Ceni app privacy

Information the app uses

We use your email address, name, organisation, role and access permissions to sign you in and keep accounts separate. Team sign-in can also use a verified WhatsApp number. We process conversations, replies, contact details and notes that you can access or add. Clients see only conversations and records permitted for their access.

We store sign-in-code hashes, session-token hashes, session dates, device names and security information such as request IP addresses and rate-limit records. If you enable notifications, we store a push token, platform, notification preferences and delivery results. Support requests include your identity, explanation and, for a message report, the selected message and author. Contact blocks store the people involved and the organisation.

Why and who can access it

We use this information to provide the service, route messages, enforce permissions, protect accounts and handle support or privacy requests. Conversation participants see permitted messages; authorised business users see their business records. Ceni support can review submitted reports and account requests. The service does not promise end-to-end encryption.

Our infrastructure and delivery processors include Vercel for hosting, Neon for database storage, Resend for email, Meta/WhatsApp for WhatsApp delivery when used, and Expo and Apple for push notifications. They process the information needed for their service, which can include message previews and device identifiers. Information may be processed outside the UK, subject to the applicable contractual safeguards.

Your phone and permissions

The app does not import your phone address book. Call, email, SMS and WhatsApp shortcuts open your chosen phone apps. Notifications require your permission and can be switched off. Optional app lock uses the phone’s biometric checks; Ceni does not receive your fingerprint or face data. Your app session token is kept in the phone’s secure storage.

Retention and your choices

Information is retained while needed to provide your organisation’s service, resolve support requests, maintain security and meet legal obligations. Signing out ends that app session and disables its registered push device; it does not erase your account or business messages. Use Account & privacy to request deletion or email support. We verify the request and explain what can be deleted, what must be retained and why. Deletion covers associated personal data, including messages and notes, except data we are legally required to retain. We normally complete verified requests within 30 days and confirm completion.

You can ask for access, correction, deletion or restriction and raise an objection where applicable. You can complain to the UK Information Commissioner’s Office at ico.org.uk.