Privacy policy

This policy explains how HeySheep Technologies Pte Ltd (“HeySheep”, “we”) handles personal data in HeyPing, our WhatsApp messaging service for businesses. It covers two groups of people: our customers (the businesses that use HeyPing and their team members) and their customers (the people those businesses message on WhatsApp).

1. Our roles under the PDPA

For the details of a business's own customers, such as names, phone numbers, consent records and messages, the business is the organisation responsible under Singapore's Personal Data Protection Act 2012 (PDPA). HeySheep processes that data on the business's behalf as its data intermediary, under our Terms of Service and data processing terms.

For the details of our own customers and their team members, such as account and billing details, HeySheep is the organisation responsible.

2. What we collect

• Account details: name, work email, business name and UEN, and your role in the workspace.
• Workspace data you add or that arrives through WhatsApp: customer names, phone numbers, emails, tags, consent records, message templates, campaigns and messages.
• WhatsApp connection details from Meta: your WhatsApp Business account and phone number IDs, and an access token Meta issues so HeyPing can send for you.
• Billing details handled by Stripe. We receive your plan, payment status and the last digits of your card, never the full card number.
• Technical data: log-in times, IP address, browser type and actions taken in HeyPing, for security and support.
• Enquiries you send us through our website, by email or on WhatsApp.

3. How we use it

• To provide HeyPing: sending and receiving WhatsApp messages, tracking delivery, and keeping consent and opt-out records.
• To run your account, bill your subscription and support you.
• To keep HeyPing secure and reliable, and to meet Meta's platform rules.
• To tell you about changes to HeyPing. We only send marketing to you if you agree, and you can stop it anytime.

We do not sell personal data, and we do not use a business's customer data for our own marketing.

4. Meta and WhatsApp

Messages travel through Meta's WhatsApp Cloud API. Your business has its own WhatsApp Business account with Meta, and Meta processes messages and bills message charges directly to your business under Meta's own terms and policies. HeyPing connects to Meta directly, without a third-party messaging provider in between.

5. Where data is stored

Workspace data is stored in Google Cloud's Singapore region (asia-southeast1). Sign-in accounts are handled by Firebase Authentication, a Google service that operates globally. Payments are processed by Stripe. Where data is transferred outside Singapore, we require protection comparable to the PDPA.

6. Who we share it with

• Meta, to deliver WhatsApp messages.
• Google Cloud, which hosts HeyPing.
• Stripe, to process subscription payments.
• Apps you connect to your workspace, such as HeyShop, HeyPOS or your own systems, limited to the permissions you grant.
• Authorities, where the law requires it.

7. How long we keep it

Message records are kept in HeyPing for up to 180 days, and longer only where a business needs them for its own records or the law requires it. Workspace data is deleted after a business closes its account, apart from records we must keep, such as billing records.

8. Security

We encrypt data in transit, encrypt WhatsApp access tokens at rest, limit staff access, and give each team member only the access their role needs. If a data breach affects you, we will notify the business and, where required, the PDPC, within the PDPA timelines.

9. Your choices

If a business messages you through HeyPing, you can reply STOP or tap “Stop promotions” to opt out. To access, correct or delete your details, contact that business. We will help them respond. HeyPing customers can ask us directly about their account data.

10. Contact

Data Protection Officer, HeySheep Technologies Pte Ltd, Singapore. Email contact@heysheep.sg.