Privacy Policy

KarooChat ("we", "us", "our") is a WhatsApp Business API platform operated by Jarryd Long, a South African business. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our platform or when your business uses our service to communicate with your customers via WhatsApp.

This policy is governed by the Protection of Personal Information Act, 2013 (POPIA) and aligns with Meta's data handling requirements for WhatsApp Business API partners.

1. Information We Collect

Platform Clients (Businesses)

• Business name, contact person name, and email address
• WhatsApp Business Account (WABA) credentials provided by you
• Billing and account information

End Users (Your Customers)

When your business uses KarooChat to communicate with customers via WhatsApp, we process:

• WhatsApp phone numbers
• Names provided by your customers in conversation
• Message content (text, media, templates) sent or received through the platform
• Delivery and read receipt status
• Opt-out preferences

We process this data as a data processor on your behalf. As the business using KarooChat, you are the data responsible party under POPIA and are responsible for having a lawful basis to message your customers.

2. How We Use Information

• To deliver messages between your business and your customers via the WhatsApp Cloud API
• To power automated bot flows and conversation routing
• To provide your team with a live chat interface
• To maintain message history and delivery logs
• To enforce opt-out requests (a customer who opts out will not receive further messages)
• To improve and maintain the platform

3. WhatsApp and Meta

KarooChat uses the WhatsApp Cloud API, operated by Meta Platforms, Inc. Messages sent through our platform are routed via Meta's infrastructure. Meta's own privacy policy and terms apply to the transmission of messages. We do not share your data with Meta beyond what is required to deliver messages.

For more information, see Meta's WhatsApp Privacy Policy and the Meta Platform Terms.

4. Data Storage and Security

Data is stored on servers in South Africa or within the European Economic Area. We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Hashed passwords — we never store plaintext credentials
• HMAC signature verification on all incoming Meta webhooks
• Session tokens are hashed and bound to IP address and user agent

5. Data Retention

Message history and conversation data is retained for as long as your account is active. When an account is terminated, data is deleted within 30 days unless a longer retention period is required by law.

6. Opt-Out

End users can opt out of WhatsApp messages from a business at any time by replying STOP or requesting removal. KarooChat automatically records and enforces opt-out preferences — once opted out, no further messages will be sent to that number through any business using our platform.

7. Sharing of Information

We do not sell personal information. We may share data only:

• With Meta/WhatsApp to deliver messages (as described above)
• With service providers who assist us in operating the platform, under confidentiality obligations
• If required by South African law or a valid court order

8. Your Rights (POPIA)

Under POPIA, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information (subject to legal retention requirements)
• Object to the processing of your information
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us via our website.

9. Cookies

Our marketing website uses no tracking cookies. The application uses a single, strictly necessary session cookie for authentication. No third-party analytics or advertising cookies are used.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related queries or to exercise your rights, get in touch via our website.