Privacy Policy

This Privacy Policy explains how Hadal Cloud (‘Hadal’, ‘we’, ‘us’, or ‘our’) collects, uses, discloses, and safeguards personal data when you use our websites, dashboard, APIs, and related services (collectively, the ‘Services’). We are committed to processing personal data in accordance with the Kenya Data Protection Act, 2019, the EU/UK General Data Protection Regulation (where applicable), and other laws that apply to you.

1. Who we are and our role

Hadal Cloud is a multi-tenant platform that lets businesses communicate with their own customers over WhatsApp and other channels using the business’s own messaging accounts.

• Where Hadal is the controller. For the personal data of the businesses that register for the Services and their team members (for example, account, login, and billing information), Hadal determines how and why that data is processed.
• Where Hadal is a processor. For personal data that a business uploads or generates while using the Services to reach its own customers (for example, contact lists and the content of messages exchanged with those customers), the business is the controller and Hadal processes that data only on the business’s documented instructions. In that case, the business’s own privacy notice governs its relationship with its customers.

2. Information we collect

Account and profile data

Name, work email, phone number, organisation name, role, and authentication metadata.

WhatsApp connection data

When you connect a WhatsApp Business Account (WABA) through Meta’s Embedded Signup, we receive identifiers for your WABA, phone numbers, and business, together with an access token that we store in encrypted form to operate the Services on your behalf.

Audience and contact data

Contact phone numbers, names, tags, and list memberships that a business imports or creates to message its customers. The business is the controller for this data.

Message content and metadata

The content, timestamps, delivery and read status, and routing identifiers of messages sent and received through your connected accounts, so that your team can read and reply to conversations.

Billing data

When paid plans are available, billing contact details and limited payment metadata. Card details are handled by our payment processors and are not stored on our servers.

Technical and usage data

IP address, device and browser information, log events, request and tenant identifiers, and diagnostic data used for security, debugging, and analytics. We do not place personal data of message recipients in logs or URLs.

Cookies

We use strictly necessary cookies and similar technologies to keep you signed in and to secure the dashboard. We do not use advertising cookies.

3. How we use information

• Provide, operate, secure, and maintain the Services.
• Authenticate users and enforce tenant isolation and access controls.
• Send and receive messages through the accounts you connect, on your instruction.
• Provide support, respond to requests, and send service communications.
• Monitor performance, detect abuse and fraud, and improve reliability.
• Comply with legal obligations and enforce our agreements.

4. Legal bases

Where the Kenya Data Protection Act or the GDPR applies, we rely on the following bases: performance of a contract; our legitimate interests in operating and securing the Services; compliance with legal obligations; and consent where required. Businesses are responsible for establishing a lawful basis (such as opt-in consent) for messaging their own customers.

5. WhatsApp Business Platform

The Services integrate with the WhatsApp Business Platform operated by Meta. When you use WhatsApp features, your use and your customers’ data are also subject to Meta’s terms and policies. Hadal only accesses and manages the WhatsApp assets you explicitly connect and authorise, and acts on your behalf as your service provider.

6. How we share information

We do not sell personal data. We share data with service providers (subprocessors) that help us operate the Services, with Meta to deliver WhatsApp messaging, when required by law, and in connection with a corporate transaction. Our current subprocessors include:

We maintain an up-to-date subprocessor list and will provide notice of material changes.

7. International transfers

We may process and store data in countries other than your own, including outside Kenya and the European Economic Area. Where we transfer personal data internationally, we use lawful transfer mechanisms and appropriate safeguards, such as standard contractual clauses.

8. Data retention

We retain personal data for as long as needed to provide the Services and for legitimate business or legal purposes. Account data is retained for the life of the account; message and contact data is retained according to your configuration and is deleted when you delete it or close your account, subject to limited legal retention (for example, billing records). See our Data Deletion instructions.

9. Security

We protect data in transit with TLS and at rest with encryption. We isolate tenants at the database layer with row-level security, encrypt connection tokens and secrets with envelope encryption, apply least-privilege access controls, and maintain audit logging and monitoring. No method of transmission or storage is completely secure, but we work to protect your data and to notify you of qualifying incidents as required by law.

10. Your rights

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact us using the details below. If we process data on behalf of a business as a processor, we will refer your request to that business. You may also lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority.

11. Deleting your data

You can request deletion of your data at any time. Detailed steps are on our Data Deletion page.

12. Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, where appropriate, provide additional notice.

14. Contact us

Hadal Cloud — Nairobi, Kenya. Privacy enquiries: privacy@hadalcloud.com. General support: support@hadalcloud.com.