Privacy notice
Last updated: 4 October 2026
In short: we keep only what we need to run your shop book and answer you. We never store your phone number, never sell your data, and you can erase everything by typing DELETE in the chat.
1. Who we are
SoroEngine is a service of Charavol Technologies Ltd, a company registered in Nigeria (the “data controller”). Contact for anything about your data: privacy@charavol.com.
2. What we collect
| Data | Why |
|---|---|
| A one-way scrambled code (salted SHA-256 hash) made from your WhatsApp number. Not the number itself. | To recognise you when you message again. |
| Your language choice, the time you agreed to this notice, and the campaign tag in your first message (for example “[WEB]”). | To reply in your language, prove consent, and know which outreach channels work. |
| The text of your messages, and the text transcript of your voice notes. | To understand and answer you, and to fix mistakes. |
| The records you give us: sales, expenses, stock, debts (including names of people you mention), and loan requests. | To keep your shop book and give you summaries. |
| Technical data: message type, reply time, errors, which tips you received. | To keep the service working and measure the pilot. |
Voice recordings are not kept. We turn each voice note into text and then discard the audio. We do not collect your location, contacts, photos or payment details.
3. Legal basis
We process your data on the basis of your consent, which you give by tapping “I agree” before SoroEngine does anything else (Nigeria Data Protection Act 2023, section 25). You can withdraw consent at any time by typing DELETE.
4. Who processes your data for us
We use these service providers, each under contract and only to run SoroEngine:
- Meta (WhatsApp Business Platform): delivers messages between you and SoroEngine. WhatsApp’s own privacy policy also applies to your use of WhatsApp.
- Supabase: our database, hosted in the European Union.
- Railway: runs the server that receives WhatsApp messages.
- Modal: runs our AI models (speech recognition, the N-ATLaS language model and voice) on servers in the United States. The models run on our own account; your messages are not used to train anyone else’s AI.
Some of these providers are outside Nigeria. We rely on your consent and on the providers’ contractual data-protection safeguards for these transfers (NDPA 2023, sections 41–43).
5. Research and the NAIC 2026 evaluation
SoroEngine is part of the National AI Champions (NAIC) 2026 programme. We may share anonymised usage records (no phone numbers or hashes, no names) and overall statistics with the programme organisers (NITDA / NCAIR) to show how the service is used. We may also use anonymised transcripts to improve SoroEngine’s understanding of Nigerian languages.
6. How long we keep it
Until you type DELETE, or 12 months after your last message, whichever comes first. After that, your records are erased. Anonymised statistics may be kept.
7. Your rights
Under the NDPA 2023 you can ask to access, correct, erase or receive a copy of your data, object to or restrict its use, and withdraw consent. Type DELETE in the chat for instant erasure, or email privacy@charavol.com for anything else; we reply within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
8. Security
Data is encrypted in transit, the database is only reachable with our server’s secret key, phone numbers are hashed before storage, and access is limited to the SoroEngine team.
9. Age
SoroEngine is for traders aged 18 and over.
10. Changes
If we change this notice in a way that affects you, we’ll tell you in the chat before the change applies.