Privacy policy

Last updated November 04, 2026

Hatef (hatef.ai) is made by KUDZO COMPUTER PROGRAMMING COMPANY LIMITED, a company in Jordan (kudzu.ai), called "we" here. This policy explains what Hatef collects and how it's used. Questions: info@kudzu.ai.

It covers two groups of people: team members, who use Hatef for a business, and customers, who message a business on WhatsApp through a number connected to Hatef.

What we collect

  • Team members: name, email address, password (stored only as a hash), profile photo if you add one, and the IP address and browser of each sign-in. Each workspace also stores the settings and business details its team enters.
  • From WhatsApp: when a business connects a number through Meta's WhatsApp Business Platform, we receive customers' phone numbers and WhatsApp names, the messages and files they exchange with the business, and delivery and read statuses. We also receive the business's phone number details and message templates, and an access token from Meta, which we store encrypted.
  • From the WhatsApp Business app: if the business keeps using the app on the same number, we also receive the messages it sends from the app, the app's contacts, and the chat history the business chooses to share when connecting.
  • What the team adds: contact details, internal notes, automated conversation flows and their history.

How we use it

Data from Meta and WhatsApp is used only to provide Hatef to the business that connected the number: to show its conversations in the inbox, run the flows it builds, send the messages it or its flows send, and show its own analytics. We never sell it and never use it for advertising.

We email team members about their account: invitations, password resets and changes, email address changes, and conversations assigned to them. An assignment email includes the customer's name or phone number.

AI features

AI features are on for new workspaces, and the workspace's admins can turn them off in Settings → AI. When someone uses one (an AI step in a flow, a suggested reply, drafting or editing a flow with AI, or testing the knowledge base), the messages involved, the customer's WhatsApp name and the business's knowledge base are sent to OpenRouter. OpenRouter runs Anthropic's Claude model through Amazon Bedrock, Google Vertex AI or Microsoft Azure, on endpoints in the United States, and only with providers that OpenRouter lists as not collecting user data. We keep a record of each AI request's size and cost, without its text, for 13 months.

Who else handles it

  • Meta: WhatsApp messages travel through Meta's WhatsApp Business Platform.
  • Contabo: the servers that run Hatef and store its database and files, in the United States. Contabo's support is in Germany.
  • OpenRouter, and Anthropic through Amazon Bedrock, Google Vertex AI and Microsoft Azure: AI features, as described above.
  • Resend: sends Hatef's emails.
  • Sentry: error reports, with message text, phone numbers and email addresses removed before they're sent.
  • GitLab: hosts Hatef's code and the pipeline that deploys it, which holds the keys used for deploying.
  • Google Fonts: our pages load fonts from Google, so your browser connects to Google, which sees your IP address.

These providers process data outside Jordan: our servers and AI requests are in the United States, and error reports and Contabo's support are in Germany.

Cookies

Hatef uses cookies only to keep you signed in and remember your workspace. It uses no advertising or analytics cookies.

Security

Hatef runs over HTTPS. Passwords are stored only as hashes, and Meta access tokens and other secrets are encrypted in our database. Each workspace sees only its own data.

How long we keep it

  • A workspace's conversations, contacts and files are kept until the business deletes them or the workspace.
  • The raw notifications Meta sends us are deleted 30 days after they're processed.
  • AI request records are deleted after 13 months.

Deleting your data

See Data deletion. Customers can also ask the business they messaged. To ask about your data or have it deleted, email info@kudzu.ai.

Changes

When this policy changes, we update this page and the date at the top.