SalesBuddy

Privacy Policy

Last updated: 18 October 2026

Drafting notice: this policy was drafted to accurately describe SalesBuddy's real data flows as a genuine starting point, not final legal language. It has not been reviewed by a lawyer qualified in Nigerian, Ghanaian, or Kenyan data protection law and should be reviewed before being relied on for regulatory compliance (NDPA, Ghana Data Protection Act 2012, Kenya Data Protection Act 2019) or before being used with real customer data at scale.

1. Who we are

SalesBuddy is run by Raeba Technologies Ltd (RC 8385692), a company registered in Nigeria ("SalesBuddy", "we", "us"). SalesBuddy lets a business run an AI sales assistant on WhatsApp. You can reach us at [email protected]. We currently serve businesses in Nigeria and apply the Nigeria Data Protection Act 2023. We will update this policy when we start operating in other countries.

2. Our two roles

  • For businesses and their staff who use SalesBuddy, and for visitors to our website, we decide why and how personal data is used. In data protection terms we are the "data controller".
  • For the customers of a business that uses SalesBuddy (the people who message that business on WhatsApp), the business decides why their data is used. We handle it for the business and on its instructions: we are the "data processor". The business is responsible for its own privacy notice to its customers.

3. What we collect

3.1 Businesses and their staff

  • Name, email address, role, and a password stored only as a one-way hash (or a Google account identifier if you sign in with Google).
  • The business profile, products, knowledge base, payment instructions and AI settings you enter.
  • Subscription and wallet records. Card details are entered on Flutterwave's page; we keep only a token Flutterwave gives us, never the card number.
  • Records of sign-ins and of actions in the dashboard (who did what, when).

3.2 Customers of a business

  • Their WhatsApp number and display name.
  • The text of their messages and, for voice notes, a transcript. We store the text and the transcript in our database. We do not save the photos, voice recordings or other files that customers send. The WhatsApp connection software we run keeps the record of each message: for a photo, voice note or file that record points to the file on WhatsApp's servers (with the key needed to fetch it), and for some photos it also keeps a small preview thumbnail. It does not keep the file itself.
  • Details they give to place an order or book: name, delivery address, products, and order and payment references. For businesses that use AI phone calls, call records and transcripts.

3.3 Website visitors

  • IP address and request details in our server logs.
  • Cookies: one login cookie (24 hours), one cookie that remembers the workspace you chose (only for businesses with several workspaces), a theme setting kept in your browser, and Cloudflare's bot check when you sign up or sign in. We do not use advertising or analytics cookies.

4. Why we use it, and our legal basis

  • To provide the service and carry out our contract with a business: running the AI assistant, the dashboard, orders, billing and support.
  • To keep the platform secure and prevent fraud and abuse (our legitimate interest).
  • To meet legal obligations, such as accounting and tax records.
  • With consent where the law requires it, for example when an owner asks us to make a clone of their voice.
  • For the customers of a business, the business's own legal basis applies. Usually this is that you contacted the business and asked about its products or services.

We do not sell personal data, and we do not use it for advertising.

5. Automated replies

Replies to customers are written by AI models. The business can read every conversation, take over from the AI at any time, and is alerted when a customer asks for a person or the AI cannot help. If you do not want to talk to an AI, ask for a person and the business is alerted.

6. Who we share data with

We use these service providers. Each receives only what it needs to provide its service to us.

  • DeepSeek (China) and Google (Gemini): write the AI replies and read order details from conversations. They receive the customer's message text and the conversation context, with the business's knowledge base and product information.
  • ElevenLabs: turns text into voice, transcribes voice notes (Google Gemini is the back-up transcriber), and makes a business owner's voice clone from a sample they provide.
  • Resend: sends our emails (password resets, deletion confirmations).
  • SmartSMS Solutions (Nigeria) and Telegram: urgent escalation alerts. Each alert contains the text of the escalation message, which can include what a customer wrote. SmartSMS delivers it by SMS to the business's contact number, and Telegram delivers it to our team.
  • Flutterwave: bills businesses for their SalesBuddy subscription.
  • Paystack and Flutterwave (the business's own account): process payments from a business's customers when the business turns that on. The business is the merchant.
  • Backblaze: stores our encrypted backups and an encrypted copy of product photos and videos, in the European Union (Netherlands).
  • Cloudflare: protects and speeds up our website and runs the bot check.
  • Google: sign-in with Google, if you choose it.
  • Meta (WhatsApp): carries the messages. Meta's own terms and privacy policy apply to messages sent through WhatsApp.

The rest of the system runs on our own servers in Germany (European Union): the database, the message store, the search index, the workflow engine, the WhatsApp connection and voice calls. We do not let providers use the data for their own marketing.

7. Transfers outside Nigeria

Our servers are in Germany and our backups are in the Netherlands, both in the European Union. Several of the providers above process data in other countries, including China (DeepSeek) and other countries where Google, ElevenLabs, Resend and Cloudflare operate. We send each provider only what it needs for its service and rely on the commitments in its terms. If you want to know more about a transfer that concerns you, write to us.

8. How long we keep data

  • Customer messages in the message log: deleted automatically after 12 months. A business can delete a customer's data sooner. The WhatsApp connection software keeps its own copy of the message record for as long as the business's number is connected; that copy is deleted when the business removes the number or deletes its account, or when you ask us to delete your data.
  • The AI's memory of a conversation: expires after 7 days.
  • Orders, payments and bookings: while the business's account is active.
  • Delivery tracking codes: archived 30 days after the delivery is closed.
  • A business's account data, including the record of actions in its dashboard: until the business deletes its account. It is then deleted from our live service 7 days after the owner confirms (a cooling-off period), and from our encrypted backups within a further 28 days.
  • Billing records: kept in anonymised form (amounts and dates only) for as long as Nigerian accounting and tax law requires, currently six years.
  • Server logs and error reports: kept until they expire on their normal schedule. We have not yet set a fixed period for them.

Copies held by our email, SMS and voice providers are deleted under their own retention rules. See how to ask for deletion.

9. Security and breaches

Each business's data is separated from every other business at database level, connections are encrypted, backups are encrypted, and staff accounts are limited by role and their actions are recorded. If a breach puts people's rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, tell the people affected without undue delay where the risk is high, and tell the businesses concerned so that they can do the same.

10. Your rights

You can ask us to confirm whether we hold your personal data and to give you a copy, to correct it, to delete it, to restrict or object to how it is used, and to give it to you in a portable form. You can withdraw consent you have given. Email [email protected]. We acknowledge your request within 3 working days and act on it within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

If you messaged a business that uses SalesBuddy (on WhatsApp, and on Messenger or Instagram once a business connects them), the business is responsible for your data and we handle it for the business. You can ask the business or us. If you ask us, we pass your request to the business and help it respond, and we act directly if the business no longer exists. See Data deletion.

11. Children

SalesBuddy is a business tool and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We will change this page and its "Last updated" date when the policy changes, and email account holders about material changes.

13. Contact

Raeba Technologies Ltd. Email [email protected] with the subject "Data protection". We have not appointed a separate Data Protection Officer yet; this address reaches the people at Raeba Technologies Ltd who handle data protection. See also our Contact page.