Privacy Policy

O3Notify is a product of Executable Technologies Inc., 8735 Dunwoody Pl # 4782, Atlanta, GA 30350, United States ("Executable Technologies", "we", "us"). We provide a messaging API that lets organizations send transactional SMS and WhatsApp messages and track their delivery.

This policy explains what data the service handles, why, who receives it, and the choices you have. For anything it does not answer, write to info@exeapps.com.

The service handles data about two different groups of people, and our role differs for each.

• Account holders: the people who create an organization, sign in, and manage API keys. For this data we decide how it is used, so we are the controller.
• Message recipients: the people your organization sends messages to. Their phone numbers and the content of those messages are yours: your organization decides whom to message and what to say, and we process that data only on your instructions to deliver it and report its status. In data-protection terms your organization is the controller and we are the processor.

If you received a message through the service and have a question about it, the organization named in the message is the party responsible for it. Section 8 explains how to reach the right party.

• Account data: your name, email address, a hash of your password (the password itself is never stored), and your organization membership. Used to sign you in and to run your organization's account.
• API keys: stored only as a hash. The full key is shown once, when it is created. Used to authenticate requests to the API and to attribute them to your organization.
• Message data: the recipient's phone number, the channel (SMS or WhatsApp), the message body, the sender name where you supply one, the delivery status (queued, sent, delivered, or failed), which provider carried the message, any error code the provider returned, and timestamps. Used to deliver the message, to show you its status by id and in your dashboard, and to diagnose failures.
• Webhook configuration: the endpoint URL you set for status updates and the secret used to sign deliveries to it.
• Service records: technical logs of requests (timestamps, which API key was used, response codes, and rate-limit counters). Used for security, abuse prevention, and troubleshooting.

We do not collect payment details: the service has no billing features today. We do not use advertising or analytics trackers on the site.

To deliver a message we must hand the recipient's phone number and the message content to the carrier that delivers it. Which carrier depends on the channel and the destination country:

• Meta Platforms, Inc.: WhatsApp messages, through the WhatsApp Cloud API.
• Twilio Inc.: SMS to every destination without a local carrier route, which today means everywhere outside Guinea.
• Orange Guinea: SMS to Guinean numbers, through the Orange SMS API.
• Africa's Talking: integrated in the software but currently disabled; it receives no data today. We will update this list before enabling it.

Each carrier processes that data under its own terms and privacy policy. We share nothing else with them.

The service runs on servers we operate ourselves, with PostgreSQL and Redis. Web fonts on the public site are loaded from Google Fonts, which receives your browser's request (including its IP address) when a page loads.

We do not sell personal data. We disclose it only to the carriers above, to a successor if the business is transferred, or when the law requires it.

Mobile phone numbers and SMS opt-in data and consent are never shared with third parties or affiliates for marketing or promotional purposes. Handing a number to the carrier that delivers a message, as described above, is the only sharing that takes place.

Account data is kept for as long as your account exists.

Message records are kept so that you can look a message up by its id and see it in your dashboard. We do not currently delete them on a fixed schedule. When you delete your account, or ask us to delete your organization's records, we delete them as described in section 7, except where we must keep a record to comply with the law or to resolve a dispute.

Service records are kept for a limited period for security and troubleshooting and then discarded.

Passwords and API keys are stored only as hashes. Traffic to the service is encrypted with TLS. Every request is authorized on the server before any data is read, and every query on an organization's data is scoped to that organization, so one customer cannot read another's messages, keys, or webhook settings. Webhook deliveries carry an HMAC-SHA256 signature so that you can verify they came from us. Provider credentials are held in server configuration and never written to logs.

No method of storage or transmission is completely secure. If we learn of a breach that affects your data, we will inform you without undue delay.

Account holders: to delete your account, email info@exeapps.com from the email address on the account. We will verify the request, then delete your account, your organization membership, your organization's API keys, and your organization's message records. Where an organization has other members, the request must come from an owner of that organization. We complete deletion within 30 days and confirm by email. A record may be retained only where the law requires it or a dispute is open, and we will tell you if that is the case.

Message recipients: if you received an SMS or WhatsApp message through the service and want your number or the message deleted, contact the organization that sent it. It decides what happens to that data, and we act on its instruction. If you cannot identify the sender, email info@exeapps.com with the number the message came from or the text you received, and we will identify the organization and forward your request within 30 days.

Depending on where you live you may have the right to see the personal data we hold about you, to correct it, to receive a copy of it, to object to or restrict how it is used, and to complain to a supervisory authority. Email info@exeapps.com; we will verify who you are and respond within 30 days.

For data your organization sends through the service, we can only act on your organization's instruction, so requests from message recipients are directed to the sending organization as described in section 7.

The service is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact info@exeapps.com and we will delete it.

Our servers are in the United States. If you or your recipients are elsewhere (in Guinea, the European Union, or any other country), the data described in this policy is transferred to and processed in the United States, where privacy law may differ from that of your country. By using the service you accept that transfer; where your organization needs specific contractual terms for it, contact us.

When we change this policy we publish the new version at this address and update the date at the top. If a change materially affects how we handle your data, we will also email account holders before it takes effect.

Executable Technologies Inc., 8735 Dunwoody Pl # 4782, Atlanta, GA 30350, United States. Email: info@exeapps.com.