Hydra Merchant privacy policy

Effective date: 11 October 2026

Ziguru provides Hydra Merchant, an app that lets authorised people manage their business's Hydra account. This policy explains how we handle personal information when someone uses the app. A business may also record information about its members through Hydra.

Information we handle

• Business account information: the sign-in email, password submitted for authentication, account role, business identity, and session information needed to keep the user signed in.
• Member and business records: member names, phone numbers, optional email addresses, membership and activity records, campaign details, rewards, and the identity of staff who recorded an action. An authorised business user can view the records for their business and add a member after confirming that person's agreement to join.
• Service and security records: the time and outcome of actions and technical identifiers needed to operate, secure, and troubleshoot Hydra. Our structured webhook audit does not retain message bodies or member phone numbers.

Business administrators provide account details. A business or its staff record member details, and a member may provide details when joining that business through its join link or connected WhatsApp number. A user must provide sign-in details to access Hydra Merchant; member email addresses are optional.

How we use the information

We use this information to sign authorised users in, show their business's records, carry out actions they request, protect accounts, investigate failures, and provide support. If the business has connected its official WhatsApp number, Hydra also uses relevant member information to operate that business's joining and messaging features.

Hydra Merchant does not use advertising identifiers or track people across other companies' apps and websites for advertising.

Who can receive the information

Authorised users of a business can access that business's records according to their permissions. We use service providers to host and operate Hydra. When a business uses WhatsApp features, information needed to deliver those messages is shared with the connected messaging providers. We may disclose information where law requires it.

We do not sell personal information.

Some providers process information outside South Africa, including when they operate hosting or connected WhatsApp services. The countries can vary by provider and service. We use contractual and security safeguards for these transfers, including access controls.

Keeping information and protecting it

Hydra uses account permissions, authenticated requests, encrypted network connections, and secure storage for the app's saved session to protect information. We keep business and member records while the business uses Hydra. After the relationship ends, we retain or delete those records under the applicable offboarding agreement and any legal retention requirements. Contact us for details about the agreement that applies to your business. Short-lived operational records have separate retention periods; these do not determine how long business and member records are kept.

Your choices and requests

Business users can ask their business administrator to correct account access or records. For access, correction, deletion, an objection to processing, or a question about personal information handled by Ziguru, contact support@usehydra.co.za. We may need to verify a request and may have to retain information where a legal obligation applies. Members can also contact the business they joined about information that business recorded. You may lodge a complaint with the South African Information Regulator at POPIAComplaints@inforegulator.org.za.

Changes

We may update this policy when our practices change. The effective date above will show when the current version took effect.

Contact