Legal

Privacy Policy

Last updated: July 2026

1. Introduction

DwaBot ("we", "our", or "us") operates a WhatsApp AI sales assistant platform for businesses in Ghana and across Africa. This Privacy Policy explains how we collect, use, and protect information when you use our service at any DwaBot-powered domain or API endpoint.

By using DwaBot, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

From merchants (business owners and staff)

  • Account information: name, business name, email address, phone number, business address.
  • Payment credentials: Eganow API keys and WhatsApp Cloud API tokens — stored encrypted with AES-256-GCM in our database, never in plaintext.
  • Business data: product catalogue, orders, customer records, and conversation history created through your account.

From end-customers (via WhatsApp)

  • WhatsApp profile data: phone number and display name provided by the Meta Cloud API when a customer messages a DwaBot-powered WhatsApp number.
  • Conversation data: messages sent and received through the WhatsApp interface, stored to power AI responses and order tracking.
  • Order data: items selected, delivery details, and payment status as part of an order flow.

Automatically collected

  • Server logs including IP addresses, request paths, and timestamps — retained for 30 days for security monitoring.
  • Queue job metadata (job IDs, retry counts) for reliable AI message processing.

3. How We Use Your Information

  • To provide and operate the DwaBot service — routing messages, generating AI responses, processing payments via Eganow MoMo.
  • To send order and payment notifications to merchants via the dashboard and WhatsApp.
  • To maintain an audit trail for sensitive operations (payment reconciliation, staff management) as required for security and accountability.
  • To detect and prevent fraud, abuse, or policy violations.
  • To improve the service, including AI model performance based on anonymised usage patterns.

We do not sell your personal data to third parties. We do not use your business's customer data to train general-purpose AI models without explicit consent.

4. Data Sharing

We share data only with the following parties and only to the extent necessary to operate the service:

  • Meta (Facebook): WhatsApp messages are routed through the Meta Cloud API. Meta's own privacy policy governs their handling of message metadata.
  • Eganow: Payment initiation requires transmitting the customer's MoMo number and amount to Eganow's API. Eganow's privacy policy governs their handling.
  • OpenAI / Anthropic: Customer conversation messages are sent to the AI provider selected by your account for generating responses. These providers process data under their own privacy policies and data processing agreements.
  • Infrastructure providers: Our hosting providers (VPS, object storage) store encrypted data under standard cloud data processing agreements.

5. Data Retention

  • Merchant account data is retained as long as the account is active. On account deletion, data is purged within 30 days except where retention is required by law.
  • Conversation and order data is retained for 24 months to support dispute resolution and audit requirements.
  • Audit logs for payment events are retained for 7 years in compliance with Ghanaian financial record-keeping requirements.
  • Server logs are retained for 30 days.

6. Security

We take the following measures to protect your data:

  • All data in transit is encrypted via TLS 1.2+.
  • WhatsApp access tokens and Eganow credentials are stored encrypted with AES-256-GCM. The encryption key is never stored in the database.
  • Passwords are hashed with Argon2id, an industry-standard memory-hard function.
  • Payment status can only be set to SUCCESS by the Eganow webhook handler (after independent re-verification) or a super-admin with full audit logging — never by AI processing.
  • All production infrastructure is isolated behind a firewall; database and Redis ports are not exposed to the public internet.

No system is perfectly secure. If you discover a security vulnerability, please contact us at the address below.

7. Your Rights

If you are a merchant or an end-customer whose data is held in a DwaBot merchant account, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your data, subject to legal retention requirements.
  • Restrict or object to processing in certain circumstances.
  • Portability — receive a copy of your data in a machine-readable format.

To exercise these rights, contact us at the email address below. We will respond within 30 days.

8. Cookies

The DwaBot merchant dashboard uses a single session cookie (dwabot_token) to maintain your logged-in state. We do not use third-party tracking cookies or analytics cookies.

9. Children's Privacy

DwaBot is a business-to-business service. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.

10. Requests from Public Authorities

DwaBot reviews requests from law-enforcement agencies, regulators, courts, and other public authorities for personal data to determine whether each request is valid, lawful, properly authorised, and within the requesting authority's jurisdiction.

Where appropriate, DwaBot may seek legal advice or challenge requests that appear unlawful, excessive, unclear, or insufficiently supported.

When disclosure is legally required, DwaBot will provide only the minimum personal data necessary to comply with the valid request. We will document the request, the legal basis relied upon, the review and decision made, the persons involved, and any information disclosed.

Where legally permitted, DwaBot may notify the affected merchant or user before disclosing their information. DwaBot IT Solutions will not voluntarily disclose personal data to public authorities unless required by applicable law or necessary to protect the rights, safety, and security of users, the public, or the DwaBot platform.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify active merchants via the dashboard or email at least 14 days before the change takes effect.

12. Contact

Questions about this Privacy Policy or requests to exercise your rights:

DwaBot
Accra, Ghana
info@dwabotai.com