Privacy Policy

1. Who We Are

The Rook is operated by Kabo Labs Software & Consultancy Limited, a company registered in Zambia. We are responsible for the personal data described in this policy. You can reach us at support@kabo-labs.com.

The Rook is a platform that businesses use to run their WhatsApp conversations with their own customers. When a business uses The Rook, we process its customers' messages and contact details on that business's behalf and on its instructions. The business decides why it talks to its customers; we provide the tools.

2. Information We Collect

From people who use The Rook (business owners and their team members): name, email address, workspace and billing details, and log information about how the service is used.

From a business's WhatsApp customers, received through the WhatsApp Business Platform: phone number and WhatsApp profile name, message content and media, message timestamps and identifiers, delivery and read status, form submissions and orders placed in the chat. When a conversation starts from a Click-to-WhatsApp ad, Meta also sends an ad click identifier with the first message.

From Meta about a connected WhatsApp Business Account: its phone numbers, message templates, WhatsApp Flows, business profile, quality rating and messaging limits, and the access token that lets us act for that account.

3. How We Use Information

We use this information only to provide, secure and support The Rook: to deliver and display messages, to run the inbox, automations and AI assistant a business has set up, to manage its templates, forms, catalog and orders, to bill for the service, and to prevent abuse.

We do not sell personal data. We do not use a business's customer data to advertise to anyone, and we do not combine one business's customer data with another's. The only data we send to Meta for advertising purposes is described in section 5, and only when the business turns it on.

4. Service Providers

We share data only with the providers below, only as far as each needs it to do its job for us, and under terms that require them to protect it:

• Meta Platforms (WhatsApp Business Platform): sends and receives WhatsApp messages and manages the business's WhatsApp assets.
• Infratel (Zambia): hosts our servers and databases. All stored data, including messages, media and contacts, is held here. Access tokens are encrypted at rest.
• OpenAI and Google (Gemini API): generate replies for a business's AI assistant. These receive message content and conversation context only when the business enables the AI assistant and selects that provider, and only to produce the reply. These providers may process data outside Zambia.
• Resend: delivers our emails to people who use The Rook, such as account, billing and template or form status notices. It does not receive the content of customer conversations.

We may also disclose information where the law requires it, as described in section 8.

5. Ad Conversion Tracking

A business that advertises with Click-to-WhatsApp ads can choose to report the outcomes of those conversations back to Meta, so it can measure and improve its ads. This is off until a business owner or admin turns it on, and they choose which outcomes count: an order placed, an order paid, or a form submitted.

Each report contains the event name, the order value and currency, the business's WhatsApp Business Account ID, and the ad click identifier Meta itself issued. We never send phone numbers, names, message content or hashed customer identifiers. Conversations that did not start from an ad are never reported, and neither is anyone who has opted out or asked for their data to be deleted.

6. WhatsApp Messaging and Your Choices

The Rook uses the WhatsApp Business Platform (provided by Meta Platforms, Inc.). Businesses send messages through The Rook to their own customers, and The Rook may send service messages to its own users.

Stopping messages. Reply STOP (or UNSUBSCRIBE) to a business on WhatsApp, tap a "Stop promotions" button, or turn off marketing messages from that business in WhatsApp itself. The business can then no longer start a conversation with you until you reply START. You can still write to the business, and it can answer you.

Deleting your conversation. Reply delete my data to the business on WhatsApp and confirm with DELETE to have your conversation and details with that business erased.

To stop messages from every business on The Rook at once, email support@kabo-labs.com. To also have your data deleted by every business, follow our Data Deletion Instructions.

We keep WhatsApp records only as long as the business uses The Rook and as needed to resolve disputes and meet legal obligations. Meta's own processing is covered by WhatsApp's terms and privacy policy.

7. Information Security

Data is encrypted in transit with TLS. Access tokens and other credentials are encrypted at rest and never shown back in the product. Each business can only see and act on its own workspace, and access within a workspace depends on the team member's role.

8. Requests From Public Authorities

We disclose personal data to a public authority only when the law requires it. We review every request to confirm that it has a valid legal basis and comes from an authority with jurisdiction. We challenge requests we consider unlawful, overbroad or unclear, and we disclose only the minimum data the request lawfully requires. Where the law allows, we tell the affected business before disclosing. We keep a record of every request, our response, the legal basis relied on and who handled it.

9. Data Deletion Requests

You may request deletion of your personal data at any time by emailing support@kabo-labs.com with the subject line "Data Deletion Request" and enough information for us to verify your account. If you are a customer of a business that uses The Rook, you can also use the WhatsApp option in section 6.

After verification, we will process your request within 30 days and delete or anonymize eligible data, unless we must retain specific records for legal, tax, fraud-prevention, or security reasons.

Our Data Deletion Instructions page also explains how to ask for deletion across every business on The Rook at once using your WhatsApp number. If you contact us through our contact form instead of email, include the same subject line and account details so we can route your request correctly.

10. Changes

We may change this policy from time to time. We will not reduce your rights under it without your explicit consent. We will post any changes on this page and, if they are significant, give more prominent notice.