Privacy Policy
This policy explains how HelloClara.eu (Diego Clément Cayuela, entrepreneur individuel) ("we", "us") processes personal data when you visit this website and when you use, or write to a business that uses, our hosted omnichannel inbox for WhatsApp ("the Service").
1. Who we are
HelloClara.eu (Diego Clément Cayuela, entrepreneur individuel)
Registered address: 23 rue du Grand Fêtre, 05220 Le Monêtier-les-Bains, France
SIRET: 981 619 547 00012
Contact for anything in this policy: services@helloclara.eu
2. Our two roles
We act in two different roles, and the role decides who you should contact.
- We are the data controller for our own website, for our clients' account data, and for the connection between a client's WhatsApp Business Account and our Service.
- We are a data processor for the conversations between a client and its own customers. The client decides why those conversations are processed and is the controller of that data. We process it only on the client's instructions, under a data processing agreement. If you are a customer asking about your own conversation, contact the business you messaged first; we help that business answer your request.
3. What we process
| Whose data | What we process | Why |
|---|---|---|
| Visitors to this website | IP address, browser user-agent, the pages requested, and the time of the request, kept in standard server logs. This site sets no cookies and runs no analytics and no third-party scripts. | To serve the pages and to keep the site secure and available. |
| Our clients (businesses) | Business name, contact person, business email address, business phone number, the WhatsApp Business Account ID and business phone number ID, and the connection status of each channel. | To open the client's account and to connect and run the client's WhatsApp channel. |
| Customers who message a client on WhatsApp (we process this on the client's behalf) | The phone number and the WhatsApp profile name that WhatsApp sends with the message, the content of the messages (text, images, documents, audio, video), and message metadata such as the WhatsApp message ID, timestamps, and delivery and read status. Any notes or tags the client's staff add to the conversation. | So the client can read and answer its own customers on WhatsApp from the inbox. |
| Meta / WhatsApp connection data | The identifiers and the access credential that Meta returns when a client completes WhatsApp Embedded Signup, and the webhook subscriptions for that account. | To send and receive messages for that client and to keep the connection working. |
4. Legal basis
Under the EU GDPR (Article 6) we rely on:
- Performance of a contract (Art. 6(1)(b)) — to provide the Service to a client and to connect the client's WhatsApp channel.
- Legitimate interests (Art. 6(1)(f)) — to operate, secure, monitor and debug the Service and to prevent abuse. We balance these interests against your rights and freedoms.
- Legal obligation (Art. 6(1)(c)) — to keep accounting and tax records.
- Consent (Art. 6(1)(a)) — where a person has agreed to receive marketing or template messages from a client. The client collects that consent. Where we rely on consent, it can be withdrawn at any time.
For the conversations between a client and its customers, where we are a processor, the client's own legal basis applies. That is normally the contract between the client and its customer, or the customer's consent.
5. Retention
- Conversation data (messages, media, contact records, notes) is kept for 12 months from the last message in the conversation, then deleted, unless the client asks us to delete it earlier.
- Client account data and connection data is kept while the account is open and for 12 months after it closes.
- Server logs are kept for 30 days and then deleted.
6. Who we share it with (sub-processors)
We do not sell personal data. We share it only with the providers that run the Service:
| Provider | Role | What it receives |
|---|---|---|
| Meta Platforms Ireland Limited (WhatsApp Business Platform) | Messaging platform. The client's WhatsApp messages are carried by Meta. | The message content, the phone numbers of the sender and the business, and message metadata, as needed to deliver and status the messages. |
| Contabo GmbH (Germany) | Our hosting provider. It operates the servers and the network the Service runs on. | All data the Service stores, including conversations, as the infrastructure operator. |
| Groupe LWS SARL (LWS, France) | Our mailbox provider for the contact address above. | Only the content of messages you send to the contact address. |
A client's own staff can see that client's conversations. We keep each client's data separate from every other client's data.
7. Transfers outside the EEA
Our hosting is in the European Union. Meta Platforms Ireland Limited is in Ireland and uses group companies and service providers outside the EEA. Those transfers are covered by the EU Standard Contractual Clauses and by Meta's data processing terms. You can ask us for a copy of the safeguards we rely on at the contact address above.
8. Security
The Service runs over HTTPS. Access to the data is limited to the people and the systems that need it to run and support the Service, and each client's data is kept separate from other clients' data. We keep the systems updated and we log access.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- rectify data that is wrong or incomplete;
- erase your data (the right to be forgotten);
- portability — receive the data you gave us in a common, machine-readable format, or have it sent to another provider;
- object to processing based on our legitimate interests, and to direct marketing;
- restrict processing while a request is being looked at;
- withdraw consent at any time where we rely on consent.
To use any of these rights, email services@helloclara.eu. We answer within one month of receiving the request, as required by Article 12(3) GDPR. If a request is complex we may extend this by two further months and we will tell you why.
If your request is about a conversation with a business you messaged on WhatsApp, that business is the controller of the conversation; send the request to the business and we will help it answer. Our dedicated page for deleting conversation data is Data deletion.
10. Right to complain
If you are not satisfied with how we handle your data, you can complain to the French data protection authority:
Commission nationale de l'informatique et des libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr
You can also complain to the data protection authority of your own country of residence.
11. Changes to this policy
We update this policy when the Service or the law changes. The current version and its effective date are always on this page.
12. Contact
HelloClara.eu (Diego Clément Cayuela, entrepreneur individuel)
23 rue du Grand Fêtre, 05220 Le Monêtier-les-Bains, France
SIRET: 981 619 547 00012
Email: services@helloclara.eu