Privacy Policy

1. Who We Are

WaziBot provides a software-as-a-service (SaaS) platform that enables businesses to automate WhatsApp customer interactions, manage orders and payments, and communicate with their customers via AI-assisted messaging.

By using WaziBot, you agree to this Privacy Policy. If you are a business ("tenant") using WaziBot to serve your own customers, you are also responsible for your customers' data under applicable laws in your jurisdiction.

2. Data We Collect

Business Account Data

• Business name and contact information
• Username and hashed password (we never store plain-text passwords)
• WhatsApp Phone Number ID and access token (encrypted at rest)
• Payment configuration (EcoCash number, PayPal email)
• Product catalogue and inventory data

Customer Conversation Data

• WhatsApp phone numbers of customers who message a business
• Message content (text, images, documents sent by customers)
• Order history, cart contents, and delivery addresses
• Payment references and proof-of-payment images
• AI conversation memory (purchase history, preferences, name if provided)

Usage Data

• API request logs (IP address, endpoint, timestamp)
• Error logs and performance metrics
• Authentication events (login, logout, failed attempts)

3. How We Use Your Data

• To operate the service — process orders, route WhatsApp messages, generate AI replies
• To improve AI responses — customer memory helps personalise greetings and suggestions
• To process payments — order totals and payment references are stored to track fulfilment
• To send campaigns — businesses may send broadcast messages to their own customers via the platform
• To ensure platform security — rate limiting, spam detection, and abuse prevention
• For billing and support — business account information and usage records

4. WhatsApp Message Handling

WaziBot processes WhatsApp messages through the Meta WhatsApp Cloud API. Messages sent through WaziBot are subject to WhatsApp's Privacy Policy and Meta's Platform Terms.

• Message content is stored in our database (Supabase) to power the inbox and order tracking
• AI replies are generated using customer message history stored in our system
• Payment proof images sent via WhatsApp are stored temporarily for order verification
• We do not sell WhatsApp conversation data to third parties

5. AI Processing Disclosure

WaziBot uses an AI conversation engine to automatically reply to customers on behalf of businesses. The AI:

• Reads the customer's message and recent conversation history
• Uses customer memory (past orders, name, preferences) to personalise responses
• Does not share data between different businesses' customers
• May optionally use the OpenAI Whisper API for voice note transcription if enabled by the business (requires an OpenAI API key configured by the business operator)

6. Payment Information

WaziBot does not process card payments directly. Payment methods supported (EcoCash, PayPal, Cash) are configured by individual businesses. We store:

• Order totals and payment status for fulfilment tracking
• Payment references provided by customers
• Business EcoCash/PayPal configuration (encrypted at rest)

For PayPal payments, transactions are processed by PayPal and governed by their privacy policy.

7. Data Storage and Security

• All data is stored in Supabase (PostgreSQL), hosted on secure cloud infrastructure
• WhatsApp tokens and sensitive credentials are encrypted using Fernet symmetric encryption
• Passwords are hashed using bcrypt — never stored in plain text
• All API communication uses HTTPS with TLS encryption
• We implement rate limiting, webhook signature verification, and abuse detection

8. Third-Party Services

• Meta / WhatsApp — message routing and delivery
• Supabase — database and authentication infrastructure
• OpenAI (optional) — voice note transcription (Whisper API), only if configured
• PayPal (optional) — payment processing, only if configured by the business
• Render.com — hosting and deployment infrastructure

9. Tenant Responsibilities

Businesses ("tenants") using WaziBot to communicate with their own customers are responsible for:

• Obtaining appropriate consent from their customers to receive WhatsApp messages
• Complying with WhatsApp's Business Policy and applicable local laws
• Not using the platform to send spam or unsolicited messages
• Handling customer data in accordance with applicable data protection laws (GDPR, POPIA, etc.)

10. Data Retention

We retain data for as long as your account is active. When a business account is deleted, associated customer conversation data is removed within 30 days. You may request deletion of your data by contacting us.

11. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your data. To exercise these rights, contact us through the platform or the email address on our landing page.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

13. Contact

For privacy questions or data requests, please contact us via the WaziBot platform support.