Privacy
What we keep about you and for how long, as the code actually does it.
If you only read
You can read every page without giving us anything. We run no advertising or analytics trackers, and we do not set a cookie when you only read, apart from the one that remembers your language if you switch it.
The quieter “Website” button on a clinic page is counted as one click for that clinic on that day. The count holds no cookie, no address and no person.
If you set an alert
We keep the WhatsApp number or email address you give us, as you typed it, a one-way hash of it, the language you chose and the time you confirmed it.
Confirmation codes are kept only as hashes and are deleted a day after they expire.
We keep what you asked us to watch and a record of each alert we sent you. Stopping all alerts cancels the watches and signs this device out. Your number or address and the record of past alerts stay until you ask us to delete them.
This device keeps a signed cookie that remembers your alerts for up to a year, and a second one for 30 minutes while you confirm a code.
If you message a clinic through us
When you tap the WhatsApp button on a clinic page you write to the Hudhud number. For each chat we keep a one-way hash of your number, the first name on your WhatsApp profile if it shows one, the words of the message, the clinic, the language and the times of each step.
We keep your number itself only for chats we hand to a clinic, only until we send the follow-up message three days later, and never more than five days. Then it is erased. A STOP or PAUSE from you erases it at once.
The raw message that Meta delivers to us waits in our job queue and is emptied once it has been handled, or five days after we give up on it.
A clinic that has added its WhatsApp number receives a card with the service you asked about and a link that opens a chat with you; the link contains your number. A clinic that has only an email address receives the service you asked about and a reference code, not your number or your name. We never pass on your own words.
The hashed number, first name and message stay in the chat record, which is how we count a clinic’s five free messages. We keep the record while the service runs and delete it when you ask.
If you run a clinic
We keep the WhatsApp number and email address you give us for lead cards, the time you agreed to receive them, and the Stripe customer and subscription numbers if you subscribe. Card details go to Stripe and never reach us.
A removal request or a licence-number message keeps the email address, the facility, the text you typed and what we decided. We keep it as the record that the request was made.
Logs and who handles data for us
To limit how many messages one address can trigger, we log a hash of the address, the requester’s IP address, the kind of message and the time. These rows are deleted after 30 days.
Meta carries the WhatsApp messages, Resend sends the emails, Stripe takes the payments, Railway hosts the service and Cloudflare sits in front of it. Each keeps its own ordinary logs. The AI models that read clinic pages receive the text of those public pages and nothing about you.
Your choices
Stop alerts on the alerts page, or reply STOP to any message. Reply PAUSE to stop for a week.
To see what we hold about you, or to have it deleted, write to us and tell us the number or address you used.
Write to us at [email protected]