Privacy policy

Who we are

Hena ("we", "us") provides an online service that lets businesses manage conversations with their customers on WhatsApp, Instagram, Messenger, email and SMS from one inbox.

You can reach us about anything in this policy at hello@henachat.com.

Two kinds of data, two roles

Account data: when you sign up and use Hena, we decide how your account data is used, as described here.

Business conversation data: the messages and contact details that a business handles through Hena belong to that business. We process them only on the business's behalf and following its instructions, to provide the service.

What we collect

Account and organization details: your name, email address, password (stored only as a secure hash), language, the organization you create or join, and your role in it.

Data from channels a business connects: messages and attachments sent and received, contact names, phone numbers, usernames and profile identifiers, delivery and read statuses, the identifiers of the connected accounts and pages, and the access tokens needed to send and receive on the business's behalf.

Technical data: IP address, browser and device information, logs and security events, used to run and protect the service.

Cookies: we use a cookie to keep you signed in. We do not use advertising cookies.

Data we receive from Meta platforms

When a business connects WhatsApp, Instagram or Messenger through Meta's official sign-in, we receive only the data needed to send and receive that business's messages and manage its message templates.

We use this data only to provide Hena to that business. We do not sell it, we do not use it for advertising, we do not combine it across businesses to build profiles, and we handle it in line with Meta's Platform Terms and Developer Policies.

How we use data

To provide and operate the service: delivering messages, showing conversations, running the automations a business sets up, and supporting its team.

To keep the service secure, prevent abuse and fraud, and meet legal obligations.

To send you messages about your account, such as security notices and changes to the service.

To improve Hena using aggregated information that does not identify anyone.

If a business turns on AI features, the relevant message content and the business's own information are sent to an AI service provider only to produce answers for that business. We will name these providers on this page before AI features are offered.

Who we share data with

Service providers who help us run Hena, such as hosting, email delivery and SMS delivery, under contracts that limit their use of the data to providing their service to us.

The messaging platforms themselves (for example Meta), because sending a message on a channel means passing it to that channel.

Authorities, when the law requires it, and a buyer or successor if Hena's business is transferred, under the same protections.

We do not sell personal data.

How long we keep data

We keep data while the business's account is active. When a business deletes data or closes its account, we delete it within 30 days, and it leaves our backups within a further 30 days.

We may keep limited records longer where the law requires it, such as billing records.

How we protect data

Data is encrypted in transit with HTTPS. Platform access tokens are encrypted at rest. Each business's data is kept separate from every other business's, and only staff who need access to run the service have it.

Your rights and choices

You can ask to access, correct, export or delete your personal data, or object to how we use it, by writing to hello@henachat.com. We may ask you to confirm your identity.

If you are a customer of a business that uses Hena, your conversations belong to that business, so please contact it first. If you write to us, we will pass your request to the business and help it respond.

Our page on deleting your data explains the steps in detail.

International transfers

Our providers may process data in countries other than yours. When they do, we use contracts and safeguards that protect it to the standard of this policy.

Children

Hena is a service for businesses and is not meant for children. We do not knowingly collect children's data for our own purposes.

Changes to this policy

We will update this page and the date at the top when the policy changes, and tell account owners by email before any important change takes effect.