Privacy Policy

Effective date: October 20, 2025

This Privacy Policy explains how we at Utell Inc (“we”, “us”, “our”) collect, use, share, and protect information when you use our software and services, including our Verifiable Credentials SaaS platform and our integrations with Meta products such as Facebook, Instagram, and the WhatsApp Business Platform (collectively, the “Services”). We follow the Barbados Data Protection Act (2019), the EU General Data Protection Regulation (GDPR), and other applicable laws.

1) Information We Collect

  • Identity & Contact Data: name, email, phone number, organization, role.
  • Account & Auth Data: usernames, hashed credentials, roles/permissions, audit logs.
  • Usage & Device Data: IP address, browser/OS, pages viewed, timestamps, diagnostics.
  • Verification & Credential Data: claims, attestations, and metadata necessary to issue/verify verifiable credentials that you request.
  • Meta Platform Data: data returned by Meta APIs/SDKs (e.g., WhatsApp message metadata, business phone number ID, template status, Facebook Login profile fields you approve).
  • Support & Communications: tickets, emails, chat transcripts, and call notes.

2) Sources of Data

We collect data directly from you, automatically from your use of the Services, and from integrated third parties such as Meta (via documented APIs/SDKs) and identity providers when you connect accounts or authorize scopes.

3) Purposes & Lawful Bases

We process personal data only for specific purposes and lawful bases:

  • To provide and operate the Services (contract performance).
  • Security, fraud prevention, and abuse detection (legitimate interests; legal obligation).
  • Account management, billing, and support (contract performance; legitimate interests).
  • Compliance with platform terms (e.g., Meta) and legal requirements (legal obligation; legitimate interests).
  • Product improvement and analytics (legitimate interests; we use aggregated/de-identified data where possible).
  • Marketing communications (consent, where required). You can withdraw consent at any time.

4) WhatsApp Business Platform & Meta Integrations

When you opt in to WhatsApp communications or connect your Meta account, we process data strictly as permitted by Meta’s policies and applicable law. For WhatsApp Business, we use pre-approved templates to initiate business messages where required, honor the 24-hour customer-care window, and only message recipients who have provided valid, auditable opt-in. Each message includes a clear opt-out method (e.g., reply “STOP” or follow the provided link). Administrative/utility messages are scope-limited to the stated purpose.

We do not sell Meta Platform Data, and we do not repurpose it beyond the purposes you have been told about and consented to. We use only documented APIs/SDKs and respect rate limits.

5) Sharing & Processors

We share personal data only with:

  • Service providers (processors) under contract and subject to confidentiality and data protection terms (e.g., hosting, email delivery, observability, and security vendors).
  • Platform providers such as Meta (Facebook, Instagram, WhatsApp) when you connect or use those features.
  • Authorities or third parties where required by law or to protect rights, safety, or the integrity of our Services.

A list of key processors and sub‑processors is available on request. We remain responsible for our processors.

6) International Transfers

Where data is transferred outside your jurisdiction, we rely on appropriate safeguards, such as EU Standard Contractual Clauses (SCCs) and equivalent mechanisms, or adequacy decisions where available.

7) Retention

We retain personal data only as long as necessary for the purposes described above, to satisfy legal, tax, or audit obligations, and to enforce agreements. We apply documented retention schedules and then securely delete or irreversibly anonymize data.

8) Security

We use administrative, technical, and organizational measures including access controls (least privilege), encryption in transit and at rest where appropriate, key management, network segmentation, monitoring, and regular testing.

9) Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, port data, or withdraw consent. To exercise your rights, contact us at kitjisupport@kitjistudios.com. We will verify your request and respond within the time required by law.

10) Cookies & Tracking

We use cookies and similar technologies for essential functions, security, and analytics. You can manage preferences via your browser settings and, where provided, our in‑product controls.

11) Facebook Login & Data Deletion

If you use Facebook Login with our app, you may request deletion of data that our app received from Facebook using our in‑app controls or by following the steps on our User Data Deletion page. Deletion requests are processed directly by Utell via authenticated account controls or verified support requests. Removing the app from your Facebook settings does not automatically delete data from our systems; please use our in‑app deletion flow or contact us.

12) Children

Our Services are not directed to children under the age required by applicable law. We do not knowingly collect personal data from children, and we apply appropriate age‑gating where required.

13) Contact

Privacy Officer
Utell Inc
Breedys Land, Silver Sands, Christ Church, Barbados
Email: kitjisupport@kitjistudios.com

14) Changes to this Policy

We may update this policy from time to time. Material changes will be notified in‑product or by email. The latest version will always be posted here.