Privacy Policy

Last updated: November 2026

1. Information We Collect

We collect information you provide when creating an account, including your name, email address, and organization details. We also collect usage data to improve our services.

  • Account information: Name, email address, password (hashed), organization name
  • Communication data: Messages are end-to-end encrypted using the Signal Protocol and cannot be read by Olbongo
  • Usage data: Feature usage analytics, login timestamps, device information
  • Hosted mail: Mailboxes on your own domain are covered separately — see the Olbongo Mail Privacy Policy

2. Google User Data

Olbongo requests one optional Google permission, and only when you ask for it:

  • Google Contacts (read-only): When you choose to import your contacts, we read contact names, phone numbers and email addresses to match them against existing Olbongo accounts and to populate your in-app contact list. The import is optional and user-initiated; we never modify or delete your Google contacts.
  • User profile information: Your name and email address, when you choose to sign in with Google.

Olbongo does not request access to your Gmail. Email inside Olbongo is our own hosted mail service on your own domain — see the Olbongo Mail Privacy Policy.

How We Use Google Data

  • Google Contacts data is used to find which of your contacts already use Olbongo, and to populate your in-app address book
  • We do not use Google user data for advertising purposes
  • We do not sell, rent, or share Google user data with third parties
  • We do not use Google user data for any purpose other than the contacts-matching feature described above

How We Store Google Data

  • OAuth tokens are encrypted at rest and stored in our secure database
  • Imported contact details are stored in your Olbongo address book until you remove them
  • We retain your Google authentication credentials only while your account is connected
  • When you disconnect your Google account, all stored tokens and cached data are permanently deleted

Google Data Sharing

Olbongo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking Access

You can revoke Olbongo's access to your Google account at any time from your Google Account permissions page. Revoking access does not delete your Olbongo account; it only stops Olbongo from accessing your Google data.

3. WhatsApp and Meta

Through Olbongo Omni, businesses and organizations such as schools connect their own WhatsApp Business Account and use Olbongo to send WhatsApp messages to, and receive them from, the people they serve. Those messages travel through Meta's WhatsApp Business Platform (the WhatsApp Cloud API), run by Meta Platforms, Inc.

  • Who is responsible: The connected business or school controls its conversations. Olbongo processes them on its behalf and only on its instructions.
  • What we handle: The organization's WhatsApp Business Account ID, phone number IDs, display number and name, and the access token it grants us. We also handle the phone numbers and WhatsApp profile names of the people it messages, the content of messages in both directions (text, images, documents, voice notes, locations and button replies), delivery and read statuses, and message template statuses.
  • Why: To deliver the organization's messages, show it its inbox and history, run the automations it sets up, and keep its WhatsApp account in good standing. We do not use this data for advertising, we do not sell it, and one organization never sees another organization's contacts or conversations.
  • Sharing: Message content and phone numbers are shared with Meta to send and receive each message, under WhatsApp's Business Policy and Meta's Privacy Policy. Content goes to an AI model provider only if the organization turns on an AI assistant.
  • How long we keep it: Conversations and contacts are kept until the organization deletes them or closes its account. Technical logs are deleted automatically after a limited period. The access token is deleted as soon as the organization disconnects WhatsApp in Omni or removes Olbongo as its partner in Meta Business Suite.
  • If you received a message: Contact the organization that sent it to see, correct or delete your data. You can stop an organization's marketing messages with WhatsApp's own block or “stop marketing messages” controls, and once you opt out we will not send you that organization's marketing templates. We help the organization act on your requests, and you can also write to us at the address below.

Full details are in the Omni Privacy Policy and on the Omni data deletion page.

4. How We Use Information

We use your information to:

  • Provide, maintain, and improve Olbongo services
  • Communicate with you about your account and service updates
  • Ensure the security and integrity of our platform
  • Provide customer support
  • Comply with legal obligations

We disclose data to public authorities only where the law requires it. Each request is reviewed for legality, unlawful requests are challenged, only the minimum data is disclosed, and every request is recorded — see Requests from public authorities.

5. Data Security

We implement industry-standard security measures to protect your data:

  • End-to-end encryption for all messages using the Signal Protocol (X3DH + Double Ratchet)
  • TLS 1.3 encryption for all data in transit
  • AES-256 encryption for data at rest
  • Argon2 password hashing
  • Regular security audits and vulnerability assessments

6. Data Retention

We retain your account data for as long as your account is active. When you delete your account:

  • Your profile and account data are permanently deleted within 30 days
  • Connected third-party service tokens (Google, and WhatsApp access tokens granted through Omni) are immediately revoked and deleted
  • Cached email and contact data are permanently deleted
  • Encrypted messages are removed from our servers (messages already delivered to other users remain under their control)

How to delete your data

You can request deletion of your Olbongo account and associated data at any time by visiting /delete-account and submitting your account email. After clicking the confirmation link in the email we send, your account enters a 14-day suspension window — you can cancel at any point during that window from the cancel link in your confirmation email. If you don't cancel, your account and the data listed below are permanently deleted after 14 days.

  • Profile (name, email, avatar, status text)
  • Messages (anonymized to "Deleted user" for other participants)
  • Contacts and uploaded media
  • Authentication data and device registrations
  • Mini-app installations and per-app data

Retained for legal/security reasons: audit logs and billing records.

7. Your Rights

You have the right to:

  • Access and download your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Disconnect third-party services at any time
  • Revoke Google account access from your Google Account permissions page

8. Contact

For privacy-related questions or data requests, contact us at: