Privacy Policy.

1Who this applies to

We serve businesses (our customers) that connect a WhatsApp Business number and invite team members into a workspace. Those businesses typically act as the controller for their customer and lead data. Onetali processes that data on their behalf to provide the product. This policy also covers personal data of workspace users (owners, admins, agents) and visitors to our marketing site.

2Information we collect

Depending on how you use the service, we may process:

• Account & workspace data — name, email, organization name, roles, invites, billing contact details, and authentication signals (for example email OTP or Google sign-in).
• WhatsApp Business data — messages, media metadata, delivery/read status, phone numbers, profile names, and related webhook events received through Meta's official Cloud API for numbers you connect.
• CRM & operations data — leads, notes, tags, appointments, follow-ups, handovers, Store catalogue and orders, broadcasts, and templates you configure.
• Google user data (Google Sheets integration) — if you optionally connect Google Sheets to sync contacts into your workspace, we request the narrow read-only scope (https://www.googleapis.com/auth/spreadsheets.readonly). We access only the specific spreadsheets you select to import contact names, phone numbers, tags, and notes into your workspace.
• AI feature data — conversation snippets, FAQs, policies, business description, catalogue excerpts, and model outputs used for triage, suggested replies, and optional auto-reply when you enable those features.
• Usage & device data — approximate logs needed for security, debugging, and product analytics (for example IP address, browser type, and feature usage events).
• Payment data — subscription and payment status handled via our payment processor (for example Paystack). We do not store full card numbers on our servers.

3How we use information

• Provide, secure, and improve the Onetali workspace.
• Deliver shared inbox, CRM, Store, broadcasts, integrations, and team collaboration features.
• Import and synchronize customer contacts from Google Sheets when you authorize the integration. We access only the specific spreadsheets you choose and do not use this data for advertising or any unrelated purpose.
• Run AI features you enable (for example drafting or auto-reply) using your configured knowledge and relevant conversation context — never to train public foundation models on your private chats for unrelated purposes.
• Process billing, send service notices, and provide support.
• Enforce acceptable use, investigate abuse, and meet legal obligations.
• Analyze aggregated or de-identified trends to improve the product.

4WhatsApp, Meta, and your customers

Messaging runs on Meta's WhatsApp Business Platform. Meta processes message data according to its own terms and privacy disclosures. You remain responsible for obtaining any consents or legal bases required to message your contacts, and for complying with WhatsApp Business and Commerce policies. End customers who message your business number should be directed to your privacy notice for how your business uses their chats; they may also contact us for platform-level deletion requests as described in our Data Deletion Policy.

5Sharing & processors

We do not sell personal data. We share information only as needed to operate the service, including with:

• Meta / WhatsApp (message delivery and account linking).
• Cloud infrastructure and database providers that host the application.
• AI model providers & services — when you enable AI triage, suggested replies, or auto-reply, prompts containing relevant chat context, business FAQs, and catalogue excerpts are processed via Alibaba Cloud Model Studio / DashScope (Qwen family of models: Qwen-Flash, Qwen-Turbo, Qwen-Plus) and OpenAI (GPT models). Prompts contain only the minimum context needed to generate the response. Customer chat history, private messages, and Google user data are never used to develop, improve, or train generalized foundation or third-party AI models.
• Payment processors for subscriptions and invoices.
• Email / push notification providers for product and security messages.
• Professional advisers or authorities when required by law or to protect rights and safety.

Workspace data is logically isolated by organization. Access for your team is invite-only and role-based.

6Google API Services User Data Policy & Limited Use

Onetali offers an optional Google Sheets integration allowing workspace owners to import contacts into their CRM. We request only the minimum necessary scope (https://www.googleapis.com/auth/spreadsheets.readonly).

Specifically, in compliance with Google's Limited Use requirements:

• Allowed Purpose Only: Google user data accessed via Google Sheets is used strictly to provide and improve user-facing features—specifically, syncing contacts into your Onetali workspace. It is never used for serving advertisements, building consumer profiles, or credit assessment.
• No Transfer or Sale: We do not sell or transfer Google user data to third parties, data brokers, or advertising platforms. Data is transferred only as strictly necessary to execute the contact sync, comply with applicable law, or as part of an approved business transfer with prior notice.
• Strict Prohibition on AI/ML Model Training: Raw or derived user data received from Google Workspace APIs (including Google Sheets) is strictly prohibited from being used to develop, improve, or train generalized artificial intelligence (AI) and/or machine learning (ML) models. We do not transfer Google user data to any AI provider (such as Alibaba Cloud Qwen or OpenAI) for model training purposes.
• No Human Access: No human reads or reviews your Google Sheets data unless we have obtained your affirmative agreement for a specific customer support ticket, it is necessary for security purposes (such as investigating abuse or bugs), or it is required by applicable law.

7Security & retention

We use industry-standard safeguards such as encrypted connections (HTTPS/TLS), access controls, and operational monitoring. No method of transmission or storage is perfectly secure. We retain workspace data while your account is active and as needed to provide the service, resolve disputes, and meet legal or accounting requirements. After deletion requests, production data is removed according to our Data Deletion Policy; encrypted backups may persist for a limited period before purge.

8International transfers

We may process and store data in Kenya and in other countries where our infrastructure or subprocessors operate. Where we transfer personal data internationally, we take steps appropriate to the context (for example contractual protections with providers) so that the data remains protected to a standard consistent with this policy and applicable law.

9Cookies & similar technologies

We use cookies and similar technologies that are necessary for authentication, session security, and remembering preferences. We may also use limited analytics cookies or similar tools to understand product usage. You can control cookies through your browser settings; disabling some cookies may affect sign-in or core features.

10Your rights

Subject to applicable law (including Kenya's Data Protection Act, 2019), you may request access to, correction of, or deletion of personal data we hold about you; object to or restrict certain processing; and withdraw consent where processing is based on consent. Workspace owners can manage most business data in-app. Individual users can update profile details in settings. To exercise rights or raise a privacy complaint, contact us using the details below. We may need to verify your identity before acting on a request.

11Children

Onetali is a business product. It is not directed to children under 18, and we do not knowingly collect personal data from children for the purpose of offering the service to them.

12Changes

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Material changes may also be communicated in-product or by email where appropriate.

Privacy questions

Contact our privacy team

Byte Nuru — Nairobi, Kenya. For privacy-related inquiries or to exercise your rights, email our data protection contact.