Privacy Policy

Who we are

hashChat is operated by LOVE & JOY (SMC-PRIVATE) LIMITED, a company registered in Pakistan under the Companies Act 2017, CUIN 0324937, incorporated 30 January 2026. We are the data controller for the information described on this page.

What this policy covers

It covers the hashChat website and the hashChat application at app.hashchat.uk, including the Android app.

It does not cover WhatsApp itself. Your WhatsApp Business Account belongs to you and lives with Meta under Meta’s own terms and policies. hashChat connects to that account; it does not replace it.

Where a business uses hashChat to talk to its own customers, that business is the controller of those conversations and hashChat processes them on its instructions. If you messaged a business, or are saved in the contacts of its WhatsApp Business app, and want your data removed, ask that business first — they can delete it themselves, and they are the ones who decide.

What we collect, and why

We do not store payment card numbers on our servers. We do not collect special categories of data, and we do not ask for any.

Data we receive from Meta

hashChat is built on the WhatsApp Business Platform, so some of what we hold reaches us through Meta’s APIs rather than from you directly. That information belongs to the business whose account it came from, and we treat it that way.

• We use it only to provide the service. Platform Data is used to run the shared inbox, contacts, pipelines, broadcasts, automations and, when the business turns it on, AI replies for the business it belongs to — and for nothing else.
• We do not sell it. Not to advertisers, not to data brokers, not to anyone, in any form, aggregated or otherwise.
• We do not build profiles across businesses. One customer’s contacts and conversations are never mixed with another’s, and we do not combine them to enrich, score or target anybody.
• We do not use it for advertising. Neither ours nor anyone else’s.
• We delete it when it is no longer needed — when the account closes, when the number is disconnected, or when you ask.

If a business connects its WhatsApp Business app number

A business can keep using the WhatsApp Business app on its phone and connect the same number to hashChat — Meta calls this coexistence. When it chooses “Connect my WhatsApp Business app number”, Meta sends us two things from that app, both in the table above: up to 180 days of past one-to-one chats, requested once, at connect time; and the app’s contact list, which follows the app — a contact removed there is removed here too.

We use them only to show the business its own past conversations and the right names in its inbox. Neither goes to anyone not already named under “Who else sees it” below, and both are kept like the rest of the inbox: until deleted, or until the account closes.

To stop it, the business disconnects in the WhatsApp Business app: Settings → Account → Business Platform → Disconnect. To have what already came across removed, use the data deletion page.

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including their Limited Use requirements.

The Android app

The hashChat Android app contains no analytics or crash-reporting SDK. The only third-party services built into it are Google Firebase Cloud Messaging (notifications) and, on ad-supported plans, Google AdMob (ads). The Google Play version of the app has no in-app purchases or payment screens.

It asks for these permissions: notifications, microphone (voice notes and calls), and the call permissions needed to ring and keep a call connected. It does not ask for location, contacts, SMS, call log, camera, or storage permissions.

Advertising in the Android app

Workspaces on the Basic and Pro plans see ads in the hashChat Android app. Workspaces on the Business plan see none. The ads are served by Google AdMob, a Google service. To show and measure ads, the Google Mobile Ads SDK in the app collects, directly from your device: your device’s advertising ID and app set ID, your IP address (which Google may use to estimate your general location), interactions with the app and the ads (such as app launches, taps and ad views), and diagnostic information about the app and the SDK.

Google uses this data for advertising, analytics and fraud prevention under its own privacy policy and explains how at How Google uses information from sites or apps that use our services. Google keeps it under its own retention policy. In the European Economic Area and the United Kingdom, Google’s consent form is shown before any ad is requested. You can reset or delete your advertising ID at any time in your phone’s Android settings.

Your conversations, contacts and other workspace data are never given to AdMob or used for advertising.

Microphone, voice notes and calls

The app asks for microphone access only when you record a voice note or take or place a WhatsApp voice call. A voice note is recorded only while you are recording. It is kept in the app’s private cache until it is sent, and is then stored and delivered like any other message media.

WhatsApp voice calls in hashChat are live. The audio is streamed in real time between your phone and WhatsApp’s (Meta’s) call servers, does not pass through hashChat’s servers, and is not recorded or stored by hashChat. We keep a record of each call (time, direction, status, which team member answered, and the customer’s number and name) as part of the conversation history.

During a call the app runs a phone-call foreground service, so the call keeps working while the screen is off. An incoming call can show a full-screen call screen over the lock screen.

Camera, photos, videos and files

The app does not have access to your photo gallery or your files. When you choose to attach something, Android’s own photo picker or file picker opens, and the app receives only the item you select. When you take a photo, Android’s camera app takes it and gives it to hashChat. The app has no camera permission of its own.

Photos, videos, documents and audio you send, and those your customers send you, are stored as part of the conversation and kept like other messages. CSV and JSON files you import (contacts, broadcasts, automations, flows) are read once to import their contents.

Data on your device

To open quickly and work on a weak connection, the Android app keeps a copy of your recent chats, messages, contacts and tags in its private storage on your phone. Other apps cannot read it. It is deleted when you sign out and when you uninstall the app. Your login session is stored encrypted with a key held in the Android Keystore. App data is excluded from Android device backups.

Who else sees it

A short list, and it stays short on purpose:

• Meta Platforms. Messages you send and receive travel through WhatsApp. Meta holds its own copy under its own policies, and that copy is outside our control.
• Our hosting provider. The servers that run hashChat and hold its database.
• Google, for notifications. If you use the hashChat Android app with notifications turned on, each new message — and any alert about your WhatsApp number — reaches your phone through Firebase Cloud Messaging, a Google service. The notification carries the sender’s name or number and the message text, and Google delivers it over its own global network. To deliver notifications, the app registers your device with Firebase Cloud Messaging. We store the resulting device token on our servers, linked to your account. Firebase also uses a per-installation identifier. We use these only to send notifications and incoming-call alerts to the devices you are signed in on. A device’s token is deleted when you sign out of the app on that device, and all tokens are deleted when your account is deleted.
• OpenAI or Anthropic, only if a business turns on AI. The AI reply assistant stays off until a business switches it on and adds its own API key from one of these providers. From then on, to draft or send a reply, hashChat sends that provider the business’s instructions, the recent text messages of the conversation being answered, and any matching text from the business’s knowledge base. Photos, voice notes and other media are not sent. The provider handles this under the business’s own account and terms, and hashChat does not use conversations to train any AI model.
• Nobody else, apart from Google AdMob as described under “Advertising in the Android app”, and unless the law requires it or you ask us to.

We do not sell data. Your conversations, contacts and workspace data are never shared for anyone’s marketing. The only advertising data is what Google’s AdMob SDK collects directly on ad-supported plans, described above.

Where it is stored

On servers in Kuala Lumpur, Malaysia. If you are messaging from Pakistan or anywhere else, your data crosses a border to get there, and by using hashChat you accept that transfer.

Two things leave that server: notifications, which travel through Google’s Firebase network to your phone, and — only when a business turns on AI — the text sent to the AI provider it chose, which processes it on that provider’s own infrastructure.

Connections to the site and the app are encrypted in transit with TLS. Access to the database is limited to the people who operate the service, and every account is separated so one customer cannot read another’s data. No system is perfectly secure, and we do not claim otherwise; if a breach ever affects your data we will tell you.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or hand it over in a portable form. You can also object to a particular use, or withdraw consent where a use rests on it.

Write to support@hashchat.uk and we will answer within 30 days. There is a separate page with the exact steps for deletion: how to delete your data.

In the Android app, you can delete a chat or a contact yourself (long-press it in the Inbox, or select contacts in the Contacts tab), and it is removed immediately. To delete your whole account and workspace, or only your own login as a team member, follow the steps on the data deletion page. Deletion requests are completed within 30 days, and backups roll over within 90 days.

Children

hashChat is a business tool and is not for children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, write to us and we will remove it.

Changes to this policy

When the product changes, this page changes with it and the date at the top moves. If a change materially affects how we handle your data, we will tell account holders by email rather than relying on you to notice.