Privacy Policy

1. Introduction

When you use our services, you trust us with information that may identify you or your customers. We take that responsibility seriously and use this policy to explain the data we collect, why we collect it, and how you can manage or request access to it.

For this policy, “Personal Data” means information relating to an identified or identifiable person. “Customer” or “Client” means a business entity using the platform to provide messaging services to its own users or customers.

ByOraya/DOTA is a WhatsApp Business CRM and conversation cloud platform that helps businesses store, manage, analyze, and transfer messages across WhatsApp Business and related channels.

2. Collection and Use of Personal Data

We may collect and process Personal Data for the following purposes:

• Providing, operating, and managing the service.
• Internal business operations and service improvement.
• Communication, marketing, product demos, and customer support.
• Payment collection and billing administration.
• Recruiting, personnel management, fraud prevention, and security.

To provide the service, we may collect names, email addresses, phone numbers, account credentials, OAuth credentials, profile details, payment information, and usage information. These details are used to identify users, deliver requested content, support accounts, and maintain the service.

Some integrations use third-party services such as Google Sign-In, Google Drive, Facebook Sign-In, Apple Sign-In, or Shopify Sign-In. Those providers may process data under their own privacy policies.

3. Service Data and Cloud API

Service Data is information processed on behalf of customers while the service is being provided. Customers decide what Personal Data is collected through their messaging flows, how it is used, and how long it is retained. Questions about a customer’s use of Personal Data should be directed to that customer.

Messages sent through Cloud API services may be temporarily stored to support transmission and delivery to WhatsApp. Message retention and deletion may depend on the relevant provider and service configuration.

When an account is terminated, contacts, conversations, and related account data may be deleted from our systems unless retention is required by law, contract, security, billing, or a customer request.

4. Website, Marketing, and Payments

When you request a demo, contact us, subscribe, or ask for support, we may collect your name, business email, job title, WhatsApp number, company information, and the details needed to respond. We may use this information to provide support, improve the service, and send product updates. You may opt out of marketing communications or request deletion of contact details where applicable.

For paid subscriptions, we process account and billing information needed to collect payment, manage invoices, handle support, and administer your subscription.

5. Cookies and Analytics

We use cookies and similar technologies to remember sessions, support account access, understand website activity, improve the website, and personalize the service. Session cookies usually expire when the browser is closed. Persistent cookies remain until deleted or expired.

Analytics tools may collect information such as IP address, browser type, operating system, pages visited, average time spent, and general usage patterns. Disabling cookies may affect some service features.

6. Mobile App and Google Sheets Plugin

If a mobile app is used, it may request access to contacts, media, documents, camera, or device information only where needed to support chat and messaging features. Mobile analytics may record app usage, device type, operating system, events, and performance information.

A Google Sheets integration may request permissions needed to send WhatsApp messages from spreadsheets, read phone numbers or variables selected by the user, call the messaging system, schedule messages, and track responses. Data sent from Google Sheets is used for the connected user account and not shared with unrelated users.

7. Disclosure of Personal Data

We do not sell Personal Data. We may disclose or make Personal Data available to service providers, hosting vendors, support tools, payment processors, affiliates, subcontractors, legal authorities, or business successors when needed to provide the service, comply with law, protect rights, prevent fraud, or complete a merger, acquisition, financing, restructuring, or similar transaction.

8. Your Data Subject Rights

Depending on applicable law, you may have the right to access, correct, delete, restrict, export, object to processing of, or withdraw consent for certain Personal Data. To exercise these rights, contact us using the details below. We may need to verify your identity before fulfilling a request.

If a request concerns data controlled by one of our customers, we may direct you to that customer and assist them where possible.

9. Security, Retention, and Updates

We use reasonable technical and organizational measures to protect Personal Data against loss, misuse, unauthorized access, disclosure, alteration, or destruction. No online service can guarantee absolute security, so customers should also maintain reasonable account and device safeguards.

This policy may be updated periodically. Updates will be posted on this website, and continued use of the service after updates means the revised policy applies.