Privacy Policy

We collect information you provide directly to us and information generated through your use of the Service:

Account information: Name, email address, business name, and payment details when you register or subscribe.

Usage data: Message logs, contact lists, session configurations, and API activity associated with your account.

WhatsApp data: Message content, media files, and contact information processed on your behalf through connected WhatsApp sessions. This data belongs to you and your contacts.

Technical data: IP address, browser type, device information, pages visited, and timestamps collected automatically when you use the Service.

Communications: Content of emails or support messages you send us.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send billing-related communications
• Send service-related notifications (e.g., session status, rate limit warnings)
• Respond to support requests and inquiries
• Monitor usage to enforce quotas, prevent abuse, and ensure platform stability
• Analyze aggregate usage patterns to improve features and performance
• Comply with legal obligations

We do not sell your personal data or the data of your WhatsApp contacts to third parties.

Your data is stored on secured servers. We implement industry-standard security measures including:

• Encryption of data in transit (TLS/HTTPS)
• Encrypted storage for sensitive credentials and session authentication data
• Access controls limiting data access to authorized personnel only
• Regular security reviews and vulnerability assessments
• HMAC signature verification for webhook deliveries

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security and are not responsible for unauthorized access resulting from factors outside our reasonable control.

We retain your data for as long as your account is active or as needed to provide the Service:

• Account data: Retained until you delete your account, then purged within 30 days
• Message logs: Retained for up to 90 days by default; configurable on higher plans
• Media files: Stored for 30 days unless you delete them sooner
• Billing records: Retained for 7 years as required by law
• Server logs: Retained for up to 90 days for security and debugging purposes

You may request earlier deletion of your data at any time (see Your Rights).

We do not sell or rent your personal information. We may share data in the following limited circumstances:

Service providers: We use third-party services for infrastructure, payment processing, and analytics. These providers are contractually bound to protect your data and may only use it to provide services to us.

Legal requirements: We may disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of HarakaFlow, our users, or the public.

Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

With your consent: We may share data in other circumstances with your explicit consent.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request that we limit how we use your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@harakaflow.io. We will respond within 30 days.

We use cookies and similar tracking technologies to operate and improve the Service:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Analytics cookies: Help us understand how users interact with the Service so we can improve it. You may opt out.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from using the Service.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it promptly.

If you believe we have inadvertently collected information from a child, please contact us at privacy@harakaflow.io.

HarakaFlow operates globally and your data may be transferred to and processed in countries other than your own. These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we implement appropriate safeguards for international transfers, such as Standard Contractual Clauses (SCCs) approved by relevant authorities, to ensure your data receives an adequate level of protection.

The Service may contain links to third-party websites and services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 14 days before the change takes effect.

Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy requests: privacy@harakaflow.io
• General contact: harakaflow.io/contact