Privacy Policy

Last updated: 29 June 2026

Chatly is a product operated by Vularis (Pty) Ltd ("Vularis", "Chatly", "we", "us", or "our"). It provides a WhatsApp commerce orchestration platform that enables businesses ("Merchants") to receive orders and accept payments from their customers ("End Customers") over WhatsApp. This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights available to you. It applies to our website, APIs, and the services we provide as a WhatsApp Business Platform Tech Provider.

1. Our role

For data about Merchants and their accounts, Chatly acts as a data controller. For End-Customer data that we process on a Merchant's behalf (such as WhatsApp messages and order details), Chatly acts as a data processor / operator, and the Merchant is the controller. We process such data only to provide the service and on the Merchant's documented instructions.

2. Information we collect

• Merchant account data: business name, contact name, email, phone number, business address, and WhatsApp Business Account (WABA) and phone number identifiers.
• WhatsApp messaging data: the content and metadata of messages sent to and from a Merchant's WhatsApp number through our platform, including the End Customer's WhatsApp phone number, message text, timestamps, and delivery/read status.
• Order and transaction data: products selected, amounts, currency, and payment references generated for an order.
• Authorization tokens: access tokens granted by Meta via Embedded Signup that allow us to send and receive messages on a Merchant's behalf (stored encrypted).
• Technical data: logs, IP addresses, and diagnostic information needed to operate and secure the service.

We do not collect or store full payment card details. Card data is handled directly by our payment processor (Paystack) on their PCI-DSS compliant infrastructure.

3. How we use information

• To deliver the core service: routing WhatsApp messages, generating payment links, and sending order and payment confirmations.
• To onboard Merchants and connect their WhatsApp Business Account.
• To process payments through Paystack and reconcile transactions.
• To secure, monitor, troubleshoot, and improve the service.
• To comply with legal obligations and enforce our terms.

4. WhatsApp and Meta data

Our use and transfer of information received from Meta APIs adheres to the Meta Platform Terms and WhatsApp Business Messaging Policy, including applicable limited-use requirements. We use WhatsApp message data solely to provide messaging and commerce features to the Merchant whose account the message relates to. We do not use this data for advertising, and we do not sell it.

5. How we share information

• Meta Platforms: to send and receive WhatsApp messages via the WhatsApp Cloud API.
• Paystack: our payment processor, to create payment links and process transactions.
• Cloud infrastructure (Google Cloud): hosting and processing of the service.
• Legal and safety: where required by law, regulation, or to protect rights, safety, and the integrity of the service.

We do not sell personal information.

6. Data retention

We retain personal information only as long as necessary to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. Merchants may request deletion of End-Customer data they control, subject to legal retention requirements.

7. Security

We use industry-standard measures to protect information, including encryption in transit (HTTPS), encryption of stored access tokens, access controls, and signature verification of inbound webhooks. No method of transmission or storage is completely secure, but we work to protect your information and continually improve our safeguards.

8. International transfers

Chatly operates from South Africa and uses service providers that may process data in other countries. Where data is transferred across borders, we take steps to ensure an adequate level of protection consistent with applicable law.

9. Your rights

Depending on your location, you may have rights under the South African Protection of Personal Information Act (POPIA) and, where applicable, the EU/UK GDPR — including the right to access, correct, delete, or restrict processing of your personal information, and to object to processing. To exercise these rights, contact us using the details below. End Customers should contact the relevant Merchant, who is the controller of their data; we will assist that Merchant in responding.

10. Children

The service is intended for businesses and is not directed to children under the age of 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above.

12. Contact us

Vularis (Pty) Ltd (operator of Chatly)
South Africa
Email: info@vularis.tech
Website: https://chatly.co.za