Privacy policy

GuulHub ("GuulHub", "we", "us") provides business software: customer messaging on WhatsApp, SMS and email, customer records, bookings, payments, stock, finance, staff tools and, for healthcare providers, patient records. This policy covers the website guulhub.com and the GuulHub platform, including our web app and the booking pages, receipts and messages it produces for the businesses that use it.

We play two different roles, and this policy is clear about which applies:

• Controller. We decide how and why personal information is used for visitors to our website, people who ask us for a demo or contact us, and the businesses that sign up for GuulHub and the staff who use it. We are responsible for that information.
• Processor. When a business (our "customer") uses GuulHub to manage its own customers, patients, guests or members, that business is the controller of their information. We process it only on the business's documented instructions, under a data processing agreement, and never for our own purposes.

If you are a customer or patient of a business that uses GuulHub, see section 13.

Visitors to guulhub.com. Our website is served by Cloudflare, which processes technical information such as your IP address, browser type and the pages requested, to deliver the site and protect it against attacks. We do not add analytics, advertising pixels or tracking scripts.

Demo requests and enquiries. When you use our demo form, WhatsApp us, email us or book a call, we receive what you give us: your name, business name, industry, country, WhatsApp or phone number, email address, team size, what you are interested in and any message. Our demo form does not store anything on our website: it opens WhatsApp or your email app with your details written in, and nothing is sent until you press send. If you book a call, Calendly collects the details on its booking form.

Businesses and their staff (account data). When a business uses GuulHub we hold the business's details, and for each staff member their name, email address, phone number, role and permissions, sign-in and security information (such as password hashes and two-step verification settings), and records of activity in the app, including audit logs.

Billing and commercial information. Contract and plan details, invoices, payment records and our correspondence with the business.

Information businesses put into GuulHub (customer data). Depending on what a business uses, this can include its customers' names, phone numbers, email addresses and other contact channels, conversations on WhatsApp, SMS and email, bookings, orders, quotes, invoices and payment records, loyalty and membership details, notes and tags, and, for healthcare providers, patient records (see section 5). We process customer data as a processor.

Support. When you contact our support team, we keep the conversation and any information you share to help you.

We only use personal information where we have a lawful reason. Where GuulHub is the controller, those reasons are:

Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time (section 12). Where GuulHub is a processor, the business that controls the data decides its purposes and is responsible for having a lawful basis.

Clinics, hospitals and pharmacies can use GuulHub to keep patient records: visit notes, documents, photographs, prescriptions and admission records. This is sensitive (special category) information, processed on the healthcare provider's instructions for the provision of healthcare. We protect it with measures beyond those for other data:

• Patient records are encrypted and stored separately from other files, in private storage with no public access.
• Clinical notes are kept exactly as written. Corrections are added as new entries with the author, time and reason; nothing is silently overwritten.
• Only staff whose role allows it can open a record, and every view as well as every change is logged.
• Clinical information is never used to build marketing messages or audiences.
• Our AI features never interpret clinical information, suggest a diagnosis or treatment, or calculate doses.

We do not ask for sensitive information from website visitors, and we ask you not to include health details in a demo request.

GuulHub includes AI features that help staff draft replies and messages, summarise a customer's history and suggest who to follow up with. To do this, relevant text from the business's account is sent to our AI provider, Anthropic, for processing.

• Neither we nor our AI provider use customer data to train AI models.
• AI suggestions are drafts. A person reviews and decides what is sent; the AI does not send messages on its own.
• The AI makes no decisions that have legal or similarly significant effects on anyone.
• We record which version of our AI instructions produced each suggestion, so suggestions can be reviewed.

Businesses use GuulHub to send WhatsApp messages, SMS and emails to their customers, such as confirmations, reminders, receipts and offers. The business decides what to send and to whom, and is responsible for its right to do so. GuulHub enforces safeguards on every message, whoever sends it:

• Anyone can stop marketing messages from a business at any time, on any channel, by replying STOP (or JOOJI in Somali). Their choice is respected across that business's messages on that channel.
• Marketing messages are limited in how often they can reach the same person.
• WhatsApp's rules on when and how businesses may message people are applied automatically.

We never sell personal information or share it for advertising. We share it only with service providers who help us run GuulHub, under contracts that require them to protect it and use it only for the service they provide to us:

We may also disclose information where required by law or a valid order of a competent authority, to protect the rights, safety and security of our users or the public, or as part of a merger or sale of our business, in which case this policy continues to protect it. Businesses using GuulHub receive notice before we add or replace a service provider that processes their customer data.

Some of our service providers are in countries other than yours, including the United States. When we transfer personal information across borders, we use safeguards required by the applicable law, such as standard contractual clauses. You can ask us for details of the safeguards for a transfer that concerns you.

• Demo requests and enquiries: up to 24 months after our last contact, unless you become a customer.
• Business account and billing data: for as long as the account is active, then as long as needed for legal, tax and accounting obligations.
• Customer data: for as long as the business keeps its account and chooses to keep it. When a business leaves, it can export its data, and we delete it within 90 days unless the law requires us to keep it longer.
• Patient records: for the period set by the healthcare provider in line with health law, which is commonly at least ten years.
• Security and audit logs: for as long as needed to protect the service and meet legal obligations.

• Each business's data is isolated from every other business's at every step of the system.
• Information is encrypted in transit, and sensitive items such as patient records, messaging credentials and payment credentials are also encrypted at rest.
• Access is based on roles, and sensitive actions are logged.
• Regular backups, kept separately from the live system.
• Staff access to customer data only where needed to provide support or keep the service running, under confidentiality obligations.

No system is perfectly secure. If a personal data breach affects your information, we will notify the relevant authority and, where required, you, without undue delay. Where we act as a processor, we notify the affected business promptly so it can meet its own obligations.

Depending on where you live, you have the right to:

• Be informed about how your personal information is used.
• Access the personal information we hold about you and receive a copy.
• Have inaccurate or incomplete information corrected.
• Have your information deleted, where there is no good reason for us to keep it.
• Restrict or object to how we use it, including objecting at any time to direct marketing.
• Receive your information in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to decisions based solely on automated processing that significantly affect you.

To exercise any of these rights, email us at the address in section 19. We will respond within one month, and may need to confirm your identity first. There is no charge, unless a request is clearly unfounded or excessive.

You also have the right to complain to a data protection authority, such as the Data Protection Authority of Somalia, the Office of the Data Protection Commissioner in Kenya, or the supervisory authority where you live or work if you are in the European Union or the United Kingdom. We would be grateful for the chance to resolve your concern first.

If a shop, restaurant, salon, clinic or other business that uses GuulHub holds your information, that business is responsible for it and decides how it is used. Please contact the business directly to access, correct or delete your information, or to ask how it is used.

If you contact us instead, we will pass your request to the business and help it respond. To stop marketing messages from a business, reply STOP (or JOOJI) to any of its messages.

This website sets no cookies of its own and uses no analytics or advertising trackers. Cloudflare, which delivers the site, may use strictly necessary security measures to protect it from attacks.

Our booking calendar is provided by Calendly and loaded from Calendly's site. Calendly may use cookies, and asks for your consent where the law requires it.

The GuulHub app uses one strictly necessary cookie to keep you signed in securely. It is not used for tracking or advertising.

Our website and GuulHub accounts are for businesses and adults. We do not knowingly collect information from children through our website. Businesses that serve children, such as schools or clinics, are responsible for obtaining any consent the law requires from a parent or guardian.

We do not make decisions about people based solely on automated processing that produce legal or similarly significant effects. Features that suggest who to follow up with, or draft a message, support staff; a person decides what happens.

Businesses that use GuulHub enter into our data processing agreement. It sets out our instructions, confidentiality, security measures, service providers, breach notification, assistance with rights requests, international transfers, and the return and deletion of data when the contract ends. Healthcare providers receive the additional terms that apply to patient records. To request a copy, email us.

We will update this policy when our practices or the law change, and change the date at the top. If a change is significant, we will tell businesses that use GuulHub before it takes effect.

For any question about privacy or this policy, or to exercise your rights, contact our privacy team: