Privacy policy

Who this covers

This policy covers Aahfil, a digital marketing agency based in Kuwait City, Kuwait, and the website at https://aahfil.com. It covers visitors to the site and people who contact us through it. It does not cover the marketing accounts we operate on behalf of clients — those are governed by the agreement with each client.

What we collect

We collect three kinds of information, and no more than we need for each.

• Details you type in. When you submit the enquiry form, request a proposal, book a call, use the growth scorecard or talk to the assistant on the site, we receive what you enter — typically your name, phone number, and optionally an email address, Instagram handle, company name and a message describing what you need.
• How you arrived. We record the marketing source of a visit (referrer and UTM parameters) so we know which channels produce enquiries. This is attribution data about the visit, not a profile of you.
• Technical data. Standard web server information, plus a one-way hash of your IP address used to rate-limit the public endpoints. We do not store raw IP addresses for that purpose.

Why we collect it

To answer your enquiry and to run the consultation you asked for. To measure which marketing channels work, so we spend our own budget sensibly. To keep public endpoints — the enquiry form, the on-site assistant and the MCP server — from being abused. That is the whole list. We do not sell personal information, and we do not share it for anyone else's advertising.

Who processes it for us

We use a small number of third-party services to run the site and handle enquiries. Each one receives only what it needs to do its job:

• Supabase — the database where enquiries, bookings, scorecard results and assistant conversations are stored.
• Vercel — hosting and content delivery for the site itself.
• Google Analytics — aggregate traffic measurement.
• Meta (Conversions API) — server-side conversion events, so we can measure ad performance. Contact details are transmitted in hashed form. Bookings made through an AI agent are excluded, because no advertisement caused them.
• Gallabox (WhatsApp Business) — sending your booking confirmation and alerting our team.
• ClickUp — the internal task board where an enquiry becomes a job for someone to action.
• Resend — internal email notification of new enquiries.
• Anthropic — powers the assistant on the site. Your messages to it are processed to generate a reply.

Cookies and tracking

The site uses analytics and advertising cookies, including Meta's _fbp and _fbc identifiers, to attribute visits and conversions to the campaigns that produced them. You can block or delete these in your browser settings; the site works without them, though our attribution gets less accurate. We do not use cookies to build profiles for sale.

AI agents and automated access

This site publishes machine-readable content deliberately — markdown mirrors of every page, an llms.txt index, and an MCP server. All of it exposes public business information only: services, availability and published content. No personal data of any visitor is reachable through those surfaces, and the endpoints that could create a record are rate-limited and, where they write anything, disabled by default.

How long we keep it

Enquiries and bookings are kept for as long as we have a live or reasonably foreseeable business relationship with you, and then removed. Assistant conversations and hashed rate-limit records are kept only as long as they are operationally useful. If you ask us to delete your information, we delete it.

Your choices

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Message us on the number below and say what you want done. We will action it and confirm. You do not need to give a reason, and asking costs you nothing.

Changes to this policy

If we change what we collect or who processes it, we update this page and change the date at the top. Material changes will be obvious rather than buried.