Privacy policy

1. Two distinct roles

TEERAL processes personal data in two roles that should be distinguished:

• As a data controller, for the data of our business customers and their agents (account creation, billing, support) and for operating the platform.
• As a data processor, for the data our customers process through the platform about their own contacts (numbers, messages, conversation information). The customer remains the controller of this data; TEERAL processes it solely on their instructions.

2. Data we collect

Phone numbers are masked in our technical logs and no access token appears in them.

• Account data: name, email address, password (hashed), role, associated business.
• WhatsApp connection data: WhatsApp Business Account (WABA) identifiers, connected business number, quality indicators and messaging tiers provided by Meta.
• Conversation data (on behalf of the customer): contact numbers, message content, timestamps, delivery statuses, consents (opt-in/opt-out).
• Technical data: access logs, IP address, usage data needed for security and proper operation of the service.

3. Purposes and legal bases

• Provide and secure the service (performance of the contract).
• Route WhatsApp messages between our customers and their contacts (performance of the contract).
• Comply with the obligations imposed by Meta and by law (legal obligation and legitimate interest).
• Bill, prevent fraud and improve the service (legitimate interest).
• Send transactional communications (performance of the contract) and, where applicable, marketing with your consent.

4. Processors and recipients

To provide the service, we rely on processors that process data on our behalf under contractual confidentiality and security commitments:

• Meta Platforms Ireland Ltd. — WhatsApp Business API (Cloud API): message routing, statuses, WhatsApp Business account management.
• Resend — sending transactional emails (account verification, password reset).
• Hostinger — hosting the platform's servers and database.
• Mistral AI (France) — classifying incoming messages and drafting suggested replies, only when the customer has enabled the AI Agent. Phone numbers are stripped from the content before transmission, and no suggestion is sent without human validation.
• Google Ireland Ltd. — audience measurement on the marketing site (Google Analytics) and advertising campaign measurement, only after your consent. No Google tool is loaded inside the application once you are signed in.

5. Transfers outside Senegal

Some processors (notably Meta, Resend and Mistral AI) process data outside Senegal. These transfers are covered by appropriate safeguards (contractual commitments, security measures) in accordance with applicable regulations.

6. Retention period

Data is kept for as long as necessary for the purposes described, then deleted or anonymised. Conversation data processed on behalf of a customer is kept according to that customer's instructions and deleted at the end of the contractual relationship, subject to legal retention obligations.

7. Security

We implement appropriate technical and organisational measures: encryption of exchanges, per-customer data isolation (strict separation by tenant identifier), access control, masking of numbers in logs, and protection of access tokens that never leave our servers.

8. Your rights

You have the right to access, rectify, erase, object to and restrict the processing of your data. To exercise them, contact us at [email protected]. Anyone can unsubscribe from a customer's messages at any time by replying "STOP" on WhatsApp; the objection is then final.

9. WhatsApp and Meta compliance

Use of WhatsApp is subject to Meta's policies (WhatsApp Business Messaging Policy and Business Terms). Our customers undertake to contact only people who have given prior consent (opt-in) and to honour unsubscribe requests (opt-out). TEERAL enforces these rules strictly to protect the reputation and availability of numbers.

10. Cookies and analytics

Cookies strictly necessary for the service to operate (authentication, security, language preference) are set without prior consent: the service cannot work without them.

On the marketing site only, and only if you accept, we use Google Analytics to measure traffic and the effectiveness of our advertising campaigns. No Google script is loaded until you have accepted. You can change your mind at any time through the "Cookies" link in the footer.

Inside the application, once signed in, we measure usage with Plausible, hosted on our own infrastructure. Plausible sets no cookies and builds no visitor identifier. Page addresses sent to it are reduced to their route pattern: we send "/inbox", never the identifier of the open conversation.

No end-customer data, no phone number and no message content is sent to any analytics tool.

11. Changes

We may update this policy. The last-updated date appears at the top of the document; significant changes will be notified to you.

12. Contact and complaints

For any question or request about your data, write to us at [email protected]. You may also refer the matter to Senegal's Personal Data Protection Commission (CDP).