Privacy Policy

DigiTrans Consultants W.L.L. (“DigiTrans”, “CORAI”, “we”, “us” or “our”) is a Bahrain-incorporated company. CORAI is the brand under which DigiTrans provides AI-powered revenue engine, digital transformation and social media automation services, primarily through the website www.corai.me and the related product www.corlin.app (together with www.thedigitrans.com, the “Services”).

This Privacy Policy explains how we collect, use, disclose and protect personal data in connection with the Services. It also explains our role when we process data on behalf of a business client (“Client”) as part of delivering AI bots, social media management, LinkedIn outreach, dead lead reactivation, or fractional marketing services.

By using the Services, visiting corai.me, or engaging CORAI as a Client, you agree to the collection and use of information as described in this Policy. This Policy should be read together with our Terms of Service and, where applicable, a signed Data Processing Agreement (“DPA”) between CORAI and a Client.

Unlike a typical marketing-website policy, CORAI's services mean personal data belonging to three different groups of people may be processed. This section identifies each so the correct rights and legal basis apply.

If you are an End Customer / Lead and have received a message, call, or LinkedIn invitation as part of a Client's campaign run through CORAI, your data has been provided to CORAI by that Client (for example, from their CRM, WhatsApp history, or a LinkedIn search) — not collected directly from you via this website. Requests about that data should first be directed to the Client (as the data controller); CORAI will support the Client in fulfilling that request and can also be contacted directly using the details in Section 21.

• Service — corai.me, corlin.app and thedigitrans.com, operated by DigiTrans Consultants W.L.L.
• Personal Data — any information relating to an identified or identifiable living individual.
• Client — a business that has engaged CORAI to deliver AI bots, social media management, website development, dead lead reactivation, LinkedIn outreach, or fractional marketing services.
• End Customer / Lead — an individual contacted through a Client's campaign delivered using CORAI's services (WhatsApp, voice, web chat, LinkedIn, SMS, or email).
• Campaign Data — personal data supplied by a Client (e.g. CRM exports, WhatsApp contact history, LinkedIn search results) that CORAI processes to deliver a Client's campaign.
• AI Systems — third-party or first-party artificial intelligence and large language models used to generate bot replies, transcribe calls, qualify leads, or personalise outreach messages.
• Sub-processor — a third-party service provider engaged by CORAI to process personal data in order to deliver the Services.
• Usage Data — data collected automatically from use of the Service, such as page visits and duration.
• Cookies — small files stored on a visitor's device by corai.me or corlin.app.
• Data Controller — the party that determines the purposes and means of processing personal data.
• Data Processor — the party that processes personal data on behalf of, and under the instructions of, a Data Controller.

4.1 From Website Visitors

While browsing corai.me or corlin.app, we may collect:

• Contact details you submit voluntarily (name, email address, phone number, company name) via the “Book Free Strategy Call” form or WhatsApp chat link.
• Usage Data such as IP address, browser type, pages visited, and time spent on the Service.
• Cookie data as described in Section 11.

4.2 From Clients

When a business engages CORAI, we collect account and billing information, including company name, billing contact name and email, payment details (processed by our payment provider, not stored by us), and records of services purchased.

4.3 Campaign Data Processed on Behalf of Clients

To deliver AI bots, dead lead reactivation, and LinkedIn outreach, Clients provide, or CORAI collects on their instruction, personal data belonging to their End Customers/Leads. This may include:

• Names, phone numbers, email addresses and WhatsApp handles supplied by the Client from their CRM, spreadsheets, or WhatsApp Business account.
• The content of WhatsApp, SMS, web chat and voice conversations between an End Customer and a CORAI-built bot, including recordings and transcripts of voice calls.
• Publicly available LinkedIn profile information (name, job title, company, and public activity) sourced for CORLIN outreach campaigns.
• Lead qualification data generated by CORAI's systems, such as intent scoring, appointment bookings, and conversation status.

CORAI processes this Campaign Data strictly on the Client's documented instructions, for the purpose of delivering the contracted service, and does not independently repurpose it for CORAI's own marketing.

CORAI acts as a Data Controller for: website visitor data (Section 4.1), and Client account/billing data (Section 4.2).

CORAI acts as a Data Processor for: Campaign Data belonging to End Customers/Leads that a Client supplies or instructs CORAI to collect on its behalf (Section 4.3). In this capacity, CORAI processes personal data only as instructed by the Client under a written Data Processing Agreement, and the Client remains responsible for having a lawful basis to collect and share that data with CORAI in the first place.

• To provide, operate and improve the Services, including building and running AI bots, campaigns and outreach on behalf of Clients.
• To respond to, qualify and route End Customer/Lead conversations, and to hand a conversation to a Client's human team when needed.
• To book appointments, update a Client's CRM, and generate reporting on campaign performance.
• To provide customer support to Clients and website visitors.
• To send Clients and interested visitors service updates, and, where consented or permitted by law, marketing communications.
• To detect, prevent and investigate fraud, abuse, or technical issues.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal data. We do not use Campaign Data belonging to End Customers/Leads to train public, general-purpose AI/ML models.

CORAI's bots and outreach tools are built using third-party AI language models, speech-to-text/voice models, and CORAI's own qualification logic. When you message or speak with a CORAI-built bot, your message or call audio is processed by these AI Systems in order to generate a reply, transcribe the conversation, or score the lead.

Lead qualification and scoring are automated processes. Where a decision meaningfully affects you (for example, whether you are routed to a human), you may request human review by asking to speak with a member of the Client's team at any time during the conversation.

Voice bot calls may be recorded and transcribed for quality, training and dispute-resolution purposes. Where legally required, you will be notified at the start of the call that it may be recorded.

AI providers used to process conversation content act as CORAI's sub-processors and are contractually restricted from using the content to train their own general-purpose models, to the extent CORAI's agreements with them permit.

CORAI operates CORLIN, a LinkedIn outreach tool used by Clients for B2B lead generation. If you have received a LinkedIn connection request or message as part of a Client's CORLIN campaign, your publicly visible LinkedIn profile information was used to identify you as a relevant business contact.

Legal basis: this outreach is conducted on the basis of legitimate interest for direct business-to-business marketing, balanced against your rights and interests. It is not based on your prior consent.

You can opt out at any time by replying “not interested” or “unsubscribe” to the message, or by contacting privacy@corai.me.

CORLIN is designed to operate within LinkedIn's User Agreement using human-like sending patterns and volume limits; it does not use LinkedIn credentials or data for any purpose beyond the outreach campaign authorised by the Client.

Messages sent to a Client's WhatsApp number, website chat widget, or CORAI-built voice line are received and processed by CORAI's systems and relevant AI Systems in order to generate a response.

Conversation transcripts and, for voice calls, audio recordings, are stored to allow the Client's team to review the interaction, retrain the bot, and resolve disputes.

You may opt out of further WhatsApp or SMS messages at any time by replying “STOP”, or by informing the bot or a human team member directly.

Where the Client uses a WhatsApp Business Platform integration, message data is also subject to Meta's WhatsApp Business Terms and Privacy Policy.

For this service, the Client supplies CORAI with existing, previously collected contact records (from their CRM, WhatsApp history, or spreadsheets) for the purpose of re-engaging contacts who have gone quiet. CORAI does not independently source or purchase these contact lists.

The Client is responsible for ensuring it had a lawful basis to originally collect this data and that re-contacting these individuals complies with applicable marketing and data protection laws.

CORAI processes this data solely to run the reactivation campaign instructed by the Client and to report results back to the Client.

Recipients may opt out of further contact at any time using the mechanisms described in Section 9.

We use cookies and similar tracking technologies on corai.me and corlin.app to operate the Service and understand how it is used.

• Session Cookies — used to operate the Service.
• Preference Cookies — used to remember your settings.
• Security Cookies — used for security purposes.
• Analytics Cookies — used to understand visitor behaviour and improve the Service.

You can instruct your browser to refuse cookies; some parts of the Service may not function correctly without them.

DigiTrans Consultants W.L.L. is based in the Kingdom of Bahrain. Delivering the Services may require transferring personal data to sub-processors located outside Bahrain, including in the United States, the European Union, or other jurisdictions where our hosting, AI, messaging, or analytics providers operate.

Where personal data is transferred internationally, we take reasonable steps to ensure it remains protected consistent with this Policy, including through contractual safeguards with sub-processors (such as Standard Contractual Clauses where required for transfers from the EEA).

• Law enforcement — where required by Bahrain law, a court order, or valid request by a public authority.
• Business transaction — if CORAI/DigiTrans is involved in a merger, acquisition, or asset sale.
• Sub-processors — third parties engaged to deliver the Services, as described in Section 18.
• With consent — in any other case where you have agreed.
• To protect rights — where we believe disclosure is necessary to protect the rights, property, or safety of CORAI, our Clients, or others.

We use commercially reasonable administrative, technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricted sub-processor access. No method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

16.1 European Union / EEA (GDPR)

If you are located in the EU/EEA, you have the right to access, rectify, delete, or restrict processing of your personal data, to object to processing, to receive your data in a portable format, and to withdraw consent at any time. You may also lodge a complaint with your local data protection authority.

16.2 Bahrain (Personal Data Protection Law)

If you are located in Bahrain, you have rights under the Personal Data Protection Law (Legislative Decree No. 30 of 2018), including the right to access, correct, and request erasure of your personal data, to object to processing for direct marketing, and to lodge a complaint with the Personal Data Protection Authority (PDPA).

16.3 Saudi Arabia (Personal Data Protection Law)

If you are located in the Kingdom of Saudi Arabia, you have rights under the Saudi Personal Data Protection Law, including the right to be informed, to access, and to request correction or destruction of your personal data, subject to the exceptions set out in that law.

16.4 California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, to request deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information (CORAI does not sell personal data), and to non-discrimination for exercising these rights.

To exercise any of the above rights, contact us using the details in Section 21. We may ask you to verify your identity before responding. If you are an End Customer/Lead, we may direct your request to the relevant Client where they are the data controller, while still assisting with your request directly.

The Services are not directed at children under 16 and we do not knowingly collect personal data from children. If we learn that we have inadvertently collected personal data from a child without appropriate consent, we will delete it.

We use the following categories of third-party service providers to deliver the Services. Specific vendor names are confirmed with each Client's Data Processing Agreement and available on request.

If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the affected individuals and/or relevant regulator without undue delay, in accordance with applicable law, and will support affected Clients in meeting their own notification obligations.

We may update this Privacy Policy from time to time. Material changes will be notified via a prominent notice on corai.me and, where appropriate, by email, before the change takes effect. The “Last updated” date at the top of this page will reflect the most recent revision.

If you have questions about this Privacy Policy, or wish to exercise your data protection rights, please contact us:

• By email: privacy@corai.me (or info@thedigitrans.com)
• By WhatsApp: via the “Chat with us” link on corai.me