Privacy Policy

MesaDash Inc. operates MesaDash in Nigeria, providing software for restaurants, salons, spas, barbers, other appointment businesses and carwashes. Features include storefronts, orders, bookings, customer conversations, payments and teams. This policy explains our collection, use, sharing, retention and protection of personal information across these services.

For account, billing, security, and product administration data, MesaDash Inc. acts as an independent controller. For customer messages, orders, bookings, and contact records that a business processes through MesaDash Inc., the business is normally the controller and MesaDash Inc. acts as a processor or service provider acting on that business's instructions.

Account data: name, email, password/authentication data, profile image, phone number, country, sessions, IP address, user agent, and security logs.

Business workspace data: business identity and contact details, country, timezone, branches, staff and roles, product settings, connected-app identifiers and permissions, catalogs, billing profiles, subscriptions, invoices, payment records and audit logs.

Customer and workflow data: names and contact details, phone numbers, usernames or provider-specific identifiers, messages and attachments, conversation metadata, orders, bookings, transactions, delivery details, assigned staff or riders, support notes and automation events. The information available depends on the service and permissions used.

Integration data: information received through connected WhatsApp Business App or Business Platform, Instagram, Messenger, Telegram, Google login or Calendar, Facebook login, payment services and other enabled providers. Different connection modes provide different access; connecting an app does not give us access to all private conversations or other accounts.

We use data to administer accounts and workspaces, connect authorized services, exchange messages, manage orders and appointments, synchronize calendars, record payments, operate enabled automation, provide support, investigate complaints, prevent fraud and secure the platform.

Under the Nigeria Data Protection Act 2023 and other applicable data protection laws, we rely on the legal basis appropriate to the activity: contract performance for our account and subscription services; legal obligations for required records and disclosures; legitimate interests where permitted for security, fraud prevention and service administration; and consent where required for optional processing. Businesses must establish the lawful basis for customer processing they instruct us to perform. Sensitive personal data requires an additional lawful condition where applicable.

We share relevant data with the business serving the customer and its authorized staff or riders, and with providers needed for enabled features, including Meta services, Telegram, Google, payment processing, AI processing, hosting, storage, email and monitoring. We may disclose relevant records to professional advisers or competent authorities where legally justified. Some recipients act on instructions; businesses and connected providers may also process data independently under their own privacy notices.

We do not sell personal information. We do not use business customer message content for third-party advertising. If any future feature would involve sale, sharing, or targeted advertising under applicable US state privacy laws, we will provide the required notice and opt-out controls before enabling it.

Our service providers and connected apps may process information outside Nigeria or your country. International transfers must meet applicable data protection requirements, including an appropriate level of protection or another lawful transfer basis. Contact hello@mesadash.app for information about the recipients and transfer arrangements relevant to your data.

MesaDash Inc. uses essential cookies for login, session security, fraud prevention, and keeping the platform available. These are required for the app to work and cannot be switched off through the consent banner.

MesaDash Inc. may use optional browser storage for preferences such as remembered workspace and dashboard sound. Users can choose Essential only or Allow preferences in the cookie notice. We do not currently load marketing or analytics cookies through the app.

We keep account and business data while the account or workspace is active. We keep operational records, audit logs, billing records, and security records only as long as needed for the service, security, dispute resolution, accounting, tax, fraud prevention, or legal compliance.

Business customer data is retained according to the business workspace settings, product needs, and lawful instructions from the business, subject to any legal or security exceptions.

For processing subject to Nigerian law, you may exercise applicable rights of access, correction, erasure, restriction, objection, portability and withdrawal of consent, subject to legal conditions. Withdrawal does not affect earlier lawful processing. You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng. Contacting us does not prevent you from exercising regulatory or judicial remedies.

Depending on the law applicable to your data, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaints to a competent supervisory authority.

California and other US state residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information and avoid discrimination for exercising applicable privacy rights.

You can request access, correction, an account export or deletion by emailing hello@mesadash.app; signed-in users may also submit available privacy requests through the platform. An export contains the records included in that export and may not cover every record relevant to a wider request. Deletion requests require verification and processing; submitting a request does not immediately erase all records. We may verify identity and assist the relevant business where it controls the data.

We send transactional emails for account, security, billing, team invitation, password reset, and service messages. If we send marketing emails, we will identify them where required and include an unsubscribe method.

We use access controls, HTTPS, secure session handling, audit logs and encryption for sensitive provider credentials. Businesses must also protect their accounts, devices, staff access and all connected-app permissions. No internet service is perfectly secure. Personal-data incidents are assessed and notified to affected parties and authorities where required by applicable law.

Restaurant records may include delivery addresses, order instructions and allergy information you provide. Appointment records may include selected services, professional assignments, availability, deposits and service notes. Carwash records may include vehicle details, selected wash services and arrival information. Complaint records may contain descriptions or photographs supplied to investigate an issue. We use these records for the relevant workflow and support; only provide information necessary for that purpose.

Health or allergy information can be sensitive. Businesses must limit collection, establish the required lawful basis and restrict access. These services are not a substitute for clinical records or emergency care. Where services involve children, businesses must meet applicable age, notice and parent or guardian authorization requirements; an adult business account does not itself authorize processing a child's data.

When you connect Google Calendar, we process authorization credentials, selected calendar identifiers and relevant event timing or availability data to support scheduling. We may create, update or remove synchronized appointment events, including the appointment details supplied by the business. People with access to that calendar may see those details under its sharing settings.

You can revoke Google access through your Google account. For any integration, use the available disconnection controls or contact hello@mesadash.app for assistance. Disconnection is separate from deletion: it does not automatically delete existing messages, calendar events, orders or records held by the business or provider, or cancel an order or payment.

When AI-assisted features are enabled, customer message text and relevant business context may be sent to an external AI provider to interpret requests or generate responses or content. Data sent depends on the feature. Contact hello@mesadash.app for the provider and data-handling details applicable to your workspace. Avoid including unnecessary sensitive information in messages or prompts. Automated responses may be inaccurate; customers can seek assistance from the business.

We may update this policy as our services or legal obligations change. The date above identifies the current version. We will provide additional notice and obtain consent where required for material changes or new processing purposes.

For privacy questions or rights requests, contact hello@mesadash.app. If you are a business customer's end user, you may also contact the business directly because they control how their customer data is used in MesaDash Inc..