Privacy policy

Last updated: 2026-10-30

RITU Wellness Inc. ("RITU", "we", "us") operates Sal: the pages at heysal.co and the Sal line on WhatsApp. This policy explains what information we collect when you use them, how we use it, who we share it with, and the choices you have. By messaging Sal, visiting heysal.co or paying a deposit, you accept this policy. If you do not accept it, do not use Sal.

Sal is for business owners and the people who act for a business. It is not offered to consumers or for personal use.

What we collect

Your WhatsApp number. WhatsApp gives it to us when you message Sal. We use it to reply and to keep your conversation in one place. We do not store the profile name WhatsApp shows.

What you write. We keep the messages you send and the replies you receive. Sal asks about your business: what you do and where, what caught your eye, what is hardest about your leads, roughly how many you get, who follows them up and the tools you use. You decide what to answer. Whatever you send, we keep with your conversation.

Links you send. If you send a link to your website or a social profile, we keep it.

Information about your business from public sources. We may read your website and other public pages about your business, such as business listings and social profiles, to understand what you do, and keep what we learn with your conversation.

Photos, voice notes and files. We do not download them. We record only that one arrived.

Records about the conversation. When you first and last wrote, whether you asked for a person, whether you said STOP, how the conversation went, and the working notes our system makes for each reply.

Payment records. If you pay a deposit, you pay on Stripe's checkout page. Stripe collects your card details and may ask for your email and billing details; those go to Stripe, not to us. We receive and keep a record of the payment: the amount, the currency, Stripe's reference numbers, the dates, and the status of any refund or dispute.

Website visits. The pages at heysal.co have no forms. We measure visits with analytics tools (currently Vercel Web Analytics, which sets no cookie): the page, the button, the link that brought you, and general details about your browser and region. We may add other analytics tools and will list them here.

How we use it

We use the information above to:

• run the waitlist, reply to you, and keep your place on it;
• decide which businesses Sal serves first and in what order;
• build, test, train and improve Sal, including the AI models behind it, using conversations with contact details removed;
• contact you on WhatsApp about Sal: the waitlist, the launch, offers and updates, until you say STOP;
• take deposits, issue refunds and keep the records payment and tax rules require;
• measure and improve heysal.co;
• detect and prevent abuse, enforce our terms, protect our rights, and comply with the law.

Information that no longer identifies you may be kept and used for any purpose, without limit in time.

Sal is AI, and a person can read the conversation

Sal is an AI system. Its replies are generated by AI models and reviewed by no one before they are sent. A founder of RITU can read any conversation and take it over. Sal tells you it is AI before it offers a deposit, and whenever you ask. If you say "Hannah", or ask for a person, the conversation goes to her.

Before any message reaches an AI provider, our code removes phone numbers, email addresses, links and street addresses from it. Names are not removed. Do not send us names, contact details or other personal information about your customers or anyone else; Sal does not need them, and you are responsible for anything you send.

Who we share it with

We share information with companies that provide services to us, each for its own part of the work:

• Meta (WhatsApp) carries every message between you and Sal.
• Supabase stores the conversations and records.
• Anthropic provides the AI models that read and write Sal's replies. It receives message text with contact details removed; it does not receive your WhatsApp number.
• Vercel hosts heysal.co and the code that runs Sal, and provides website analytics.
• ntfy delivers an alert to the founder when a conversation is handed over.
• Stripe processes deposits and refunds.

Several of these companies are in the United States or elsewhere outside Canada. Your information may be stored, processed and accessed there, where the law may differ from the law where you live, and by using Sal you consent to that.

We may also disclose information to comply with a law, a court order or a lawful request; to enforce our terms and protect our rights, property and safety or those of others; to investigate abuse; and to a buyer, successor or financing partner if RITU or Sal is sold, merged, reorganized or financed, in which case your information may be transferred as part of that transaction.

We do not sell personal information for money.

How long we keep it

We keep information for as long as we need it for the purposes above and as the law requires. Currently, a conversation and the records kept with it are deleted 12 months after the last activity in it; the working notes behind each reply are cleared after 30 days. Payment records are kept separately for as long as payment, tax and dispute rules require. Information held by the companies above is kept under their own terms. These periods may change; the current version of this policy states them.

Saying STOP does not delete your conversation. It is deleted on the schedule above, or sooner if you ask and the law allows.

Your choices and rights

• Stop messages. Send STOP (or "unsubscribe", "cancel", "quit", "opt out"). Sal confirms once and goes silent. If you message again later, the conversation reopens and these terms apply again.
• Talk to a person. Say "Hannah" in the conversation.
• Access, correction and deletion. Write to privacy@heysal.co to ask what we hold about you, to correct it, or to have it deleted. We will verify that the request comes from you, respond within the time the law requires, and act on it except where we are required or permitted to keep the information, including to complete a transaction, keep payment records, enforce our terms or defend a claim.
• Withdraw consent. Send STOP and ask for deletion. Withdrawing consent ends your place on the waitlist.
• Complain. You may complain to us first at privacy@heysal.co, or to the regulator where you live: in Canada, the Office of the Privacy Commissioner of Canada or British Columbia's Office of the Information and Privacy Commissioner; in Quebec, the Commission d'accès à l'information.

Rights vary by where you live. We honour the rights the law that applies to you gives you, in the way it requires.

Security

Every message from WhatsApp is checked against Meta's signature before we accept it. Our database accepts connections only from our own server. Contact details are removed before messages reach AI providers, alerts or logs. No system is fully secure, and you send information to us at your own risk. If a breach creates a real risk of serious harm to you, we will notify you and the regulator as the law requires.

Age

Sal is for adults running a business. Do not use Sal if you are under 18. We do not knowingly collect information from anyone under 18 and will delete it if we learn we have.

Changes

We may change this policy at any time. The date at the top tells you when it last changed. Using Sal after a change means you accept the changed policy. For a significant change we will also tell you in the conversation the next time you write, or by WhatsApp where WhatsApp permits us to message first.

Who is responsible, and how to reach us

RITU Wellness Inc., a corporation under the laws of Canada, is responsible for the information described here. The person in charge of the protection of personal information is the Founder, reachable at privacy@heysal.co. All privacy questions and requests go to that address.