Privacy Policy

1. Who we are

ChatThru ("we", "us", "the platform") provides a service that lets businesses deploy automated conversations on messaging platforms — currently WhatsApp, with Facebook, Instagram, Telegram and TikTok planned. This policy explains what we do with personal information in the course of providing it.

For the purposes of South Africa's Protection of Personal Information Act, 2013 (POPIA) and, where it applies, the EU General Data Protection Regulation (GDPR), the responsible party / controller is the business whose number you messaged. We act as their operator / processor. For information about our own website visitors and account holders, we are the responsible party.

2. Our two roles

This distinction matters, and most policies bury it:

If you are…	We are…	Who to contact
A customer messaging a business that uses ChatThru	A processor on that business's instructions	The business you messaged. They decide what happens to your conversation. We will help them answer you.
An account holder, agency or team member using our console	The responsible party	Us, using the details in section 12.
Just visiting this website	The responsible party	Us. We keep this site deliberately free of tracking.

3. What we collect

3.1 When you message a business through ChatThru

• Your platform identifier — for WhatsApp, your phone number; for other platforms, the account identifier that platform gives to businesses.
• The content of your messages — text, and any buttons or list options you tap. This is stored so the business can read the conversation and so the automation knows where you are in a flow.
• Delivery metadata — when a message was sent, delivered and read, as reported by the messaging platform.
• Anything you choose to send us — for example an order number, a delivery address, or a support description, if the conversation asks for it.

3.2 When you use our console

• Your name, email address and profile picture, as provided by your identity provider when you sign in.
• A record of privileged actions you take (publishing a bot, changing a role), for audit purposes.
• Technical logs: request times, error codes, IP address.

3.3 What we deliberately do not do

• We do not use advertising or analytics trackers on this website.
• We do not sell, rent or trade personal information.
• We do not read customers' conversations for our own purposes. Access is limited to operating the service and investigating a fault you report.

4. Why we process it

Purpose	Lawful basis (POPIA / GDPR)
Delivering your message to the business and returning their reply	Performing the service you asked for (contract / legitimate interest of the business)
Keeping a conversation history the business can read	Same as above, plus the business's record-keeping obligations
Running automated flows (menus, order status, payment links)	Same as above
Security, abuse prevention and debugging	Legitimate interest
Meeting legal, tax and accounting obligations	Legal obligation

We do not make automated decisions that produce legal effects about you. A bot decides which menu to show; it does not decide whether you get a refund, a loan or a job.

5. Who we share it with

Only what is necessary, and only to these categories of recipients:

• The business you contacted, and the people it has authorised to read its inbox — including any agency it has hired to run the automation for it.
• The messaging platform (for example Meta, as operator of WhatsApp). Messages necessarily pass through their systems, subject to their own privacy terms.
• Infrastructure providers who host the service and send email on our behalf, under written processor terms.
• Authorities, where we are legally compelled, and only to the extent required.

6. Where it lives and for how long

• Location. Data is stored in data centres in the European Union and/or South Africa. Where information moves across borders, we rely on the transfer safeguards required by POPIA section 72 and, where applicable, GDPR Chapter V.
• Retention. Conversation records are kept for as long as the business maintains its workspace, because they are the business's records — not ours. A business can delete a conversation, and can ask us to purge a workspace entirely.
• Deletion. When a workspace is deleted, its conversations, contacts and channel credentials are removed. Backups roll off on a defined schedule, after which the data is gone from those copies too.
• Credentials. Channel access tokens are encrypted at rest with a key held outside the database, and are redacted in every API response.

7. Cookies and sessions

This website sets no cookies. The ChatThru console uses a single session cookie so you stay signed in after authenticating with your identity provider. It is HttpOnly, SameSite=Lax, marked Secure outside local development, and expires after 14 days or when you sign out. There is no advertising or cross-site cookie anywhere in the product.

8. Your rights

Subject to applicable law, you may ask to:

• be told what personal information we hold about you, and receive a copy;
• have incorrect information corrected;
• have your information deleted;
• object to processing based on legitimate interest;
• withdraw consent, where processing was based on consent;
• receive your data in a portable format.

If your request concerns a conversation with a business, we will forward it to that business and support them in answering. We may need to verify your identity — normally by you messaging us from the same account — before acting.

You also have the right to complain to a regulator: in South Africa, the Information Regulator (inforegulator.org.za); in the EU, your national supervisory authority.

9. How we protect it

• Encryption in transit (TLS) for every connection.
• Channel credentials encrypted at rest with an application-held key.
• Webhook payloads verified by HMAC signature, failing closed on mismatch.
• Role-based access, tenant isolation, and an audit log for privileged actions.
• Rate limiting and request-size caps on the API.

No system is perfect. If a breach affecting personal information occurs, we will notify the affected businesses and the Information Regulator as required by section 22 of POPIA.

10. Children

The platform is not directed at children. We do not knowingly collect information from a child without the consent required by law. If you believe a child has sent us personal information, contact us and we will delete it.

11. Changes to this policy

When this policy changes we update the version and date at the top. Material changes will be announced to account holders by email or in the console before they take effect.

12. Contact us

For any privacy question, request or complaint:

• Email: privacy@chatthru.example.com
• Information Officer: listed in our PAIA manual, available on request.
• Response time: we aim to acknowledge within 5 business days and resolve within 30 days.

If you are messaging a business and want your conversation deleted, the fastest route is to ask that business directly — they control the record. We will act on their instruction.