Privacy policy

1. Who we are

HAFSAGE LIMITED is a private limited company registered in Kenya. Our registered office is at Cardinal Otunga Plaza 5th Floor, Kaunda Street, Nairobi, Kenya. You can reach us at privacy@hafsage.com or +254 701 838 802.

2. Our role: data controller and data processor

Under the Act, our role depends on whose data it is and why we process it:

• We are the data controller for personal data about our customers and website visitors, such as account details, billing information, support requests and website usage.
• We are the data processor for personal data that our business customers put into the Service or receive through it, such as their contacts, WhatsApp conversations and sales records (“Customer Data”). The business using the Service is the data controller of that data and decides why and how it is processed. We process Customer Data only on the customer’s documented instructions and to provide the Service.

If you messaged a business that uses Hafsage CRM and want to know how it uses your data, please contact that business first. We will help them respond to your request.

3. Personal data we collect

3.1 Data you give us

• Account details: name, business name, email address, phone number and password.
• Team member details that account owners add when inviting their staff.
• Billing details: business name, KRA PIN where provided, payment records and M-Pesa or bank references.
• Messages you send us, including demo requests and support conversations.

3.2 Data processed through the Service (Customer Data)

• Contacts: names, phone numbers, tags, notes and custom fields.
• WhatsApp conversations: message content, media, timestamps and delivery and read status.
• Sales records: pipeline stages, tasks, reminders and deal values.
• Lead source data that Meta provides when a person contacts a business from a Click-to-WhatsApp ad, such as the ad or campaign reference.

3.3 Data we collect automatically

• Technical data: IP address, browser and device type, and log data about how the Service is used.
• Essential cookies needed to keep you signed in and secure your session.

3.4 Data we receive from Meta

When a business connects a WhatsApp Business Account to the Service, we receive from Meta the account and phone number identifiers, access tokens, message templates, incoming messages and message status updates needed to send and receive messages on the business’s behalf.

4. How we use personal data and our lawful basis

5. WhatsApp and Meta data

For data we receive through the WhatsApp Business Platform and other Meta products, we commit that:

• We use it only to provide the Service to the business that connected its account.
• We do not sell it, rent it or share it with data brokers or advertisers.
• We do not use it to build profiles of individuals for advertising.
• We do not use Customer Data to train general-purpose artificial intelligence models.
• We store WhatsApp access tokens encrypted and delete them when the business disconnects its account or closes it with us.
• We comply with Meta’s Platform Terms, the WhatsApp Business Terms of Service and the WhatsApp Business Messaging Policy.

Messages are delivered through Meta’s infrastructure, and Meta processes them under its own terms and privacy policy. Businesses using the Service are responsible for getting customers’ opt-in before sending them messages, as WhatsApp’s policies and section 37 of the Act require for direct marketing.

6. Optional AI features

If a business turns on the AI reply assistant, it connects its own account with an AI provider (such as OpenAI or Anthropic). The content of relevant conversations and the business’s knowledge base is then sent to that provider to generate suggested replies. The business chooses whether to use this feature and which provider to use. We do not turn it on by default.

7. Who we share personal data with

We share personal data only as needed to run the Service, with:

• Service providers (sub-processors) who host and run the Service for us, under written contracts that require them to protect the data. These include our database and authentication provider (Supabase), our application hosting provider, our email provider and Meta for WhatsApp message delivery. We can provide an up-to-date list on request.
• Payment providers, such as Safaricom (M-Pesa) and banks, to process subscription payments.
• AI providers chosen by a business, only if that business turns on AI features.
• Authorities, where the law requires us to, such as in response to a valid court order.
• A buyer or successor, if our business is sold or merged, under the same protections as this policy.

We do not sell personal data.

8. Transfers outside Kenya

Some of our service providers store or process data outside Kenya, for example in the European Union or the United States. When we transfer personal data outside Kenya, we do so only as the Act allows: where the recipient country or provider gives appropriate safeguards for the security and protection of the data, under contracts that require such safeguards, or with consent where required.

9. How long we keep personal data

• Account data: for as long as the account is open.
• Customer Data: until the business deletes it or closes its account. After an account is closed, we delete Customer Data within 90 days, unless the business asks us to delete it sooner.
• Backups: overwritten on a rolling basis, within 30 days of deletion from the live system.
• Billing and tax records: for the period that Kenyan tax and accounting laws require.
• Technical logs: up to 90 days, unless needed to investigate a security incident.

10. How we protect personal data

• Data is encrypted in transit using TLS (HTTPS).
• WhatsApp access tokens are encrypted at rest.
• Each business’s data is kept separate from other businesses’ data in our database.
• Access within a business is controlled by roles (owner, admin, agent and viewer).
• Our staff access personal data only when needed to provide or support the Service.

If a personal data breach occurs, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it where the Act requires, and we will inform affected customers without undue delay. Where we act as a data processor, we will notify the affected business within 48 hours so it can meet its own obligations.

11. Your rights

Under the Act, you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• object to the processing of all or part of your personal data;
• have false or misleading data corrected;
• have false, misleading or unlawfully processed data deleted;
• receive your data in a portable format;
• not be subject to decisions based solely on automated processing that significantly affect you; and
• withdraw consent at any time, where we rely on consent.

To use these rights, email privacy@hafsage.com. We may ask you to confirm your identity. We will respond within the time limits set by the Act and the Data Protection (General) Regulations, 2021. If your request concerns data a business holds about you through the Service, we will pass it to that business and help it respond. You can also follow our data deletion instructions.

12. Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.

13. Cookies

We use only essential cookies needed to run the website and keep you signed in. If we add analytics or advertising cookies in future, we will update this policy and ask for your consent where required.

14. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya at www.odpc.go.ke.

15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “last updated” date and, for significant changes, notify account owners by email.

16. Contact us

HAFSAGE LIMITED
Cardinal Otunga Plaza 5th Floor, Kaunda Street, Nairobi, Kenya
Email: privacy@hafsage.com
Phone: +254 701 838 802