SalesBuddy

Privacy Policy

Last updated: 15 August 2026

Drafting notice: this policy was drafted to accurately describe SalesBuddy's real data flows as a genuine starting point, not final legal language. It has not been reviewed by a lawyer qualified in Nigerian, Ghanaian, or Kenyan data protection law and should be reviewed before being relied on for regulatory compliance (NDPA, Ghana Data Protection Act 2012, Kenya Data Protection Act 2019) or before being used with real customer data at scale.

SalesBuddy ("SalesBuddy", "we", "us") provides a multi-tenant SaaS platform that lets businesses run an AI sales agent over WhatsApp. This policy explains what data we collect, how it moves through the platform, who we share it with, and what rights you have — both for the businesses ("tenants") that use SalesBuddy, and for the end customers who message a tenant's WhatsApp number and interact with the AI agent.

1. Information we collect

1.1 From tenants (the businesses using SalesBuddy)

Account information: name, email address, and password (or Google account identifier, if you sign up with Google).
Business profile information you provide: business name, website, social media handles, payment instructions shown to your customers, and your configured AI behavior/knowledge base content.
Staff accounts you create under your tenant, and their role assignments.
Subscription and billing information, processed by our payment processor (see Section 3) — SalesBuddy does not store your card details directly.

1.2 From end customers (people who message a tenant on WhatsApp)

When someone messages a SalesBuddy tenant's WhatsApp number, we process:

Their WhatsApp phone number and display name.
The content of their messages — text, voice notes (transcribed), and images they send — for as long as needed to carry on the conversation.
Order-related details they provide: delivery address, product/service selections, and (for cash-on-delivery orders) nothing related to payment card or bank details, since SalesBuddy never handles that payment directly — see Section 5.

This data is provided by the end customer to the tenant business, via WhatsApp, in the ordinary course of the tenant using SalesBuddy to run its sales conversations. SalesBuddy processes it on the tenant's behalf, as a data processor, not as the party the end customer has a direct relationship with — the tenant business is responsible for its own customers' consent and data rights under its own privacy policy.

1.3 Technical and usage data

Standard technical data (IP address, request timestamps, error logs) generated by normal operation of the platform, retained for security/audit purposes as described in Section 4.

2. How we use this information

To operate the AI sales agent: answering questions, qualifying leads, generating and relaying orders, and coordinating delivery/logistics tracking.
To provide the tenant dashboard: order visibility, escalation handling, staff management, analytics.
To send transactional communications: password resets, welcome emails, and delivery-status alerts.
To secure the platform: audit logging of account and data-mutating actions, fraud/abuse prevention.
To bill tenants for their SalesBuddy subscription.

SalesBuddy does not sell tenant or end-customer data, and does not use end-customer conversation content to train shared/foundation models beyond the ordinary operation of the third-party AI providers described below (see Section 3 for each provider's own data-use terms).

3. Who we share data with

SalesBuddy is built on a set of third-party infrastructure and AI providers that necessarily process data as part of running the platform. Each is used strictly to provide the service, not for their own independent marketing purposes:

WhatsApp messaging — either a self-hosted Evolution API instance, or, where a tenant chooses it, the official Meta WhatsApp Business Cloud API.
AI language models — DeepSeek and Google Gemini, used to generate qualification replies and extract structured order information from conversations.
Voice — a text-to-speech provider (currently ElevenLabs) for voice-note replies, and a speech-to-text provider to transcribe voice notes customers send.
Vector search / retrieval — Qdrant (self-hosted), storing embeddings of tenant knowledge-base and product content to power semantic search — not raw conversation transcripts.
Transactional email — Resend, for password-reset and welcome emails.
Subscription billing — Flutterwave, for the tenant's own SalesBuddy subscription payment only.
Hosting infrastructure — our VPS/hosting provider, which stores the underlying database and application servers.

We do not sell or rent personal data to third parties for their own marketing.

4. Data retention

Conversation memory used to keep the AI agent's context is retained for a limited rolling window and then expires automatically.
Order/transaction and delivery-tracking records are retained for as long as the tenant account is active, to support order history and analytics.
Audit logs (who did what, when) are retained indefinitely for security and dispute-resolution purposes.
Delivery short codes are archived (no longer usable) 30 days after a delivery closes.
If a tenant closes their account, we will delete or anonymize their data within a reasonable period, except where retention is required by law.

5. Payments

For cash-on-delivery orders — the default for most SalesBuddy tenants — the delivery company collects payment directly from the end customer and remits it to the tenant; SalesBuddy never touches, stores, or has access to that payment. For prepaid orders, the AI agent shares the tenant's own payment details or redirects to the tenant's own payment page — again, SalesBuddy is not a party to that payment. SalesBuddy's own billing relationship is solely with the tenant, for their platform subscription, via Flutterwave.

6. Data security

Each tenant's data is isolated at the database level using PostgreSQL Row-Level Security, enforced on every query — not just an application-layer check. Data is transmitted over encrypted connections. Access to staff accounts is role-gated, and sensitive account actions are audit-logged.

7. Your rights

Depending on where you're located, you may have rights to access, correct, or request deletion of your personal data. Tenants can manage most of their own account and business data directly from the dashboard. To request deletion of your data, or if you're an end customer who wants to reach the tenant business you messaged, contact us at [privacy@salesbuddy.example — placeholder, update once a real support address exists]. If your data reached SalesBuddy via a Meta (Facebook/Instagram/WhatsApp) login or integration, see our data deletion request process.

8. Children's privacy

SalesBuddy is a business tool and is not directed at children. We do not knowingly collect personal data from children.

9. International data transfers

SalesBuddy operates across Nigeria, Ghana, and Kenya, and uses infrastructure and AI providers that may process data outside the country where you're located. Where this happens, we rely on the provider's own safeguards and contractual commitments.

10. Changes to this policy

We may update this policy as the platform evolves. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Questions about this policy: [contact email — placeholder].