Privacy Policy

Draft template – the operator has not completed these terms yet.

[Your Company Ltd] ("we") operates WhatsApp Commerce. This policy explains how we handle personal data.

Business customers (our clients)

We collect your name, email, business details, billing information (processed by Stripe) and usage data to provide and bill the Service, under contract and legitimate interests. We keep it for the life of your account plus 6 years for tax records.

Your customers (shoppers who message you)

When shoppers message a business that uses our Service, we process their WhatsApp number, name, messages, orders, delivery address and preferences on behalf of that business, which is the controller. Questions about that data should go to the business; we help them respond.

Sub-processors

Meta Platforms (WhatsApp Cloud API), Stripe (payments), our hosting provider, and AI model providers configured in our AI platform (e.g. OpenAI or OpenRouter) for generating replies. Some may process data outside the UK under appropriate safeguards (UK IDTA / adequacy).

Retention

Chat transcripts – including earlier WhatsApp Business app conversations a business imports when it connects its number – and media are kept for the business's configured period (default 24 months) and deleted on request. Contacts imported from the WhatsApp Business app are never treated as having agreed to marketing; they must opt in separately. The activity log keeps IP addresses for 90 days and entries for 24 months. Payment-proof images are kept only as long as needed to confirm payment. Records of marketing consent and opt-outs are kept for 6 years after the last contact – even if the rest of a person's data is erased – so that we can prove consent and honour opt-outs.

Security

Credentials are encrypted at rest (AES-256-GCM), webhooks are signature-verified and access is key-based with role separation.

Your rights

You can request access, correction, deletion, restriction or portability, and object to processing, by contacting [contact email]. You can complain to the ICO (ico.org.uk).

Last updated: 2026-11