Hudara — Privacy Policy
Data controller (for account/billing data) and processor (for customer data you connect): websquids LLC, Cairo, Egypt.
1. Scope
This policy covers two kinds of data:
- Your account data — you and your team's login, billing, and usage data. Hudara is the controller of this data.
- Your customers' data — WhatsApp conversation content, contact records, order data synced from WooCommerce, and similar data you (the business) collect about your customers. Hudara is a processor of this data, acting on your instructions as the business that owns the customer relationship.
2. What we collect
Account data: name, email, phone, password (hashed), billing details, usage logs. Server and error logs are kept for up to 30 days.
Customer data you connect or generate through the Service:
- WhatsApp conversation content (messages, media, voice notes) sent and received through your connected number.
- Contact details: name, phone number, tags, lifecycle stage, custom fields, opt-in/opt-out status.
- Commerce data synced from WooCommerce: orders, order status, spend, cart events — including data needed to compute VIP tiers, RFM scores, and COD-risk flags.
- CRM data your team creates: notes, tasks, deal records, pipeline stage.
We do not collect data about your customers beyond what your team enters, what syncs from systems you connect, or what a customer sends you directly.
3. How we use it
- To operate the Service you've subscribed to (the inbox, templates, WooCommerce sync, recovery flows, CRM, broadcasts).
- To compute derived fields you've enabled (VIP tiers, RFM scores, COD-risk flags) from your own order data.
- This is automated profiling of your customers based on their order history. It is visible only to your team and is not used to make decisions without human involvement.
- To send transactional account emails (e.g., billing, security) via our email subprocessor, from
notifications.hudara.io. - To provide customer support to you (the business), and to maintain and secure the Service.
We do not sell customer data, and we do not use your customers' conversation content to train models for other customers.
4. Where data is processed and stored
Your data is hosted by Verpex in London, United Kingdom, and processed and stored under the security measures described in §8. Error monitoring data is processed by Sentry in Frankfurt, Germany (EU data region). See §6, Subprocessors, for the current list of subprocessors and where each operates.
5. Legal basis and your responsibility for customer consent
Where applicable data-protection law requires a legal basis for processing your customers' personal data (including under Egypt's Personal Data Protection Law and Saudi Arabia's Personal Data Protection Law), you, as the business collecting and directing the use of that data, are responsible for establishing that legal basis — including WhatsApp opt-in consent as required by Meta's platform terms (see the Terms of Service, section 5.1). Hudara processes customer data strictly on your instructions as the data controller for that data.
6. Subprocessors
Hudara's current subprocessors, and where each operates, are:
- Meta Platforms, Inc. — WhatsApp Business Platform (Cloud API) messaging infrastructure, message delivery; message content passes through Meta's systems as part of WhatsApp's own architecture.
- Verpex — server hosting for the Hudara application, database, and backups, London, United Kingdom.
- Cloudflare — DNS.
- Sentry — error monitoring, Frankfurt, Germany (EU data region).
- Resend — transactional email delivery.
- Google Cloud Speech-to-Text — only if you enable voice transcription and connect your own Google credentials. Audio is then sent to Google under your own account.
- Your WooCommerce store — a merchant-controlled system you connect yourself; it is not a subprocessor Hudara selects, but data flows to and from it under your own control.
We will notify customers at least 30 days before adding a new subprocessor.
7. Retention
- Active accounts: data is retained for as long as your subscription is active.
- After cancellation or closure: to close your account, email privacy@hudara.io from an admin address. We delete your workspace data from live systems within 30 days of a confirmed request. Backups are kept for 14 days and then deleted automatically. You can request a copy of your data before closure.
- Customer records within an active account: a business on Hudara can delete or anonymize an individual customer's record at any time — deletion is a soft delete with restore, and anonymizing a customer with order history removes personal details while keeping order totals for the business's own accounting. See the Data Deletion page for exactly how this works and how one of your own customers can request it directly.
- You can request deletion of specific customer records (e.g., on a data-subject request from one of your customers) by contacting privacy@hudara.io.
8. Security
Hudara applies the following measures: encryption in transit (TLS); access tokens, API credentials and other secrets encrypted at rest; passwords stored as bcrypt hashes; role-based access control (admin, manager, agent roles); tenant isolation enforced via row-level security; HMAC-signed traffic between Hudara and the hudara-connect WordPress/WooCommerce plugin; and token-gated media URLs. Hudara does not hold or claim any third-party security certifications.
9. Your rights and your customers' rights
As the business, you can access and delete customer data through the Service, and request an export of your account data by emailing privacy@hudara.io. Where one of your customers contacts Hudara directly about their data, we will refer them to you (the business) as the data controller for their information, and support you in fulfilling their request as required by applicable law.
10. International transfers
Your data may be processed outside your own country by the providers listed in §6 — including in the United Kingdom (Verpex) and the European Union (Sentry) — under contractual safeguards with those providers. Hudara does not guarantee that data will remain solely within any single country or region, since this may change if our subprocessors change (see §12).
11. Children
The Service is intended for business use and is not directed at children. We do not knowingly process data about children as data subjects beyond what may incidentally appear in a business's customer conversations.
12. Changes to this policy
We may update this policy. For material changes, we will give at least 30 days' advance notice by email to the account owner and an in-app notice before the changes take effect.
13. Contact
Questions about this policy or a data request: privacy@hudara.io. A data processing agreement (DPA) is available on request at the same address. General support: support@hudara.io.