Privacy Policy

Ghala is a product of Neurotech Company Limited ("Neurotech," "we," "us," or "our"), a company registered in the United Republic of Tanzania (Registration No. 154911294, TIN 159-911-294), with its principal place of business at Sky City Mall, University Road, Dar es Salaam, Tanzania.

This Privacy Policy explains how we collect, use, share, and protect information when you use Ghala — our WhatsApp-native commerce platform and messaging/developer infrastructure — including our website, WhatsApp-based storefronts, merchant dashboard, and developer APIs (collectively, the "Service").

By using the Service, you agree to the collection and use of information as described in this Policy.

1. Who This Policy Applies To

This Policy covers three types of users:

• Merchants — businesses that create a shop, sell products, or manage customer conversations through Ghala.
• Shoppers / End Customers — individuals who message, browse, or purchase from a merchant's Ghala-powered WhatsApp storefront.
• Developers — individuals or businesses building on Ghala's messaging and commerce infrastructure via our API.

2. Information We Collect

2.1 Information Merchants Provide

• Business details: business name, registration information, physical/delivery address, contact details.
• Identity and compliance information required for payment enablement (e.g. national ID, TIN), collected on our behalf or on behalf of our payment partner, Snippe.
• Catalogue data: product listings, prices, images, descriptions.
• Team member information (names, roles, phone numbers) for staff you add to your Ghala account.

2.2 Information Collected Through WhatsApp Conversations

• Message content exchanged between shoppers and a merchant's Ghala-powered WhatsApp number, including text, images, and order-related messages, to the extent necessary to route conversations, process orders, and power automated/AI-assisted replies.
• WhatsApp identifiers (phone number, WhatsApp profile name) associated with a conversation.
• Order details: items ordered, quantities, delivery instructions, order status.

2.3 Payment Information

Ghala does not store full payment card or mobile money credentials. Payments made through Ghala storefronts are processed by Snippe, our affiliated payments infrastructure, or by other licensed payment partners. We receive and store transaction metadata (amount, status, timestamp, payment method type, order reference) needed to reconcile orders and provide merchant reporting.

2.4 Automatically Collected Information

• Usage data from the Ghala dashboard and website: pages visited, features used, timestamps, device and browser type, IP address.
• API request logs from developers integrating with Ghala's infrastructure (endpoints called, timestamps, response codes) for reliability, rate-limiting, and security purposes.
• Cookies and similar technologies on ghala.io, used for authentication, analytics, and remembering preferences. You can control cookies through your browser settings.

2.5 Information From Third Parties

• Data shared by WhatsApp/Meta as part of the WhatsApp Business Platform integration, subject to Meta's own data practices.
• Verification results from identity or business-verification partners engaged for merchant onboarding and fraud prevention.

3. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including routing WhatsApp messages, processing orders, and generating merchant dashboards/reports.
• Enable and reconcile payments in conjunction with Snippe and other licensed payment partners.
• Power AI-assisted and automated features (e.g. conversational order-taking, auto-replies), where enabled by a merchant.
• Verify merchant identity and business legitimacy, and detect and prevent fraud, abuse, and violations of our Terms of Service.
• Communicate with merchants and developers about their accounts, service updates, and support requests.
• Monitor, debug, and improve platform reliability, security, and performance.
• Comply with applicable legal, regulatory, and law-enforcement obligations, including those arising from our operation within the Bank of Tanzania regulatory framework.

We do not sell shoppers' personal information to third parties.

4. How We Share Information

We share information only as needed to operate the Service:

• With merchants: A shopper's messages, order details, and WhatsApp contact information are shared with the merchant they are messaging, since that conversation is the basis of the commercial relationship.
• With payment partners: Transaction data is shared with Snippe and other licensed payment processors to complete and reconcile payments.
• With service providers: Cloud hosting, messaging infrastructure (including Meta's WhatsApp Business Platform), analytics, and customer-support tooling providers who process data on our behalf under confidentiality and data-processing obligations.
• For legal reasons: Where required to comply with a legal obligation, regulatory request, or to protect the rights, property, or safety of Neurotech, our users, or the public.
• In a business transfer: If Neurotech is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this Policy or a comparable one.

We do not share shopper conversation content with developers building on our infrastructure beyond what is strictly necessary to operate the specific integration a merchant has authorized.

5. Data Retention

We retain personal information for as long as necessary to provide the Service, comply with legal and regulatory obligations (including financial record-keeping requirements applicable to payment-related data), resolve disputes, and enforce our agreements. Merchants may request deletion of their account data subject to these retention obligations; see Section 7.

6. Data Security

We apply technical and organizational measures — including encryption in transit, access controls, and monitoring — to protect information against unauthorized access, alteration, disclosure, or destruction. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your relationship to Ghala and applicable law (including Tanzania's Personal Data Protection Act, 2022), you may have rights to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to legal and regulatory retention requirements.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent (e.g. opting out of promotional messages from a merchant, subject to that merchant's own communication settings).

To exercise these rights, contact us at privacy@ghala.io. Shoppers wishing to stop receiving messages from a specific merchant should contact that merchant directly or block the number on WhatsApp.

8. International Data Transfers

Ghala's infrastructure may involve data processing outside Tanzania (for example, cloud hosting or WhatsApp Business Platform infrastructure operated by Meta). Where this occurs, we take steps to ensure an adequate level of protection consistent with applicable data protection law.

9. Children's Privacy

Ghala is intended for use by businesses and adult shoppers. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Ghala dashboard or by email to registered merchants. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

11. Contact Us

Neurotech Company Limited Sky City Mall, University Road, Dar es Salaam, Tanzania Email: privacy@ghala.io

For questions about this Privacy Policy or to exercise your data rights, contact us using the details above.