Woovli is built for Kenyan businesses. Here is what data we collect, how we use it, and your rights under the Kenya Data Protection Act 2019.
Woovli is a product of Rentsleek Ltd, a company incorporated in Kenya (“Rentsleek Ltd”, “we”, “us”, or “our”). We operate woovli.com and provide an AI sales assistant on WhatsApp for Kenyan small and medium businesses. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform.
By creating a Woovli account you agree to the practices described here. Questions? Contact us on WhatsApp.
Account information
Your email address and a password when you register. If you sign in with Google, we receive your name, email address, and profile photo from Google's OAuth service.
Business information
Your business name, WhatsApp phone number, business type (products or services), description, location, and operating hours. This is collected during the setup wizard and is required to operate Lora.
Payment configuration
Your M-Pesa business details — till number, Paybill number, account number, or Pochi la Biashara phone — so Lora can tell your customers where to send payment. We also accept bank account details if you choose bank transfer. We do not store your customers' M-Pesa PINs or card numbers. We only store the M-Pesa confirmation reference (e.g. QWE456RTY) that a customer provides after paying.
WhatsApp conversation data
Messages exchanged between your customers and Lora on your connected WhatsApp number, including customer phone numbers, message text, and conversation history. This data is required for Lora to respond in context and for you to review conversations in your dashboard.
Subscription billing
The M-Pesa phone number you use to pay your Woovli subscription, plus the M-Pesa checkout request ID and confirmation reference. We do not store your M-Pesa PIN.
Usage data
Aggregate information about how you use the Woovli dashboard — such as which features you access — to help us improve the product. This does not include the contents of WhatsApp messages.
All data is stored in encrypted cloud infrastructure. We apply encryption in transit (HTTPS/TLS) and encryption at rest. Access to production data is restricted to authorised systems and personnel only.
Each business account is logically isolated — one merchant cannot access another merchant's data or customer conversations.
No system is completely immune to attack. If you suspect unauthorised access to your account, contact us on WhatsApp immediately and change your password.
We retain your account and business data for as long as your account is active. If you close your account, personal data is deleted within 90 days unless Kenyan law requires a longer retention period.
WhatsApp conversation data (messages and customer phone numbers) is retained for a rolling 12-month period to support your dashboard analytics and conversation history. You may request earlier deletion at any time by contacting us.
Woovli integrates with these third-party services to deliver its features. Each has its own privacy policy and data practices.
Meta (WhatsApp Business API)
WhatsApp messages are delivered through Meta's infrastructure. Meta processes message metadata (sender, timestamp, delivery status) as described in Meta's privacy policy and WhatsApp Business terms.
Safaricom M-Pesa
Payment processing for customer orders and Woovli subscriptions uses Safaricom's M-Pesa API. Safaricom handles the STK Push prompt and the transaction. Woovli only stores the M-Pesa confirmation reference code.
Google OAuth
If you sign in with Google, Google shares your name, email address, and profile photo with Woovli under Google's OAuth terms. You can revoke this access from your Google account settings at any time.
As a data subject under the Kenya Data Protection Act 2019, you have the following rights:
To exercise any of these rights, contact us on WhatsApp. We will respond within 21 days as required by the DPA 2019. There is no charge for submitting a data rights request.
We may update this Privacy Policy as our services evolve or to comply with legal changes. We will notify you of material changes by email or via a notice in your Woovli dashboard at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.
For privacy questions or to exercise your data rights:
Response time: 2 business days for general queries; 21 days for formal data requests under the DPA 2019.