Privacy Policy

Who is responsible

• Customer data. When an operator (our customer) uses Kepala, the customer decides what is processed and why. The customer is the controller; we process that data on its behalf under a data processing agreement.
• Our own data. For this website, the contact form and customer account administration, we are the controller.

What we process

For customers, under their instructions:

• Text messages from the customer's internal team WhatsApp groups that the customer connects to Kepala, with sender names and roles. Voice notes, images and other media are not processed; only a placeholder showing that media was sent is kept.
• Records Kepala creates from them: issues, tasks, status, decisions and daily summaries.
• The WhatsApp number and name of the customer's contact person who receives Kepala's summaries and alerts.

We redact phone numbers, email addresses, and card, ID, passport and bank numbers from message text before it is stored or sent for AI processing.

Through the website contact form: your name, business name and email address. If you contact us by email or WhatsApp, we receive what you send.

The website uses no analytics, advertising cookies or tracking. It loads the Inter typeface from Google Fonts, so your browser sends your IP address to Google when the page loads.

Why we process it

• To run the service the customer ordered: track operational issues and send the customer's contact daily summaries and critical-issue alerts by WhatsApp or Telegram.
• To secure, support and bill the service.
• To answer enquiries sent through the contact form.
• To improve Kepala's general, non-personal structure (for example, which types of operational decisions exist). This never includes a customer's personal data, values or policies.

We do not sell personal data, use it for advertising, or send marketing messages via WhatsApp.

Messages Kepala sends

Kepala sends messages only to contacts the customer designates, never to groups: summaries and alerts by WhatsApp (moving to Meta's WhatsApp Business Platform, Cloud API) and alerts by Telegram where the contact has linked it. These are service messages, not marketing. A recipient can stop them at any time by asking the customer or us.

Service providers

We use these sub-processors for Kepala:

• Meta Platforms (WhatsApp Business Platform): message delivery.
• Hetzner Online (server hosting, Singapore): runs the Kepala application and the connection to the customer's WhatsApp groups.
• Supabase (database hosting, Singapore).
• Anthropic (AI processing, United States).
• Telegram (alert delivery, for contacts who link it).

For the website and enquiries:

• Netlify (website hosting).
• Formspree (contact form processing, United States).
• Zoho (business email).
• Google (web fonts).
• Meta (WhatsApp, if you contact us there).

Each provider is bound by contract to protect the data and use it only to provide its service to us.

International transfers

Customer data is stored in Singapore and processed by AI in the United States; our team accesses it from the UAE. Website enquiries may be processed in the United States and other countries where our website providers operate. We rely on contractual safeguards with our providers for these transfers.

Retention

• Raw message text: up to 6 months, then deleted.
• Issue and summary records: for the duration of the customer contract, then deleted within 30 days unless the customer asks us to return them first.
• Contact form enquiries and business contacts: as long as needed for the relationship, and as required by law.

Security

Data is encrypted in transit and at rest, each customer's data is kept separate, access is limited to authorised staff, and administrative actions are logged.

Your rights

You may ask for access to, correction or deletion of your personal data, or object to its processing. If your data is processed for one of our customers (for example, as a member of a customer's staff), we will pass your request to that customer and help it respond. Staff of a customer can also ask, through the customer, to have their messages excluded from processing. Contact: manuel@anayalabs.ai.

Changes

We will post updates on this page and change the effective date above.