Woovli is built for Kenyan businesses. Here is what data we collect, how we use it, and your rights under the Kenya Data Protection Act 2019.
Woovli is a product of Rentsleek Ltd, a company incorporated in Kenya (“Rentsleek Ltd”, “we”, “us”, or “our”). We operate woovli.com and provide an AI sales assistant on WhatsApp for Kenyan small and medium businesses. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform.
Lorais Woovli's AI assistant. On a merchant's WhatsApp number, Lora answers customers' questions, takes orders and bookings, and requests M-Pesa payments. Woovli also lets merchants run advertising campaigns on Facebook and Instagram by connecting their Facebook account.
By creating a Woovli account you agree to the practices described here. Questions? Contact us on WhatsApp or email privacy@woovli.com.
Account information
Your email address and a password when you register. If you sign in with Google, we receive your name, email address, and profile photo from Google's OAuth service.
Business information
Your business name, WhatsApp phone number, business type (products or services), description, location, and operating hours. This is collected during the setup wizard and is required to operate Lora.
Payment configuration
Your M-Pesa business details — till number, Paybill number, account number, or Pochi la Biashara phone — so Lora can tell your customers where to send payment. We also accept bank account details if you choose bank transfer. We do not store your customers' M-Pesa PINs or card numbers. We only store the M-Pesa confirmation reference (e.g. QWE456RTY) that a customer provides after paying.
WhatsApp conversation data
Messages exchanged between your customers and Lora on your connected WhatsApp number, including customer phone numbers, message text, and conversation history. This data is required for Lora to respond in context and for you to review conversations in your dashboard.
Subscription billing
The M-Pesa phone number you use to pay your Woovli subscription, plus the M-Pesa checkout request ID and confirmation reference. We do not store your M-Pesa PIN.
Facebook and Instagram advertising data
If you connect your Facebook account to run ads, we receive from Meta, through Facebook Login and the Marketing API: your Meta user ID and name; the Facebook Pages and Instagram accounts you manage; your ad account and Business Manager IDs; your campaign, ad set and ad details; and performance data such as impressions, clicks, spend and results. We store the access tokens Meta issues so Woovli can manage ads on your behalf. We do not access your personal posts, friends list or private messages.
Usage data
Aggregate information about how you use the Woovli dashboard — such as which features you access — to help us improve the product. This does not include the contents of WhatsApp messages.
We do not sell your data. Data we receive from Meta is used only to run and report on your own ads. It is not used to build advertising profiles or for any unrelated advertising, and it is shared only with Meta and with the service providers we need to run Woovli.
All data is stored in encrypted cloud infrastructure. We apply encryption in transit (HTTPS/TLS) and encryption at rest. Access to production data is restricted to authorised systems and personnel only.
Each business account is logically isolated — one merchant cannot access another merchant's data or customer conversations.
Meta access tokens are stored encrypted and are never shown in the dashboard. Connected ad accounts are isolated per merchant: each merchant's token is used only for that merchant's own ads.
No system is completely immune to attack. If you suspect unauthorised access to your account, contact us on WhatsApp immediately and change your password.
We retain your account and business data for as long as your account is active. If you close your account, personal data is deleted within 90 days unless Kenyan law requires a longer retention period.
WhatsApp conversation data (messages and customer phone numbers) is retained for a rolling 12-month period to support your dashboard analytics and conversation history. You may request earlier deletion at any time by contacting us.
Data we receive from Meta is kept while your Facebook account is connected. When you disconnect, your Meta access tokens are deleted immediately. Any remaining Meta-sourced data is deleted within 30 days of a deletion request or of your account being closed, unless Kenyan law requires us to keep it. The only records we keep for that reason are payment records (M-Pesa transaction references and Woovli subscription payments), which Kenyan tax and financial record-keeping law requires us to keep. See how to request deletion.
Woovli integrates with these third-party services to deliver its features. Each has its own privacy policy and data practices.
Meta (WhatsApp Business API)
WhatsApp messages are delivered through Meta's infrastructure. Meta processes message metadata (sender, timestamp, delivery status) as described in Meta's privacy policy and WhatsApp Business terms.
Meta (Facebook Login and Marketing API)
If you connect your Facebook account to run ads, you share the Facebook and Instagram advertising data described in Section 2 with Woovli under Meta's Platform Terms. You can disconnect at any time from the Ads page in your Woovli dashboard, or in Facebook under Settings > Business integrations. After you disconnect, we delete your stored Meta access tokens and stop accessing your ad accounts.
Safaricom M-Pesa
Payment processing for customer orders and Woovli subscriptions uses Safaricom's M-Pesa API. Safaricom handles the STK Push prompt and the transaction. Woovli only stores the M-Pesa confirmation reference code.
Google OAuth
If you sign in with Google, Google shares your name, email address, and profile photo with Woovli under Google's OAuth terms. You can revoke this access from your Google account settings at any time.
As a data subject under the Kenya Data Protection Act 2019, you have the following rights:
To exercise any of these rights, contact us on WhatsApp or email privacy@woovli.com. To delete your data, including Facebook and Instagram data, follow our data deletion instructions: we confirm a deletion request within 2 business days and delete the data within 30 days. We will respond within 21 days as required by the DPA 2019. There is no charge for submitting a data rights request.
We may update this Privacy Policy as our services evolve or to comply with legal changes. We will notify you of material changes by email or via a notice in your Woovli dashboard at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.
For privacy questions or to exercise your data rights:
Email: privacy@woovli.com
Response time: 2 business days for general queries; 21 days for formal data requests under the DPA 2019.