) and a short-lived cookie that protects Google sign-in and Facebook connection. No advertising or tracking cookies.

The Studio is for people aged 18 or over. If we change this policy we will update the date above, and tell you by email or in the Studio when the change is significant.