Moran AI
1. Scope and roles
This Privacy Policy explains how Moran AI ("Moran", "we") handles personal data when you use moranai.co.tz and the Moran dashboard, and when your customers talk to your Moran assistant on WhatsApp.
- Business owners and co-workers: for your account data, Moran is the data controller.
- Your customers: for the messages, names, numbers and orders of the people who write to your business, you are the controller and Moran is your processor. We act on your instructions and this policy.
We follow the Personal Data Protection Act, 2022 of Tanzania and, where applicable, other data protection laws.
2. What we collect
From business owners and co-workers
- Account details: name, email address, business name, phone number, password (stored only as a hash), and, if you sign in with Google or Facebook, the identifier and profile name and picture those services share with us.
- Business content you add: products, prices, photos, documents for the knowledge base, business details and instructions for the assistant, templates and campaigns.
- WhatsApp connection data: your WhatsApp Business account id, phone number id and an access token that Meta issues, stored encrypted.
- Billing details: plan, invoices and payment references. Card or mobile-money credentials are handled by the payment provider, not stored by us.
- Usage and technical data: pages visited, actions in the dashboard, device and browser type, IP address, and logs needed to keep the service secure and working.
From your customers
- WhatsApp phone number, WhatsApp profile name, and the content of messages, photos, voice notes and locations they send to your business number.
- Details they share in conversation such as their name, area or district, preferences, budget and orders, which the assistant may ask for politely once, so your business can serve them and arrange delivery.
- Records the assistant creates for you: contacts, orders, bookings, follow-ups and short conversation summaries.
3. Why we use it
- To provide the service: answer your customers, save contacts and orders, send reminders and follow-ups you or the assistant scheduled, run campaigns you start, and show reports.
- To run and secure your account: sign-in, email verification, password reset, co-worker permissions, fraud and abuse prevention.
- To bill you and to communicate about your subscription, service changes and support.
- To improve the service, using aggregated and de-identified statistics. We do not use your customers' conversations to train AI models.
- To comply with the law and Meta's platform requirements.
4. AI processing
To generate replies, relevant parts of a conversation, your catalogue and your instructions are sent to AI model providers (currently OpenAI, DeepSeek and NVIDIA Nemotron via Ollama). They process the text to produce a reply and, under their business terms, do not use it to train their models. We send only what is needed for the reply, and we never send passwords, payment details or identity numbers. Prices and product facts in replies are checked against your catalogue before they are sent.
5. Who we share data with
- Meta (WhatsApp): messages are delivered through the WhatsApp Business Platform; Meta processes them under its own terms.
- AI model providers as described in section 4.
- Service providers that host our servers and databases, send transactional emails, and process payments, each bound by contracts that limit them to acting on our instructions.
- Google and Facebook when you choose to sign in with them.
- Authorities when the law requires, or to protect the rights and safety of Moran, our users or the public.
We do not sell personal data and do not share it with advertisers.
6. How long we keep data
- Account and business data: for as long as your account exists, then deleted within 30 days of deletion, except billing records kept for the period the law requires.
- Customer conversations, contacts, orders and bookings: for as long as you keep them in your dashboard. You can delete contacts and export data at any time.
- Conversation memory used by the assistant: facts expire after 10 days of inactivity unless refreshed by a new conversation.
- Chat history a business imports so the assistant can learn its tone: kept for the period the business chooses, 180 days by default, then deleted automatically.
- Security logs: up to 12 months.
You can delete an account or ask us to delete personal data at any time — see Data and Account Deletion.
7. Security
We use encryption in transit (HTTPS), encrypted storage of WhatsApp tokens, hashed passwords, one-time tokens for password reset and email verification, permission controls for co-workers, tenant isolation so one business can never read another's data, and monitoring for abuse. No system is perfectly secure; if we learn of a breach affecting you we will notify you without undue delay and, where required, the relevant authority.
8. Your rights and your customers' rights
Depending on applicable law you may have the right to access, correct, delete or export personal data, to object to or restrict certain processing, and to withdraw consent. Business owners can do most of this directly in the dashboard (contacts, products, account settings) or by emailing us. If a customer of yours contacts us directly, we will refer them to you as the controller and assist you in responding. Customers can stop marketing messages at any time by replying STOP or ACHA; the assistant honours this automatically. You can also complain to the Personal Data Protection Commission of Tanzania.
9. Cookies and local storage
The dashboard uses browser local storage to keep you signed in and to remember interface preferences. Our website uses only essential cookies and does not use advertising trackers. Sign-in with Google or Facebook loads their scripts on the sign-in pages, which are governed by their policies.
10. Children
Moran is a business tool and is not intended for use by anyone under 18. We do not knowingly collect data from children. Contact us if you believe a child has provided data to us.
11. International transfers
Our servers and some providers are located outside Tanzania. Where personal data leaves the country we rely on contracts with our providers that require protection equivalent to this policy, and on the safeguards permitted by the Personal Data Protection Act, 2022.
12. Changes to this policy
We may update this policy. The new version will be posted here with a new effective date, and material changes will be announced by email or in the dashboard before they take effect.
13. Contact
Moran AI, Dar es Salaam, Tanzania · hello@moranai.co.tz