SayHala Privacy Policy
1 Who we are and what this policy covers
SayHala is operated by ENGAGE MENA FZ LLC, a company established in Abu Dhabi, United Arab Emirates ("ENGAGE MENA", "SayHala", "we", "us" or "our").
Registered address: P.O. Box 769664, Abu Dhabi, United Arab Emirates
Privacy contact: [email protected]
General support: [email protected]
This policy explains how we handle personal information when you visit sayhala.com, create or manage an account or public profile, send or receive enquiries, use booking-request features, interact with our business WhatsApp channel, or contact us. It applies to creators, businesses, personal-profile users, enquirers and visitors. It does not replace the privacy policies of linked shops, social platforms, booking providers or WhatsApp.
ENGAGE MENA is the controller for account administration, platform security, public-profile hosting, enquiry delivery and other purposes described here. A creator or business receiving an enquiry or booking request is responsible for its own subsequent use of that information. If we process information solely on a business customer's documented instructions, our role and obligations will be addressed in a separate data-processing agreement where required. An enquiry submitted through SayHala is not automatically an agency enquiry to ENGAGE MENA.
2 What privacy-first communication means
Your private account phone number is not included in your public profile or automatically disclosed to an enquirer. SayHala can deliver service notifications through its business WhatsApp account, and users can access the related enquiry through SayHala. This is different from a direct WhatsApp conversation between two personal phone numbers.
Information you intentionally publish, put in a message, or include in an external link may disclose your contact details. Choosing to share contact details or to open a direct-contact conversation can reveal your number to the other party. We will identify such a sharing action and ask for a separate confirmation before using a feature that discloses the private number held by SayHala. Accepting an enquiry alone does not authorize contact-detail disclosure.
Privacy-first does not mean anonymous, invisible to SayHala, or end-to-end encrypted between users of SayHala. Our systems process enquiry content to provide the service. Authorized personnel and contracted service providers may access information where needed for support, security, abuse investigations, legal compliance or service operation. We do not routinely have agency staff manually approve enquiries before delivery.
WhatsApp has its own data-handling and encryption arrangements. Those arrangements do not prevent information delivered to our business account from being processed by our systems. Do not send passwords, full payment-card details, identity-document numbers, medical records or other highly sensitive information through an enquiry.
3 Information we collect
| Category | Examples and sources |
|---|---|
| Account and contact information | Name, handle, phone number, country code, optional recovery email, profile type, language preferences, account status and login-verification events, supplied by you or generated by our systems. |
| Public profile content | Photo, biography, categories, business information, languages, social links, featured content, product or shop links and booking information you choose to publish. |
| Enquiry and booking information | Sender name, selected recipient, enquiry text, requested service, date/time, adult contact details, responses, acceptance/decline status and booking status. We collect this from participants and their interactions. |
| Messaging information | WhatsApp identifiers, delivery status, message timestamps, button selections, opt-in/opt-out records and messages sent to our business account, received through our messaging providers. |
| Technical and usage information | IP address, browser/device type, approximate location inferred from IP, visited pages, link interactions, request logs, error information and security events collected when the service is used. |
| Support and verification requests | Correspondence and information supplied when requesting support, reporting abuse or applying for profile verification. If a verification process requires identity evidence, we provide a separate collection notice before asking for it. |
| Consent and preference records | Terms acceptance, notification choices, optional-cookie preferences and any explicit authorization to disclose contact details. |
We do not request access to your entire phone address book to operate the service. We do not require social-account passwords. Linking a public social URL is different from authorizing account access. If an account-connection feature is introduced, its permission scope will be shown before connection.
An adult may request a family activity or similar booking. Please provide the adult's details and avoid including a child's name, age, photo or other identifying details unless a separately explained and lawful collection process is provided. We do not offer child accounts.
4 How we use information and the grounds for doing so
We use information only for specified purposes. The legal ground depends on the applicable law and the particular processing. Where consent is required by UAE, Saudi or other applicable law, we obtain it; a reference to legitimate interests below is not a substitute for required consent.
| Purpose | Information used | Grounds where recognized and applicable |
|---|---|---|
| Register and authenticate accounts; provide profile and enquiry features | Account details, profile content, login events and enquiry records | Necessary to provide the requested service or perform our contract; consent where required. |
| Deliver requested WhatsApp notices, acknowledgements and booking updates | Contact details, message/status records and preference records | Requested service and recorded communication permission; consent where required. |
| Publish a profile at your direction | The information selected for publication | Requested service and publication consent where required. |
| Protect the service and enforce fair-use limits | Technical logs, identifiers, enquiry content relevant to abuse and reports | Legal obligations and permitted legitimate interests in security and fraud prevention; other lawful grounds where required. |
| Handle support, complaints and disputes | Correspondence, account and enquiry records relevant to the issue | Requested assistance, contract performance, legal obligations and permitted legitimate interests. |
| Measure and improve reliability and usability | Usage events and technical information | Permitted legitimate interests for limited operational measurement; consent for optional tracking where required. |
| Send optional promotions | Contact details and marketing preferences | Separate opt-in consent where required; subject to applicable marketing laws. |
| Meet legal requirements and protect legal rights | Relevant records | Legal obligations, establishing or defending claims, or another applicable lawful ground. |
Where we rely on legitimate interests, we assess the purpose, necessity and impact on individuals. You can ask about this assessment and object where the law provides that right. We do not use a general interest in growth as permission to read private enquiries for agency prospecting.
Providing required account details is necessary to register and receive requested notifications. You may omit optional profile fields. If you withdraw a permission required for a particular feature, that feature may become unavailable, while other features may remain usable.
5 Public profiles, recipients and contact sharing
Public profiles can be seen by anyone with the link and may be indexed by search engines, copied, screenshotted or cached. Publish only information you are comfortable making public. Removing content from SayHala does not immediately remove copies held by others or search engines.
When you send an enquiry or booking request, we make the information you submit available to the intended recipient. A sender's number remains private unless the sender puts it in the content or authorizes its disclosure. A recipient's private number also remains private unless the recipient authorizes disclosure or publishes it themselves. The interface will identify what information is being sent and to whom.
If either party chooses to share their own contact details, the other party may retain them independently. Withdrawal prevents future sharing by SayHala; it cannot undo information already delivered. We cannot control an independent recipient's screenshots, exports, response behaviour or off-platform communications.
If a recipient is also an ENGAGE MENA client, that does not automatically permit us to reuse their private enquiries for unrelated agency sales or campaigns. Any separate agency service or marketing purpose requires its own appropriate notice and lawful basis.
6 WhatsApp and communication choices
Before enabling WhatsApp notifications, we ask you to agree to the identified service-message categories, such as enquiry alerts, booking updates or security codes. Permission to receive an authentication code is not permission to receive advertising. Marketing choices are separate and optional.
You can change preferences using the controls provided in the service, contact support, or use the opt-out instructions included in messages. We honour requests to stop WhatsApp notifications. You can also block our business account in WhatsApp. Blocking or opting out can prevent delivery of notifications or login codes; it does not by itself delete your SayHala account. Use an available recovery route or contact support if this prevents account access.
Our messaging integration is subject to WhatsApp's terms, template approvals and delivery rules. We do not use this policy as authorization to forward one customer's WhatsApp chat to another customer in breach of those rules. Private enquiry content can be accessed in SayHala; WhatsApp notification content is limited to the information permitted for the relevant workflow.
WhatsApp and Meta process some information under their own terms and privacy notices. Our actual contractual messaging provider and any intermediary are listed in Section 8. See WhatsApp's Privacy Policy (https://www.whatsapp.com/legal/privacy-policy) for its independent practices.
7 Filtering, automation and artificial intelligence
We use automated operational controls to route notifications, enforce sending limits, detect suspicious activity and block known abuse patterns. These controls can make mistakes. They do not guarantee that every enquiry is useful or that spam never reaches a recipient. You may report an incorrect block or restriction to support and request review.
The initial service does not use third-party generative AI to read private enquiries, generate profiles or train models on user content. If such features are introduced, we will first explain the provider, information sent, purpose, applicable choices and any material automated decision-making. We will not silently introduce a new AI use inconsistent with this policy.
If a decision with legal or similarly significant effects is made solely by automation and applicable law gives you safeguards, we provide the required explanation, opportunity to express your view and human review or other required protection.
8 Who receives information
We disclose information only as needed for the following purposes:
- Intended enquiry or booking recipients: the information you submit for that recipient, subject to contact-sharing controls.
- Service providers: hosting, storage, authentication, WhatsApp delivery, monitoring and support providers operating under appropriate contractual restrictions. Their roles and processing locations must be confirmed in the provider list below.
- Authorized staff and contractors: access necessary for assigned operational, support, safety or compliance tasks. This includes developers only where their access is needed and authorized.
- Legal and safety recipients: authorities, courts, advisers or relevant parties where disclosure is legally required or lawfully necessary to address fraud, threats, claims or protection of rights.
- Corporate transactions: advisers or a successor in a merger, acquisition or restructuring, subject to lawful confidentiality arrangements and any notice or other safeguards required by law.
- Other recipients you authorize: for example, an express instruction to share your number.
We do not sell personal information, rent contact lists, or share personal information for cross-context behavioural advertising. We do not use private enquiries to build advertising audiences. A future change to those practices would require advance notice and any legally required opt-out or consent before it takes effect.
Service-provider and location list
| Service | Provider / contracting entity | Processing location and role |
|---|---|---|
| Hosting, database, storage and backups | Google Cloud (Cloud Run application hosting, Cloud SQL for PostgreSQL database, Pub/Sub and Cloud Tasks queues, Secret Manager). Cloudflare (R2 media storage, content delivery and network security). Upstash (short-lived cache for one-time sign-in code checks and rate-limit counters). | Service providers (processors) acting on our instructions. Google Cloud: Doha, Qatar (region me-central1) for the application, database, queues and secrets; database backups in Google Cloud’s European Union multi-region. Cloudflare R2: Eastern Europe (location EEUR), delivered through Cloudflare’s global network. Upstash: Mumbai, India (AWS ap-south-1). |
| WhatsApp Business Platform and any intermediary | Meta, through the WhatsApp Business Platform (Cloud API), used directly by SayHala. No business solution provider (BSP) or other intermediary is used. | Meta hosts the Cloud API and processes message content and delivery information to send and receive our WhatsApp messages, as our service provider (processor). No local-storage region is selected, so Meta’s standard Cloud API data storage applies. WhatsApp and Meta also process some information as independent controllers under their own terms (see Section 6). |
| Authentication / email / support | Google Cloud Identity Platform (account sign-in). Resend (transactional email such as sign-in codes and service notices). No third-party support or help-desk tool is used. | Service providers (processors) acting on our instructions. Identity Platform: Google Cloud global service (not tied to one region). Resend: United States (AWS us-east-1). |
| Operational monitoring / analytics | Google Cloud Logging and Cloud Monitoring (service and security logs, error reports and uptime alerts). Cloudflare (network security and traffic metrics). Limited first-party usage counts, without cookies, are kept in our own database. No third-party analytics, advertising pixels or session-recording tools are used. | Service providers (processors) acting on our instructions. Google Cloud Logging and Monitoring: Google Cloud global storage (not tied to one region). Cloudflare: global network. First-party usage counts: Doha, Qatar, with the database above. |
9 International processing and transfers
ENGAGE MENA is established in the UAE. Information may be processed in other countries only as identified in the provider list and the arrangements applicable to the service. Countries can have different privacy laws and government-access rules.
When applicable law requires a transfer safeguard, we use an appropriate lawful mechanism before the transfer takes place. Depending on the relevant law and route, this may include an adequacy decision, approved contractual safeguards, the EU standard contractual clauses, the UK international data transfer agreement or addendum, or a permitted exception. Where required, we assess transfer risks and implement supplementary safeguards.
For information subject to Saudi data-protection law, transfers outside Saudi Arabia must meet the applicable Saudi transfer requirements, including assessments and safeguards where required. Acceptance of our Terms is not a blanket waiver of transfer protections or permission to use any hosting location.
You may contact us for information about the safeguards applicable to your information, including a copy or summary where legally required, with confidential details appropriately redacted.
11 Retention and deletion
We retain information only for as long as needed for the purposes described here, legal obligations, security and legitimate dispute handling. Information is then deleted or irreversibly anonymized, except where a lawful retention obligation or properly limited legal hold applies.
| Records | Retention period or applicable criteria |
|---|---|
| Account and private contact details | While the account remains active. Following account closure, we delete account and private contact details from active systems within 30 days, except for limited records that must be retained to comply with legal obligations, resolve disputes or address fraud and security incidents. Any retained records are restricted to those purposes and deleted when no longer needed. Backup copies are removed according to the backup retention period stated below. |
| Public profile content | Until you remove the content or close your account. We remove it from public view promptly and delete it from active systems within 30 days, subject to lawful retention exceptions. Backup copies follow the backup retention period stated below. Copies held by third parties, including search-engine caches, are outside our control. |
| Enquiry, response and booking records | Enquiry, response and booking-request records are retained for up to 180 days after closure or, if still open, after the last activity. You may request earlier deletion by contacting [email protected]. We process deletion requests in accordance with applicable law, subject to limited retention needed for legal obligations, disputes or fraud and security investigations. Backup copies follow the backup retention period stated below. |
| Login codes and security tokens | One-time login codes expire after five minutes and are invalidated immediately after successful use. Session and recovery tokens expire according to their purpose and are revoked when no longer valid, including on logout or account closure where applicable. Raw login codes and token secrets are not retained in application logs. Limited verification-event logs follow the security-log retention period. |
| Security and operational logs | Up to 90 days, unless longer retention is necessary for a specific security investigation or legal obligation. Extended retention is reviewed periodically. |
| Support, abuse and verification records | Up to 12 months after resolution, unless longer retention is necessary for legal obligations or ongoing investigations. Identity documents, if collected, follow a separately disclosed, shorter retention period. |
| Consent and opt-out evidence | For as long as needed to demonstrate consent and meet applicable legal requirements. Minimal opt-out records are retained while needed to prevent unwanted contact. |
| Backups | Backup copies are deleted or overwritten within 90 days. If restored, previously approved deletion requests are reapplied. |
Deleting information from SayHala does not delete a message already delivered to a recipient's device, WhatsApp records controlled by that provider, or records independently held by an enquiry recipient. Those parties' retention practices and applicable rights apply separately.
12 Security
We use technical and organizational measures appropriate to the sensitivity and risks of the information, including access restrictions and safeguards for service providers. No online service can promise absolute security or that all disclosures or misuse will be prevented.
If a personal-data breach occurs, we investigate, take appropriate containment and remediation steps, and notify regulators and affected individuals when and within the time limits required by applicable law. You can report a suspected incident to our privacy contact. Never send an OTP or password in an ordinary support message.
13 Your rights and how to exercise them
Depending on the applicable law, you may have rights to receive information about processing; access or obtain a copy of personal information; correct inaccurate information; delete information; restrict processing; object to certain processing; receive portable information; withdraw consent; and challenge qualifying automated decisions. You may also have rights to opt out of sale, sharing, targeted advertising or certain profiling where applicable.
Contact [email protected], identifying your request and the account or interaction concerned. You need not create an account to make a request. We may request proportionate information to verify identity and authority before disclosing private records. An authorized agent may act where permitted, subject to appropriate proof of authority. We do not request unnecessary identity documents for routine requests.
We respond within the period required by the applicable law. If a permitted extension or exception applies, we explain it. Requests are generally free; any fee or refusal will be limited to situations permitted by law and explained to you. If a request is refused, we explain any applicable appeal or complaint route. You will not be unlawfully penalized for exercising your rights.
Withdrawal of consent does not affect processing lawfully carried out before withdrawal. A right to deletion may be limited by legal retention duties or the need to establish or defend claims. If a recipient independently controls information received from you, you may also need to contact that recipient; we can help identify the relevant recipient where appropriate.
14 Regional rights
UAE: If UAE personal-data law applies, you may exercise the applicable information, correction, deletion, restriction and other rights through the contact above and complain to the competent authority. The applicable UAE regime depends on our actual licensing jurisdiction and the processing concerned.
Saudi Arabia: If Saudi personal-data law applies, you may exercise the rights provided under that law, including being informed, access, obtaining a copy, correction and destruction subject to legal conditions, and withdrawal of consent where applicable. You may complain to the Saudi Data and AI Authority or other competent authority through its official channels.
EEA and UK: Where the GDPR or UK GDPR applies to our processing of your personal information, you may exercise the rights described in Section 13 and lodge a complaint with your local supervisory authority. For privacy questions or requests, contact [email protected].
United States: Where an applicable state privacy law covers our processing, residents have the rights and request mechanisms described above, including any legally required appeal rights. We do not sell personal information or share it for cross-context behavioural advertising. We do not use sensitive information to infer characteristics for advertising. California residents may request the categories and specific information collected, its sources, purposes and recipients, and correction or deletion, to the extent provided by applicable law. Applicable statutory thresholds and exemptions determine whether particular state-law obligations apply.
Other locations: Nothing in this policy removes mandatory privacy rights provided by the laws applicable to you. Tell us your location when it is relevant to a rights request so we can apply the correct process.
15 Age restrictions
SayHala accounts, enquiries and booking requests are for people aged at least 18, or the higher age required to enter a binding agreement in their location. We do not knowingly collect personal information from children to provide these features. If you believe a child has supplied information, contact us so we can investigate and remove it where appropriate. This restriction does not authorize adults to publish a child's personal information without a lawful basis.
16 Changes and contact
We may update this policy to reflect changes to our service, providers or legal obligations. We publish the new version at this URL and update the date. We give additional notice of material changes where required and obtain new consent before processing for a new purpose where the law requires it. Continued use is not treated as consent where affirmative consent is legally required.
For privacy questions or requests, contact [email protected] or write to our registered address above.