Skip to content
PaalChat
Create account

Legal

Data Processing Terms

Draft - this document is being reviewed and may change before PaalChat opens to the public.

These terms apply when [PaalTech registered company name] ("PaalTech") processes personal data on behalf of a business that uses PaalChat ("the business"). They form part of our Terms of Service and apply from [date].

Roles

The business is the controller of its customer data (contacts, messages, conversations, consent records). PaalTech is the processor and acts only on the business's instructions - given through PaalChat's settings, dashboard and API.

What we do and do not do

  • We process customer data only to provide PaalChat to the business: sending and receiving messages, storing conversations, running the features the business turns on (such as the AI assistant), security, and support.
  • We do not use customer data for our own purposes, sell it, or use it to train AI models.
  • People at PaalTech who can reach customer data are bound to confidentiality; operators see counts and statuses, not message text.

Security

We keep appropriate technical and organisational measures: encryption in transit and of message content, tokens and secrets at rest; role-based access; two-step sign-in; audit logs; and monitoring.

Sub-processors

We use these sub-processors for customer data: Meta (WhatsApp), OpenAI (only when the business turns the assistant on), Arkesel and Hubtel (SMS), Resend (email), and our hosting and storage providers. We will give notice before adding one, and the business may object.

Assistance

We help the business answer requests from the people it messages (access, correction, deletion) with exports and erasure through PaalChat's API, or on request, and help with security incidents and data protection questions.

Breaches

We tell the business without undue delay after becoming aware of a breach affecting its customer data, with what we know and what we are doing.

Retention and deletion

Message text is kept for the period the business sets (one year by default). When the business closes its account, we delete its customer data within 30 days, except where the law requires us to keep something.

Contact

privacy@paaltech.org - [PaalTech registered company name], [registered address], Ghana.