Legal

Privacy Policy

Last updated: 24 September 2026 · Effective immediately

This policy explains how Reachub Ltd. ("noli", "we") handles personal data - both for visitors of our website and for end-customers of merchants who use our service. We are GDPR-native by design: EU-hosted, explicit-consent, no bundled enrollment.

Who we are

Noli is a product of Reachub Ltd. (Рийчхъб ООД), a company registered in Bulgaria (EU) under UIC 206096116 (VAT BG206096116), with its registered office at 38 Bacho Kiro St., 1202 Sofia, Bulgaria. We provide loyalty and AI-agent software ("the Service") to eCommerce merchants ("Customers"), who in turn use it to communicate with their own customers ("End-Users").

For data we collect about visitors of this website and our direct Customers, we act as a data controller. For data we process about End-Users on behalf of our Customers, we act as a data processor - that relationship is governed by our Data Processing Agreement.

Data we collect

From website visitors

Pages viewed, referring URL, approximate location (country, region) inferred from IP
Device and browser type, screen size, language preference
Form submissions: email address and any message you send us

From Customers (account holders)

Account: name, work email, company, billing details
Service usage: actions taken in the dashboard, configuration changes, API calls
Support communications and any data shared with us during onboarding

Processed for our Customers (about their End-Users)

Customer profile: name, email, phone (if collected by the merchant), order history, points balance, tier
Conversational data: messages exchanged with the AI agent on behalf of the merchant
Behavioral signals used to personalize replies (last viewed product, opt-ins, opt-outs)

Why we process it

Provide and operate the Service (loyalty engine, AI agent, dashboards)
Bill Customers and prevent fraud
Improve product reliability, security and performance
Communicate service updates and respond to support requests
Comply with applicable laws and respond to lawful requests from authorities

Legal bases (GDPR Art. 6)

Performance of a contract - to provide the Service to our Customers
Legitimate interests - security, fraud prevention, product improvement, when not overridden by your rights
Consent - for non-essential cookies and any optional marketing communications. You can withdraw at any time
Legal obligation - to comply with EU/Bulgarian tax, accounting and law enforcement requirements

Where data is stored

All personal data is stored in the European Union - primary regions are Frankfurt (Germany) and Sofia (Bulgaria). Backups are also kept inside the EU. We do not transfer personal data outside the EU/EEA ourselves; the one exception is a messaging channel a Customer chooses to connect, such as WhatsApp, where messages are carried by the channel's provider under its own terms (see WhatsApp Business).

How long we keep data

Active Customer accounts - for the duration of the subscription
Closed accounts - deleted within 30 days of confirmed account closure, except for records we are legally required to keep (e.g. invoicing - up to 10 years per Bulgarian law)
End-User data processed on behalf of a Customer - retained per the Customer's instructions in the DPA, then deleted on termination
Website analytics - aggregated and anonymized after 14 months

We do not sell personal data. We share it only with carefully selected sub-processors that help us run the Service - for example, our cloud hosting and database provider, our payment processor, and our email-delivery vendor. A current list is maintained in Annex B of our DPA and includes the data categories shared with each.

We may also disclose data to lawful authorities when legally required, and to our professional advisers (legal, accounting) under confidentiality.

WhatsApp Business (Meta)

Noli is a Meta Tech Provider. A Customer can connect its own WhatsApp Business account to noli through Meta's Embedded Signup ("Connect with Facebook"). The Customer stays the owner of its WhatsApp Business account, phone number and message templates; noli acts on the Customer's behalf and only within the permissions the Customer grants in the Meta dialog (whatsapp_business_management and whatsapp_business_messaging).

What we receive from Meta when a Customer connects

The WhatsApp Business Account ID and phone number ID the Customer selected, the display phone number and the verified business name
An access token that lets noli send messages and manage templates for that account only
The message templates on that account and their review status

We do not receive the Customer's Facebook password, personal Facebook profile data, friends or any other Facebook or Instagram assets.

What we process about End-Users on WhatsApp

The End-User's WhatsApp ID (their phone number) and the profile name WhatsApp shares with the business
Messages the End-User sends to the business and the replies sent by the Customer or by its AI agent
Delivery and read receipts and Meta's billing category for each business-initiated message, used to show the Customer its delivery statistics and messaging costs

This data is processed on the Customer's behalf under our DPA and used only to operate the Customer's loyalty program, AI agent, campaigns and automations. Business-initiated WhatsApp messages are sent only as templates approved by Meta and only to End-Users who opted in with the Customer; End-Users can opt out at any time by replying STOP or by contacting the business.

Messages travel through the WhatsApp Business Platform operated by Meta Platforms Ireland Ltd., which processes them as described in the WhatsApp Business Data Processing Terms and may process them outside the EU under the safeguards those terms describe. WhatsApp message fees are billed by Meta directly to the Customer; noli does not handle those payments.

The access token and account IDs are kept in our EU database with access limited to the systems that send messages. They are deleted when the Customer disconnects WhatsApp or closes its noli account.

Data deletion instructions

Customers (businesses). To disconnect WhatsApp and delete the data noli received from Meta, open Settings → WhatsApp in the noli dashboard and click Disconnect. We stop sending and receiving messages for that number immediately, unsubscribe noli from the WhatsApp Business account and delete the access token and account IDs. You can also remove noli's access on Meta's side in Meta Business Settings → Integrations → Connected apps. To delete your whole noli account and all associated data, email support@heynoli.ai; we complete deletion within 30 days, except for records we must keep by law (e.g. invoices).

End-Users (customers of a business). Ask the business you shop with to delete your data - it is the controller and can erase your profile, including your WhatsApp ID and conversation history, from its noli dashboard. If you cannot reach the business, email support@heynoli.ai with the business name and your phone number and we will forward and track the request. We confirm deletion within 30 days.

Your rights under GDPR

You have the right to:

Access the personal data we hold about you
Request rectification of inaccurate data
Request erasure ("right to be forgotten") subject to retention obligations above
Restrict or object to certain processing
Data portability - receive your data in a structured, machine-readable format
Withdraw consent at any time, where consent is the legal basis
Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or your local supervisory authority

To exercise any of these rights, email support@heynoli.ai. If you are an End-User of a merchant who uses noli, please contact that merchant first - they are the controller of your data.

Cookies

We use a minimum of cookies. Strictly-necessary cookies (session, CSRF protection) are set without consent. Analytics cookies are only set after explicit opt-in. You can manage preferences via the cookie banner or your browser settings at any time.

Changes to this policy

We may update this policy as the Service evolves or law changes. Material updates are notified to Customers via email at least 30 days before they take effect. The effective date at the top reflects the latest version.

Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer at support@heynoli.ai. For general inquiries, support@heynoli.ai.