OML Send

Privacy and your data

OML Send is run by OML LTD, a company registered in Mauritius. For your own account details, below, OML LTD is the controller. The lists and files you send hold your customers' personal data, so the service is built to keep as little as possible, for as short a time as possible. For that data you are the controller and we are your processor (the terms, section 5).

Your campaigns: deleted, not kept

  • A campaign's people, numbers, names, IDs, texts, files and its per-person report are deleted 24 hours after it ends (the default), as soon as it ends, or at once when you press Wipe now. A campaign that is never started is deleted 7 days after its last change, and one that is paused and not resumed 7 days after it was paused.
  • Until then they are stored encrypted with a key that belongs to that campaign alone, kept apart from the data and left out of our backups. Deleting a campaign destroys its key: from that moment what is left of it on our server or in our backups can no longer be read.
  • Messages already sent stay in your WhatsApp, on your phone, and with the people who received them. OML Send cannot delete those.
  • What stays, for billing only: the campaign's id, channel, dates, and how many messages were sent and charged. Nothing about the people in it.
  • While your number is linked, the messages it sends and receives also reach our WhatsApp gateway, as they reach any linked device. We use them only for delivery and read receipts, replies to your campaigns and STOP requests; the gateway is set up not to store messages, contacts, chats or history.

The do-not-send list

When someone replies STOP, we keep a keyed code of their number (an HMAC, never the number) in your workspace's do-not-send list, so they are not sent to again, also after your campaigns are deleted, until the workspace itself is deleted.

What else we keep

  • Your account: your email address, your name (encrypted), your workspaces and team roles, your message templates (text only, encrypted), your credit and orders.
  • When you sign up, what you typed waits, encrypted, until you open the link in our email: at most 24 hours.
  • A log of actions: who did what and when, with ids and counts only, never a number, a name or a text.
  • Payments go through OML's own invoicing at sales.omlcloud.com, which issues your invoice and receipt. A QR payment also passes through your bank or payment app and the QR payment network, and a transfer through the banks. Orders, invoices and receipts are kept as long as tax law requires, also after your account is closed.
  • The web server records your IP address and the pages you open (without the part of the address after a ?), for 14 days, to keep the service safe.
  • We use only the cookies the site needs to work (keeping you signed in and protecting forms); no advertising or tracking cookies.

Logs

Our logs are set up not to hold phone numbers, names or message texts: the web server does not record the part of an address after a ?, and the application records short codes only.

Where your data is

OML Send runs on a server rented from Contabo GmbH (Germany), in a data centre in the European Union, outside Mauritius. Our emails are sent from our own mail server there. Your account details and campaign data are stored there, protected as described above.

Your rights

Under the Data Protection Act 2017 you can ask to see, correct or delete the personal data we hold about you, and object to how we use it. Write to us on WhatsApp at +230 5850 19 20 or through omlcloud.com; we answer within one month. Ask us to close your account and we delete your personal details, except what the books and the law require us to keep. People on your lists can ask you, as the controller; we help you answer. If you are not satisfied with our answer, you can complain to the Data Protection Commissioner (Data Protection Office, Mauritius).