You're trusting us with your customers' conversations. This page sets out exactly what we do with that data, who touches it and how long it's kept — with no promises that can't be verified.
The business owns its customers' data. We process it solely to provide the service. We don't sell data and we don't use it for advertising, and we don't collect location, contacts from the device, or anything beyond what is sent in the conversation itself.
Traffic is encrypted with HTTPS. Each business's WhatsApp access tokens are encrypted in the database with AES-256-GCM, so a database backup on its own does not expose them.
Separation is enforced in the database layer itself (Row Level Security), not only in application code. One business cannot reach another's data even if a bug is found in the code. An automated check runs on every change and confirms that no new table was added without that protection.
Every message arriving from Meta is cryptographically verified before it touches the system. A message that isn't properly signed is rejected — so fabricated conversations can't be injected into your inbox.
You decide how long conversations and media are kept. Deletion runs automatically and is logged — so "has my data been deleted?" has a recorded answer rather than a promise.
When a customer asks to see what's held about them, or to be deleted, you can export everything about them to a file or delete them entirely. Deletion is real deletion, including message history and files — not a "hidden" flag.
Opt-out requests ("הסר", "STOP") are honoured automatically by the bot, with nothing for you to do.
We rely on the following providers, and name them:
Replies are generated automatically and may be wrong — responsibility for their content rests with the business. We also don't guarantee absolute uptime and we have no signed SLA at present. We'd rather write that here than have you find it out the hard way.
The full legal detail is in the privacy policy and the terms of service.