Privacy Policy
This policy explains what personal data WA Desk collects, why, who it is shared with, how long it is kept and the choices you have.
Who we are
WA Desk is a shared WhatsApp inbox, automation and WhatsApp shop service for businesses, operated by KITIMBA, Kiwatule, Kampala, Uganda ("we", "us"). Contact us at support@kitimba.com.
Our two roles
- For people who sign up for WA Desk (business owners and their teammates), we decide how your account data is used. We are the data controller.
- For the customers of those businesses (people who message a business on WhatsApp), the business decides what happens to the conversation. We store and process it on the business's behalf and only to provide the service. If you are a customer of a business that uses WA Desk, contact that business first about your data. You can also contact us.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, phone number, role, password (stored only as a one-way hash), sign-in times | You, when you sign up or are added by a teammate |
| Workspace | Business name, address, time zone, business hours, plan and billing history | Workspace admins |
| WhatsApp connection | Phone number ID, WhatsApp Business Account ID, access token, display name | Meta, when a business connects its number |
| Contacts | WhatsApp number, profile name, tags, notes, email, opt-out status | WhatsApp messages and the business's team (including CSV imports) |
| Messages | Text, photos, voice notes, documents, delivery and read status, internal team notes | Conversations between the business and its customers |
| Shop orders | Items, delivery area and address, payment method, the mobile money number used to pay, payment references | Customers ordering through a business's WhatsApp shop |
| Technical | IP address, browser cookies needed to stay signed in, security and audit logs | Your browser and our servers |
How we use it
- To provide the service: show conversations, send and receive WhatsApp messages, run the automations and shop a business sets up, and process its orders.
- To run your account: sign-in, email verification codes, password resets, subscriptions and payments.
- To keep the service secure: rate limits, fraud and abuse prevention, and an audit log of who changed what.
- To support you when you contact us.
We do not sell personal data, we do not use it for advertising, and we do not use businesses' conversations to train AI models.
Who we share it with
- Meta (WhatsApp). Messages are sent and received through the official WhatsApp Business Platform (Cloud API), so Meta processes them under its own terms.
- Payment providers. Wa Desk processes subscription payments by mobile money. For shop payments, the business's own provider account (for example ioTec Pay, flutterwave, yo payments) receives the payer's number and amount.
- AI providers, only if a business turns them on. When a business uses AI reply steps with its own Anthropic, OpenAI or Google key, the relevant conversation text is sent to that provider to write the reply.
- A business's own systems, only if it sets this up. An automation can send selected values, such as the customer's number, to an address the business chooses.
- Service providers that host our servers and deliver our emails, bound to protect the data.
- Authorities, when the law requires it.
Some of these providers, including Meta and AI providers, may process data outside Uganda.
How we protect it
- Connections use HTTPS. WhatsApp access tokens, API keys and payment credentials are encrypted at rest.
- Passwords are stored only as hashes. Every new email address is confirmed with a code.
- Each business's workspace is kept separate, and teammates only see what their role allows.
- Webhooks from Meta and payment providers are checked with signatures or shared secrets.
How long we keep it
| Data | Kept |
|---|---|
| Accounts, workspaces, contacts, messages, orders | While the workspace exists, or until deleted (see Data deletion). A lapsed subscription does not delete data. |
| Photos and documents | Until the business deletes them under Settings → Storage, or the workspace is deleted |
| Raw webhook deliveries | 7 days |
| Automation API and AI call logs | 30 days |
| Email verification and reset codes | 15 minutes to use; removed within a day |
| Payment and audit records | As long as needed for accounting, tax and legal obligations |
Your rights
Under Uganda's Data Protection and Privacy Act, 2019, you can ask to access the personal data we hold about you, correct it, have it deleted, or object to how it is used. Email support@crm.ug and we will respond within a reasonable time. If you are unhappy with our answer, you can complain to Uganda's Personal Data Protection Office.
Customers of a business can reply STOP to that business on WhatsApp at any time to stop its campaigns and automated messages, and START to resume them.
Cookies
This website sets no cookies and uses no analytics or advertising trackers. The WA Desk app uses only the cookies needed to keep you signed in and to protect forms. When a business connects its number with "Connect with Facebook", Meta's login window loads Meta's own scripts.
Children
WA Desk is a service for businesses and is not intended for anyone under 18 to sign up.
Changes
We will update this page when our practices change and show the new effective date at the top. For significant changes we will tell workspace admins by email or in the app.
Contact
KITIMBA, Kiwatule, Kampala, Uganda. Email: support@kitimba.com.