Back to home

Privacy Policy

This Privacy Policy describes how Galucy Niels Enterprises ("Galucy Niels", "we", "us", or "our") collects, uses, stores, and shares information when you use the Shona WhatsApp Business messaging platform (the "Service"). By registering for or using the Service you agree to this policy.

1. Who We Are

Galucy Niels Enterprises is a technology company incorporated in the Federal Republic of Nigeria. Shona is a multi-tenant SaaS platform that enables businesses to send and receive WhatsApp messages through Meta's WhatsApp Business Platform.

Data Protection Officer contact: hellogalucyniels@gmail.com

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, and business name provided during registration.
• WhatsApp message logs: inbound and outbound message content, timestamps, delivery statuses, and message IDs associated with your WhatsApp Business Account.
• Broadcast and template history: records of bulk broadcasts you create and send, including recipient lists, template names, and delivery outcomes.
• Contact data: names, phone numbers, email addresses, and tags of the contacts you upload or create within the platform.
• Usage data: message counts by category (marketing, utility, authentication, service), API call logs, and session metadata.
• Technical data: IP address, browser type, operating system, and server-side request logs.

We do not collect payment card numbers or financial credentials directly. Billing is handled through our payment processors.

3. How We Use Your Data

We use the data we collect to:

• Provide and operate the Shona messaging service, including sending and receiving WhatsApp messages on your behalf.
• Display analytics and delivery reports within your dashboard.
• Enforce compliance with Meta's WhatsApp Business Policy, including opt-out tracking and message frequency limits.
• Send transactional communications such as password-reset emails and service notices.
• Calculate and record per-tenant usage for billing and platform capacity planning.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with legal obligations under Nigerian law and applicable international frameworks.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the Nigeria Data Protection Act 2023 (NDPA) and applicable law:

• Contract performance: processing necessary to provide the Service you have subscribed to.
• Legitimate interests: security monitoring, fraud prevention, and platform improvement, where these do not override your rights.
• Legal obligation: compliance with court orders, regulatory requirements, and Meta's Platform Terms.
• Consent: where we rely on consent (such as for optional features), you may withdraw it at any time.

5. Data Retention

• Message logs: retained for 90 days from the date of the message, then permanently deleted.
• Account and contact data: retained for as long as your account is active, or until you submit a deletion request.
• Broadcast history: retained for 12 months, then deleted.
• Technical logs: retained for 30 days for security and debugging purposes.

6. Third-Party Sharing

We share data with third parties only as described below. We do not sell your personal data.

• Meta Platforms (WhatsApp Business API): message content and recipient phone numbers are transmitted to Meta's servers as required to deliver WhatsApp messages. Meta's own privacy policy and data processing terms govern Meta's handling of this data.
• Infrastructure providers: we use Vercel (hosting), Supabase or Upstash (database), and Resend (transactional email) to operate the platform. These providers act as data processors under contractual obligations.
• Legal authorities: we may disclose data if required by a valid court order, Nigerian law enforcement agency, or other competent regulatory authority.

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS encryption for all data in transit (TLS 1.2+).
• Hashed storage of passwords using bcrypt.
• JWT-based authentication with short-lived tokens.
• Webhook payload signature verification using HMAC-SHA256.
• Access tokens and secrets stored only in environment variables, never in source code or logs.
• Security response headers on every endpoint.

No system is completely secure. If you discover a security vulnerability, please report it immediately to hellogalucyniels@gmail.com.

8. Your Rights Under the NDPA

As a data subject under the Nigeria Data Protection Act 2023, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data. To exercise this right, log in to your Shona account, click "Data and privacy" in the footer, and click "Delete my account". Deletion is immediate. Alternatively, submit a written request to hellogalucyniels@gmail.com, which we will action within 30 days.
• Data portability: request an export of your data in a structured, machine-readable format.
• Restriction of processing: request that we restrict processing of your data in certain circumstances.
• Right to object: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection Officer at hellogalucyniels@gmail.com. We will respond within 30 days.

9. Data Deletion

You may request complete deletion of your account and associated data by:

• Logging in to shona.galucyniels.com, clicking "Data and privacy" in the footer, and clicking "Delete my account". This erases your account and all workspace data immediately, or
• Emailing hellogalucyniels@gmail.com with the subject line "Data Deletion Request", which we will action within 30 days.

10. International Transfers

Some of our infrastructure providers operate servers outside Nigeria. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including contractual protections consistent with NDPA requirements.

11. Children

The Service is intended for businesses and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before a material change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

Questions, concerns, or requests relating to this Privacy Policy should be directed to:

Galucy Niels Enterprises
Data Protection Officer
Nigeria
hellogalucyniels@gmail.com