Privacy policy

Last updated: 9 November 2026

1. Who runs Dealo

Dealo OS (“Dealo”, “we”) is run by Heracules Design & Tech Ltd. We decide how and why the personal data described here is used.

Dealo is an AI business assistant for car dealers and property agents. It works on WhatsApp, on the web at app.usedealo.com, and later in a mobile app.

2. What data we collect

Account data: your name, email address, phone or WhatsApp number, and how you sign in.
Business data: your business name, country, team members and their roles, branding and settings.
Listing and customer data: the cars and properties you add (details, prices, photos, videos), and the customers, enquiries, deals, reminders and appointments you record. This can include your customers’ names and phone numbers. You are responsible for having a right to record them.
Messages: the WhatsApp messages, photos and voice notes you send to Dealo, and Dealo’s replies. The same goes for chats in the web dashboard and the mobile app.
Payment records: what you bought, the amount, the currency and the date. Card and bank details are handled by our payment provider; we do not store them.
Device and usage data: device and session details for security, the country and time zone of your connection, and log entries. Full IP addresses are kept in logs for at most 30 days.
Instagram data, if you connect Instagram: the connected account’s ID and username; the posts Dealo itself publishes for you; and comments on your business’s own posts that contain a keyword you set, with the commenter’s Instagram-scoped ID and username, and replies to Dealo’s private reply.

We do not sell your data and we do not use cookies on this website.

3. Why we use it

To provide Dealo: to run your account, store your listings and customers, answer your messages, send reminders and your daily briefing, and prepare posts for you to share.
To take payments and keep the records the law requires.
To keep Dealo secure, prevent abuse and fix problems.
To contact you about your account, such as sign-in codes, receipts and service notices.

Instagram data is used only to publish what you approved and to respond to and record enquiries about your own listings. It is not used for advertising, profiling, selling or sharing data, training machine-learning models, or any other purpose.

We use your data under the data protection law that applies to you, including the Nigeria Data Protection Act 2023: to perform our contract with you, to meet legal duties, for our legitimate interests in running a secure service, and with your consent where the law asks for it.

We share some data with service providers that help us keep Dealo running, such as the services that host it, deliver messages and email, take payments and power the AI replies. They may use the data only to provide those services to us. We configure the AI service so your business data is not used to train its models.

Inside Dealo, your business data is visible only to the members of your business, according to their role. Another business can never see it. We do not sell your data. We may also disclose data when the law requires it.

5. How long we keep it

We keep your account and business data while your account is open.
When you delete your account (see our data deletion page), your account, login methods, devices, messages and stored files are deleted, and any remaining copies, such as backups, are removed within 60 days.
Payment records are kept as the law requires, for 6 years, with the business’s name.
Full IP addresses in logs are kept for at most 30 days. After that, logs keep only the country or a shortened address.
Instagram access tokens are deleted at once when you disconnect Instagram.

6. Where it is processed

Dealo’s servers and service providers are in several countries, including the European Union and the United States, so your data may be processed outside the country where you live. We use providers that protect data to a standard we consider appropriate and we sign the agreements the law asks for.

7. How we keep it safe

Data is sent over encrypted connections.
Instagram access tokens are encrypted with AES-256-GCM, using a key for each business that is itself encrypted under a master key kept apart from the data.
Sensitive actions, such as connecting Instagram, changing sign-in details or deleting an account, need an extra check such as a code sent to you.
Each business’s data is separated from every other business’s.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit or stop how we use it, or move it to another service. You can withdraw your consent at any time. You can also complain to your local data protection authority or to the Nigeria Data Protection Commission.

To use a right, email support@usedealo.com from the email address on your account or message Dealo on WhatsApp from your registered number. To delete your data, follow the steps on the data deletion page.

To disconnect Instagram, open Dealo, choose Instagram settings and Disconnect (or message Dealo “Disconnect Instagram”). You can also remove Dealo OS in Instagram under Settings, Apps and websites.

9. Children

Dealo is for businesses and for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has used Dealo, email support@usedealo.com and we will delete the data.

10. Changes to this policy

We may update this policy. We will change the “Last updated” date above and, for important changes, tell you in Dealo or by email.

11. Contact

Heracules Design & Tech Ltd. Email: support@usedealo.com.