Service Level Agreement (SLA)

1. Introduction

This Service Level Agreement ("SLA") sets out the service levels, data protection commitments, and responsibilities between SMESS ("we", "us", "our") and our clients ("you", "your") in connection with the use of our WhatsApp messaging API and related services.

2. Data Ownership

You retain full ownership of all data you submit, store, or transmit through our platform, including customer phone numbers, message content, and business information. We do not claim ownership of your data.

3. Data Protection & Security

• Encryption: Data in transit is protected using TLS/SSL. Sensitive data at rest is encrypted using industry-standard algorithms.
• Access Controls: Access to production systems is restricted to authorized personnel only, protected by strong authentication and role-based permissions.
• Isolation: Client data is logically isolated. We do not share, sell, or rent your data to third parties.
• Backups: We perform regular backups to ensure data resilience and recoverability.

3.1 API Key Security

• Hashed at rest: Your API keys are stored as one-way cryptographic hashes. SMESS staff cannot view the plaintext of any active or revoked API key.
• One-time display: A plaintext API key is displayed to you exactly once upon creation or regeneration. It cannot be retrieved again.
• Client control: You have full control to create, rename, regenerate, revoke, and delete your API keys from the client portal.
• Account-level resources: All API keys under your account share your account message quota and WhatsApp connection status.

4. Confidentiality

We treat your data as confidential. Our staff and contractors are bound by confidentiality obligations and may only access your data when necessary to provide support or maintain the service.

5. Data Retention & Deletion

We retain your data only for as long as necessary to provide the service or as required by law. Upon account closure or your written request, we will delete or return your data in accordance with our data retention policy, subject to any legal obligations to retain records.

6. Compliance

We operate in compliance with applicable data protection laws, including the Ghana Data Protection Act and other relevant regulations. You are responsible for ensuring your use of the service complies with your own legal obligations, including obtaining necessary consents from your end users.

7. Uptime & Availability

We target 99.5% monthly uptime for our core API and platform services, excluding scheduled maintenance, force majeure events, and issues caused by third-party providers (e.g., WhatsApp/Meta, network providers).

8. Support & Incident Response

• Support Hours: Business hours, Monday–Friday.
• Response Time: We aim to acknowledge critical issues within 4 hours and non-critical issues within 24 hours.
• Incident Notification: We will notify affected clients of any security incident or significant service disruption as soon as reasonably practicable.

9. Subprocessors & Third Parties

We may use trusted third-party providers (e.g., hosting, payment, messaging gateways) to deliver the service. All subprocessors are bound by data protection obligations consistent with this SLA.

10. Your Responsibilities

• Use the service in compliance with WhatsApp Terms of Service and applicable laws.
• Obtain all necessary consents from your customers before messaging them.
• Maintain the security of your API keys and account credentials.
• Not use the service to send spam, illegal content, or harmful messages.

11. Limitations

We are not liable for issues arising from misuse of the service, third-party failures, internet connectivity problems, or events beyond our reasonable control.

12. Changes to this SLA

We may update this SLA from time to time. Material changes will be communicated to clients via email or through the platform. Continued use of the service after changes constitutes acceptance.

13. Contact

For questions about this SLA or data protection matters, contact us at sales@smess.io or WhatsApp +233 24 606 6666.