Privacy Policy

Effective 14 September 2026

1.Who we are

Sowaan Limited ("Sowaan," "we," "us," "our"), registered in England and Wales at 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom, operates Tarceel (the "Service"). For UK data protection law purposes, Sowaan Limited is the data controller for the personal data described below, except where this policy says otherwise.

2.What we collect

• Account data. Your email address, and your name if you provide one (via magic-link sign-up or Google sign-in). We never ask for or store a password.
• Billing data. Handled directly by Stripe — we never receive or store your full card number. We keep a Stripe customer/subscription reference and your billing history (amounts, dates, plan) to administer your account.
• WhatsApp connection data. When you link a number, the session credentials that keep the connection open are stored on our servers. We treat this the same way we'd treat a password: scoped to your account only, never returned by our API once issued, and excluded from logs by design.
• Message delivery metadata. To track delivery, we temporarily store each message's identifier, recipient, and status (sent/delivered/read/failed) for up to 7 days. We do not store the text or media content of your messages in this record.
• Webhook delivery records. To reliably deliver inbound messages and status updates to your own server — including retrying a failed delivery — we keep a record of each attempt, which includes the payload sent (this can include message content), for up to 90 days, after which it's permanently deleted.
• Technical/log data. Standard server logs (timestamps, request paths, error details). Credentials and message content are deliberately excluded from logs by design, not just by policy.
• Support communications. Anything you send us directly, e.g. by email.

3.What we don't do

We do not sell your personal data. We do not read your message content for advertising purposes.

4.How we use this data

To provide and maintain the Service; process payments; send service-related communications (a sign-in link, a receipt, a trial-ending reminder) and, where you haven't opted out, product updates; monitor and improve reliability and security; detect and prevent abuse, including the consent safeguards in our Terms of Service; and comply with legal obligations.

5.Legal basis for processing (UK GDPR)

We rely on one or more of: performance of our contract with you (providing the Service you signed up for); our legitimate interests (keeping the Service secure, reliable, and free of abuse); your consent (for example, optional marketing email, which you can withdraw any time); and compliance with a legal obligation.

6.Who we share data with

We share data with these categories of service providers, each under their own obligation to protect it:

• Stripe, Inc. — payment processing
• Mailgun (Sinch) — sending transactional email
• Google LLC — if you choose to sign in with Google
• Sentry — error tracking (technical error data, never message content)
• Cloudflare, Inc. — encrypted backup storage
• Hetzner Online GmbH — infrastructure and hosting

Because Tarceel connects to WhatsApp, message content you send and receive also passes through WhatsApp/Meta's own systems, the same way it would through the ordinary WhatsApp app. If your account uses the official WhatsApp Business Platform (Cloud API) connection, Meta receives and processes that content as the provider of that platform — their handling of that data is governed by WhatsApp's own terms and privacy policy, not this one. We'll also disclose data where the law requires it, or to protect the rights, property, or safety of Sowaan, our users, or the public.

7.International transfers

Some providers listed above may process data outside the United Kingdom, including in the United States. Where that happens, we rely on safeguards recognized under UK data protection law, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses.

8.Data retention

We keep account and billing data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution obligations. Message delivery-status metadata is kept for up to 7 days. Webhook delivery records (including their payload) are kept for up to 90 days, then permanently deleted.

9.Your rights

Under UK GDPR you can: access the personal data we hold about you; correct inaccurate data; request erasure; request a portable copy of your data; object to or restrict certain processing; and withdraw consent at any time where we rely on it. If you're in the European Economic Area, you have equivalent rights under the EU GDPR. To use any of these rights, contact info@sowaan.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

10.Security

We apply reasonable technical and organizational measures, including access controls that keep one customer's data, messages, and session credentials from ever being reachable by another, and treating WhatsApp session credentials with the same care as a password. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

11.Children

The Service isn't directed at, and must not be used by, anyone under 18.

12.Changes to this policy

We may update this policy from time to time. We'll notify material changes the same way as changes to our Terms of Service.

13.Contact

Questions or requests about this policy or your data: info@sowaan.com — Sowaan Limited, 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom.