Privacy Policy

1. Who we are and how to contact us

Bimo Cloud operates from Ndudi Street, Itega, Nkuhungu, Dodoma Region, Tanzania, postal code 41117. In this policy, “Bimo”, “we”, “us” and “our” mean Bimo Cloud.

For privacy questions, access or deletion requests, email support@bimocloud.com with the subject “Privacy request”. You may also write to the address above. Rainhard Ngambiye is the founder and can be reached at rainhard@bimocloud.com for an unresolved enquiry.

This policy applies to bimocloud.com, Bimo-operated accounts and services, and integrations provided by Bimo. A service-specific notice or customer data-processing agreement may add details for a particular product. References to a feature apply only where that feature is enabled; they do not announce the availability of planned education, healthcare, housing or AI solutions.

2. Our role and your business’s role

Bimo determines how to handle its own website, account administration, billing, security and support information. For those activities, Bimo acts as a data controller.

When a customer uses Bimo to manage records or messages about its customers, staff or other people, the customer generally determines why those records are used. Bimo processes that information on the customer’s documented instructions to deliver the agreed service. The customer is responsible for an appropriate legal basis, accurate records, its own privacy notice and the permissions required for its activities.

A person whose information belongs to a customer’s business workspace may contact that business or contact Bimo for help identifying the correct route. We do not require an individual to hold a Bimo account before they can raise a privacy or deletion request.

3. Information we handle

Website and technical information: IP address, browser and device information, requested pages, timestamps, connection details and security or error logs. Our marketing website stores your privacy choice in browser storage. It remembers whether you have seen the introduction only if you allow optional preferences. It does not currently embed advertising pixels or visitor analytics tools.

Account and support information: names, email addresses, business contact details, account identifiers, roles, authentication information, support correspondence and records of account or integration changes.

Business workspace information: records supplied by a customer or its authorised users, such as customer and supplier contacts, sales, purchases, stock, invoices, accounting entries, staff records and attachments. The categories depend on the product and features actually used.

Billing information: subscription choices, invoices, payment references, transaction status and related business records. Payment providers handle the payment credentials entered into their own services. Do not send full payment card details, passwords or one-time codes to our support mailbox.

WhatsApp information, where enabled: business portfolio and WhatsApp Business Account identifiers; business phone numbers and profile details; authorised connection credentials and access tokens; message templates and parameters; sender and recipient phone numbers or WhatsApp identifiers; message content and attachments; conversation records; message identifiers; delivery and read status; timestamps; webhook events; and operational errors. Content may include location or contact details if a participant sends them.

4. Where information comes from

We receive information directly from you, from authorised users of a customer’s workspace, from people who contact a connected business, and from the technical operation of our services.

For a connected WhatsApp account, Meta and any messaging provider expressly selected for the connection supply account information, messages, status events and the permissions needed to operate that connection. Access is limited to the accounts and permissions authorised for the service.

5. Why we use information

We use information to provide the requested service; administer accounts and permissions; organise business records; send and receive authorised messages; manage templates and connections; respond to support requests; handle billing; troubleshoot problems; protect against abuse; and meet legal obligations.

Depending on the activity and applicable law, processing relies on providing an agreed service or requested pre-contractual assistance, consent where required, legal obligations, or a legitimate operational purpose where the law permits it. Customer workspace processing is also governed by the customer’s instructions and legal responsibilities.

Information must be relevant to the stated purpose. We do not sell personal information or use a customer’s WhatsApp Platform Data for unrelated advertising, another customer’s activities or an independent data-broker purpose. Accepting these terms or connecting an integration does not by itself give consent to unrelated marketing.

6. WhatsApp and Meta connections

The intended onboarding model lets an authorised business administrator connect the customer’s own Meta business portfolio, WhatsApp Business Account and business phone number through Meta’s authorisation process. The customer retains responsibility for its business assets and its payment method and billing arrangements with Meta. Any separate Bimo service charges are identified in the customer’s order or subscription terms.

Where enabled, Bimo uses the granted access to configure the connection, manage authorised templates and business assets, send or receive messages and process webhook notifications. Message content and media may be stored in the business workspace to provide conversation history, customer service and the workflow the business requests.

When acting for a customer, Bimo may use Meta Platform Data only for that customer’s authorised purpose, within Meta’s applicable terms. One customer’s information must not be made available to another customer. Disconnecting a WhatsApp connection ends its authorised use by Bimo; it is separate from a request to erase existing records.

The connected business must provide its recipients with appropriate notice, obtain the required messaging opt-in and respect requests to stop messaging. You can ask the business to stop contacting you, or contact Bimo about a connection we operate. Blocking a number in WhatsApp does not automatically delete records already held by the business.

Meta operates the WhatsApp Business Platform under its own terms and privacy information. This policy governs Bimo’s handling of information; it does not replace Meta’s policies or mean that Meta has approved, endorsed or certified Bimo.

7. Automation and AI

Rule-based notifications or automated replies do not necessarily use AI. A customer’s authorisation to connect WhatsApp does not authorise unrelated AI training or undisclosed disclosure of message content to an AI provider.

Before an optional AI feature processes personal information, its service notice must explain the purpose, information used, relevant provider and retention arrangements, and any consent or customer instruction needed. Meta Platform Data remains subject to Meta’s purpose and sharing restrictions. Bimo does not grant an AI provider permission to use that data for the provider’s own general-purpose model training.

A privacy policy is not a substitute for human oversight. Where automation is used, the business remains responsible for its communications and for decisions affecting people, including compliance with applicable rights relating to automated decisions.

8. Sharing and service providers

We share information only where needed to deliver the authorised service, follow lawful customer instructions, protect the service or comply with law. Recipients can include authorised people within the relevant business, hosting and storage providers, email and support providers, payment processors, and Meta or a messaging provider used for an enabled connection.

Netlify hosts the Bimo Cloud marketing website and processes the technical information needed to deliver it. The website’s anonymous plan catalogue request does not include customer workspace records or account credentials.

Service providers handling information on our behalf must be subject to appropriate confidentiality, purpose restrictions, security and data-handling obligations. Meta Platform Data may be shared with a provider only as permitted by Meta’s terms and the applicable customer instructions. Ask support@bimocloud.com for the providers relevant to your service before connecting it.

We may disclose information where a valid legal obligation requires it, with appropriate limits. If an ownership or service-provider change affects personal information, applicable safeguards and notice obligations still apply. We do not make customer messages public merely because a business uses Bimo.

9. International processing

Hosting, communications and messaging services may process information outside Tanzania, including through Netlify and Meta. The relevant locations depend on the service and provider. Information is not represented as stored exclusively in Tanzania.

International transfers must satisfy Tanzania’s applicable data-protection requirements, including required assessments, safeguards and any permit or authorisation required by the Personal Data Protection Commission. A customer’s agreement to use the service does not remove those requirements. Service-specific processing locations and transfer arrangements must be identified before an integration is activated.

10. Security

Security measures must be appropriate to the information and service. These include protected HTTPS connections, authenticated access, permissions, separation of customer workspaces and restricted handling of connection credentials. Access tokens are sensitive credentials, not information to include in support emails or public logs.

No online service can guarantee absolute security. WhatsApp’s transport protections do not mean that messages stored in a Bimo business workspace are end-to-end encrypted against the business or Bimo.

Report a suspected security or privacy incident to support@bimocloud.com. We assess reports, take appropriate action and make legally required notifications to affected parties or authorities.

11. Retention and deletion

Information is retained only for as long as needed for its identified purpose, the applicable customer instructions and relevant legal obligations. Factors include an active account, the requested conversation history, unresolved support work, financial-record requirements and the need for limited security evidence. Different record categories can have different retention periods.

For Meta Platform Data, we apply Meta’s additional deletion requirements: stop unnecessary processing and remove data promptly when required by Meta, when a valid user or customer request requires deletion, when the relevant service ends, or when there is no permitted purpose to keep it. If law requires retention, only the necessary information is retained for that obligation and the legal reason is documented. A general commercial preference is not a legal retention exception.

Deletion may require action in live systems, attachments, replicas and backup processes. The response to a request will explain its scope, any required retained records and the applicable completion arrangements. We do not promise an immediate purge of every provider backup or an automatic deletion period that is not part of the agreed service.

Revoking Meta permissions, disconnecting WhatsApp, cancelling a subscription and deleting stored information are different actions. The data-deletion instructions explain how to request removal of information held by Bimo.

12. Your privacy rights

Subject to applicable law, you may ask whether we process information about you, request access, correct inaccurate information, request blocking or erasure where appropriate, object to or restrict certain processing, withdraw consent where consent is the basis, and raise a concern about direct marketing or an automated decision. Legal conditions and exceptions can apply.

Email support@bimocloud.com with the request and enough context to identify the relevant information. We may need proportionate verification of identity or authority to protect you and other people. Do not send identity documents, passwords or authentication codes unless a necessary and secure verification method has been agreed.

We handle requests without unnecessary delay and within applicable legal requirements. We explain any lawful limitation or refusal and the next steps available. Where a customer controls the records, we help route the request and support the customer’s lawful instructions.

13. Children and sensitive information

Bimo’s business account and administration services are intended for authorised adults. A customer that lawfully processes information about children or sensitive records must meet the additional legal requirements and agree appropriate service safeguards.

Do not use an ordinary WhatsApp connection to send full payment-card or bank-account numbers, identity-document numbers, passwords, one-time codes, or sensitive health information that requires heightened safeguards. A planned education or healthcare product does not itself authorise those records to be processed through WhatsApp.

14. Cookies and browser storage

Our marketing site uses required browser storage to remember your privacy choice for up to 180 days. Optional introduction storage is off until you allow it. You can accept or reject optional preferences from the first-visit notice, and change or withdraw that permission through Cookie settings at any time. Rejecting or withdrawing removes the introduction preference from this browser without restricting access to the website.

These settings affect this marketing website and browser, not a Bimo account or stored business records. Account services can use essential authentication and security storage, as explained in their own notices. If new tracking purposes or third-party tools are introduced, this notice and the settings will be updated, and any consent required for the new purpose will be requested before activation.

15. Questions and complaints

Contact support@bimocloud.com if you believe information has been handled incorrectly. You can also contact Tanzania’s Personal Data Protection Commission directly. You do not have to resolve a complaint with Bimo before contacting a regulator where the law gives you that right.

16. Changes to this policy

This policy is effective from 7 October 2026. We update it when our services, providers or legal obligations change. Material changes require appropriate notice, and new processing that requires consent is not authorised merely by updating this page. The latest date appears with this policy.