Privacy Notice.

heyjane.io is the organisation responsible for the personal data described in this notice.

Our service lets a business (a “Venue”) connect its own WhatsApp number to an AI agent that replies to the Venue's customers, takes orders, and escalates conversations to the Venue as needed. Depending on how you interact with us, we may collect:

• account and workspace data — name, email address, business information, and role, for the person and organisation signing up;
• authentication data needed to sign you in and manage sessions, handled through our authentication provider;
• WhatsApp message content exchanged between a Venue's connected number and its customers, so our agent can read and respond to conversations;
• a Venue's customers' WhatsApp phone numbers and profile display names, to the extent needed to route messages and fulfil orders;
• order details placed through a WhatsApp conversation — items, quantities, and prices;
• billing and subscription information, processed through our payment provider; we do not see or store full payment card or bank account details;
• IP address, device, and usage information, and any information you choose to provide when you contact us.

We may collect, use, or disclose personal data for purposes including:

• providing, operating, and maintaining the service;
• operating the WhatsApp-based agent, including reading, routing, and replying to messages, taking orders, and escalating conversations to a Venue when needed;
• verifying identity, managing accounts, and enforcing permissions;
• processing payments and administering subscriptions;
• responding to enquiries, requests, complaints, or support tickets;
• monitoring, analysing, and improving the service;
• complying with applicable laws, regulations, court orders, or requests from competent authorities;
• transmitting personal data to third-party service providers, agents, and authorities, wherever located, for any of the above purposes;
• any other purpose to which you have consented.

The above purposes may continue to apply for a reasonable period after your relationship with us ends, including any period needed to enforce our rights.

We process personal data because you asked us to provide the service: you give it to us when you sign up or use the service, and we use it to deliver what you signed up for and to meet our obligations to you. We also process a limited amount of data where it is necessary to keep the service safe and working — fraud detection and prevention, preventing misuse, security analysis, debugging, and protecting our rights, property, or the safety of others.

We do not process personal data for purposes unrelated to running the service, and we do not sell it.

You may withdraw your agreement to non-essential processing by writing to us at the email in the Contact section below. Withdrawal may mean we can no longer provide some or all of the service to you, and does not affect processing already carried out before withdrawal, or processing we are required or permitted to carry out under applicable law.

We may share personal data with third-party service providers and agents that help us operate the service, in categories including:

• cloud database and hosting providers, who store the service's data;
• an authentication provider, who manages sign-in and sessions;
• a payment provider, who processes subscription billing;
• an email delivery provider, who sends transactional email on our behalf;
• AI / large-language-model inference providers, who process message content so our agent can generate replies, and so we can suggest knowledge-base entries for a Venue to review;
• product analytics providers, in aggregate or pseudonymised form.

We may also disclose personal data where required or permitted by law, in response to lawful requests from authorities, to enforce our terms, or to protect our rights, property, or the safety of any person.

We do not sell personal data, and we do not share it with advertisers.

If you are a Venue using the service to communicate with your own customers over WhatsApp, a separate relationship applies to your customers' personal data (their WhatsApp message content, phone numbers, profile names, and order details). In that relationship, the Venue is the party that decides why and how that data is processed, and we act only as a data intermediary, processing it solely on the Venue's instructions and only to provide the service — reading, routing, and replying to messages, taking orders, and escalating conversations to the Venue.

We do not use a Venue's customers' personal data for our own independent purposes, and we apply the same security measures described in this notice, plus tenant-level data isolation between Venues. A Venue is responsible for its own compliance with applicable law toward its customers, including any consents needed to message them over WhatsApp through the service. The contractual terms governing this relationship, including our obligations as a data intermediary, are set out in the “Data processing for your customers” section of our Terms of Service.

Some of the service providers we use (for example, cloud database hosting, authentication, payments, or AI/LLM infrastructure) may store or process personal data in a country other than your own. Where this happens, we take reasonable steps to ensure the recipient is bound by terms providing a comparable standard of protection to the one described in this notice.

We retain personal data for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable laws (including tax, accounting, and other record-keeping obligations). This includes WhatsApp message content and conversation history, which we retain for as long as needed to provide the service to you and your customers, unless you request earlier deletion. When personal data is no longer required, we will take reasonable steps to delete it or remove the means by which it can be associated with you.

We have implemented appropriate administrative, technical, and organisational measures to safeguard personal data in our possession or under our control. No system can be guaranteed completely secure, and we make no warranty regarding security.

We rely on the personal data you provide. Please keep your account information current and notify us in writing if any personal data we hold about you needs to be updated or corrected.

You may request access to, correction of, or deletion of the personal data we hold about you by writing to us at the email below (see also our Data Deletion page). We may charge a reasonable fee for an access request and will tell you the fee before processing it. We will respond as soon as reasonably possible. If we cannot respond within 30 days of receiving your request, we will inform you in writing of the time by which we will respond. Where we are required or permitted by law to decline a request, we will inform you of the reason.

The service is intended for use by individuals aged 18 years or older. By using the service you represent that you are at least 18 years old. We do not knowingly collect personal data from anyone under 18 without verified parental or guardian consent.

We may revise this notice at any time without prior notice. Revised versions take effect on the date posted, indicated by the “Last updated” date at the top of this page. Your continued use of the service constitutes your acknowledgement and acceptance of the revised notice.

Enquiries about this notice, or requests to access, correct, or delete your personal data, should be made in writing to privacy@heyjane.io.

heyjane.io