Platform Privacy Policy

1. Data controller

Controller: Dhalinta Digital Solutions · Somalia
Domain: app.dhalinta.com
Privacy contact: abdullhiomarhassan@gmail.com

2. Personal data we process

• Account data: name, email, encrypted password, preferred language and authentication information.
• Billing data: legal name, tax ID, address, country, invoices and subscription status.
• Payment data: processed by Stripe; we keep only customer identifiers, payment metadata and invoice history.
• Technical data: IP address, access times, user agent, security logs and audit events.
• Usage data: created bots, workspaces, channels, integrations, calendars, tickets and voice configuration.

3. Purposes of processing

• Provide the contracted SaaS service and manage the account.
• Manage billing, payments and support.
• Keep the platform secure and prevent fraud and abuse.
• Comply with legal, tax and accounting obligations.
• Send operational notices, security alerts and sub-processor change notices.
• With your additional consent, send product news or marketing communications.

4. Legal basis

• Contract performance (GDPR art. 6.1.b) for providing the service.
• Legal obligation (art. 6.1.c) for tax and accounting duties.
• Legitimate interest (art. 6.1.f) for service security and fraud prevention.
• Consent (art. 6.1.a) for marketing communications and non-essential cookies.

5. Data of your end users

When your end users interact with your bots, voice agents, tickets or channels on Dhalinta AI Automation (including WhatsApp, Instagram, Messenger and Telegram), you are the controller and Dhalinta Digital Solutions acts as processor (with Muse Layer LLC, technology provider of the platform, as sub-processor) under the Data Processing Agreement. You are responsible for informing your end users and for the integrations you activate.

6. Telegram alerts (optional)

If a team member links their personal Telegram account to receive notifications and reply from Telegram ("Telegram alerts"), we store their Telegram user ID, chat ID, username and first name, plus the preferences they choose. Notifications and replies travel through Telegram's servers, outside the EEA; with "minimal" mode the message content is not sent to Telegram, only a notice with a link to the panel. The member can disconnect at any time from the panel or with /disconnect.

7. Retention

Account data is kept while the account remains active. After cancellation, data is deleted or anonymised within 30 days unless legal retention applies (invoices: 6 years; security logs: up to 12 months).

8. Recipients and sub-processors

Dhalinta Digital Solutions provides the service on a platform supplied by Muse Layer LLC, technology provider of the platform, which processes the data on behalf of Dhalinta Digital Solutions (as sub-processor for the data of your end users). We also use the providers listed at /legal/subprocessors (hosting, AI, telephony, email, payments and messaging). The main servers are in Germany, with a replica server in Spain (Mallorca) operated by Muse Layer LLC, sub-processor. Changes to the list are notified as required by the GDPR and the DPA.

9. International transfers

The platform's technology provider and sub-processor, Muse Layer LLC is a company established in the United States and is subject to the GDPR when it offers its services in the European Union. Your data is hosted on servers in the EU. Any transfer to Muse Layer LLC is covered by the European Commission Standard Contractual Clauses. Where a provider processes data outside the EEA, the transfer is protected by the European Commission Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another valid GDPR mechanism.

10. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions by writing to abdullhiomarhassan@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

11. Security

We apply technical and organisational measures including TLS encryption in transit, encryption at rest (AES-256) of message content, stored attachments and integration tokens, role-based access control, audit logs, daily backups within the EU, incident response procedures and periodic security reviews.