Trust and privacy
You are trusting us with your clients' phone numbers and your business's reputation on WhatsApp. This page explains what the product does with both.
Consent comes first
A marketing message only goes to someone who agreed to hear from that business, and the record of how they agreed is kept.
- Each consent stores the business, purpose, source, method, time, notice version and proof.
- Opt-outs from keywords, Meta's stop signals or your team cancel pending offers within ten seconds.
- When consent changes arrive from different places, the most recent action by the person wins.
- Proof of consent is kept for the life of the consent plus three years, with access restricted.
Each business kept separate
Running several brands should never mean mixing their clients.
- Every business has its own workspace, number, contacts, consent and budget.
- Access is checked on the server for every request, not just hidden in the interface. A role in one business grants nothing in another.
- Reports never merge contacts across businesses.
- Only safety holds cross over: an invalid number, a whole-organization deletion or a legal hold applies everywhere, without revealing which business it came from.
Requests to see or delete data
People can ask what you hold about them, correct it, withdraw consent or ask for deletion.
- Each request records whether it covers one business or every business you run.
- Requests are completed within 30 days.
- After a deletion, the person's records are never restored, and re-imports are blocked.
- If they write to you again later, they start as a new contact who can receive replies only.
How long data is kept
Proposed defaults, to be confirmed with counsel before launch.
| Data | Kept for |
|---|---|
| Contact profile | While active, plus 24 months after last interaction |
| Messages | 24 months |
| Media | 12 months |
| Consent proof | Life of the consent, plus 3 years |
| Contact exports | Deleted 7 days after creation |
| Application logs | 90 days, never message text |
| Audit log | 3 years |
| Backups | 35 days, rolling |
Security
Controls that are part of every release, not add-ons.
- Two-step sign-in required for owners and admins.
- Access to your Meta account is encrypted with a key for your business only, and never shown or logged.
- Exporting contacts needs its own permission, and every export is logged with its row count.
- An audit log of sensitive actions, including refused attempts, kept for three years.
- Each release must pass an external penetration test with no open critical or high findings before it ships.
India's DPDP Rules
The Digital Personal Data Protection Rules were notified in November 2025.
The main duties on notice, consent, security safeguards, breach reporting, retention and people's rights apply from May 2027. The product's consent records, deletion handling and breach runbook are built for them now. Hosting choices alone do not make a business compliant; how you collect consent still matters.
Questions about data?
Read the draft privacy notice, or ask us directly.