Privacy Policy

1. Introduction

Notivo (“Notivo,” “we,” “us,” or “our”) is a WhatsApp business messaging platform operated by Humziq. This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use Notivo — whether as an organization sending messages through our platform (a “Customer” or “Tenant”), a member of a Customer's team (a “User”), or a person who receives a message sent through Notivo (a “Recipient”).

2. Information We Collect

Account information. When a Customer or User registers, we collect a name, email address, hashed password, organization name, and role. Sign-up includes email verification via a one-time code sent to the address provided.

Contact information. Customers upload contact records (such as names, phone numbers, and optional custom fields they choose to include) in order to send them messages. This data is provided and controlled by the Customer, not collected by us directly from Recipients.

Message content and delivery data. We process the content of messages Customers send, along with delivery status (sent, delivered, read, or failed) reported back by the WhatsApp Business Platform.

WhatsApp Business Account credentials.Customers connect their own WhatsApp Business Account to Notivo. Access tokens are encrypted at rest and used solely to send messages on the Customer's behalf.

Usage and log data. We maintain audit logs of significant account actions (such as campaign sends, contact imports, and settings changes) for security and accountability purposes.

3. How We Use Information

• To operate the Notivo platform and deliver messages via the WhatsApp Business Platform
• To authenticate accounts and protect against unauthorized access (rate limiting, account lockout, email verification)
• To provide Customers with delivery and engagement analytics for their own campaigns
• To detect and honor opt-out requests from Recipients
• To maintain security, audit, and legal compliance records

4. Consent for Contact Data

Customers are solely responsible for ensuring they have a lawful basis and, where required, explicit consent to message each contact they upload. Notivo requires a consent acknowledgment at the point of import and records a consent source and timestamp against every contact. Notivo automatically detects opt-out requests (such as a reply of “STOP”) and suppresses further messages to that contact across all future campaigns.

5. How Information Is Shared

To deliver messages, contact and message data is transmitted to Meta Platforms, Inc. via the WhatsApp Business Platform, which processes it under its own terms and privacy policies. We also share information with infrastructure providers that host our application and database. We do not sell personal information to third parties.

6. Data Security

• WhatsApp access tokens and other sensitive credentials are encrypted at rest (AES-256-GCM)
• Passwords are hashed, never stored in plain text
• Each Customer's data is isolated from other Customers at the database level
• Inbound webhook requests from Meta are cryptographically verified
• Account access is protected by rate limiting and automatic lockout after repeated failed logins

7. Data Retention

Account and contact data is retained for as long as the associated account remains active. Customers may delete contacts or their account at any time. Audit logs are retained for security and compliance purposes for a limited period after an event occurs.

8. Your Rights

If you are a Recipient and no longer wish to receive messages from a business using Notivo, reply “STOP” to any message, or contact that business directly — they control your contact record. If you are a Customer or User, you may access, correct, or delete your account information at any time, or contact us at the address below.

9. International Data Transfers

Notivo's infrastructure and the WhatsApp Business Platform may process data in countries other than your own. By using Notivo, you acknowledge that your information may be transferred to and processed in such locations.

10. Children's Data

Notivo is intended for business use and is not directed at children. Some Customers (such as schools) may include a minor's name as a custom field on a parent or guardian's contact record solely for message personalization; in such cases, the Customer — not Notivo — acts as the data controller responsible for that information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

12. Contact Us

Questions about this Privacy Policy can be sent to privacy@humziq.com.