Acolyte Marketing | Multi-Channel Marketing Platform

Section 1: General Platform Framework

1. Data Controller vs. Data Processor Distinction

Under European Union Regulation 2016/679 (General Data Protection Regulation or GDPR) and the California Consumer Privacy Act (CCPA):

The Merchant (Our Client): Acts as the Data Controller. You determine the lawful basis (consent or legitimate interest) for importing customer phone numbers, email addresses, and messaging them.
Our Platform (Acolyte Marketing SaaS): Acts solely as the Data Processor. We store, queue, and dispatch marketing sequences, transactional messages, and shared inbox chats exclusively on your documented instructions.

Lawful Basis Requirement: The Merchant warrants and covenants that all end-user recipients have provided verifiable prior express consent or opt-in proof before being enrolled into automated broadcast sequences.

Section 2: WhatsApp Business Cloud API Addendum

Dedicated Policy: /privacy/whatsapp

2. Meta WhatsApp Cloud API Privacy & Data Handling

When our WhatsApp Business messaging features are activated, all outbound and inbound message packets transit through Meta Platforms, Inc. Cloud API infrastructure located in high-security Meta data centers.

Data Transit & Encryption

All communications between our servers, Meta Graph API v26.0 endpoints, and end-customer devices are protected using TLS 1.3 cryptographic protocols with mandatory HMAC-SHA256 signature verification.

24-Hour Customer Care Window

Freeform messages and shared team inbox chats are permitted only within 24 hours of the customer's last inbound message. Out-of-window messages require pre-approved Meta Utility/Marketing templates.

2.1 WhatsApp Opt-in Consent & STOP / Opt-Out Processing

To comply with Meta Commerce & Messaging Policies, our platform implements automated compliance safeguards:

Automated Unsubscription: When an end user sends STOP, UNSUBSCRIBE, or CANCEL, our webhook worker automatically updates their marketing status to OPTED_OUT and isolates them in the Unsubscribe Contacts view.
Blocking Safeguard: Once opted-out, automated campaign engines will strictly refuse to dispatch marketing broadcasts to that phone number until formal re-opt-in proof is recorded.
Audit Trail: Inbound consent events, webhook challenge tokens, and opt-out timestamps are persisted with tamper-evident audit logs.

Section 3: Email Marketing & Transactional Addendum

Dedicated Policy: /privacy/email

3. Email Communications & Anti-Spam Compliance

Our email suite processes email addresses, delivery telemetry, bounce events, and engagement tracking. We enforce strict anti-spam regulations in alignment with Google and Yahoo 2024+ sender guidelines.

Mandatory One-Click Unsubscribe (RFC 8058):Every marketing email generated by our system automatically includes standard machine-readable headers (List-Unsubscribe: <mailto:...>, <https:...>) and a conspicuous footer unsubscribe link that processes unsubscription requests within 24 hours without requiring a password.

Sender Authentication Verification (SPF, DKIM, DMARC):Merchants using custom domain sending must authenticate their domain via DNS records. We do not permit sending from unauthenticated domains or third-party webmail domains (e.g. @gmail.com, @yahoo.com).

Telemetry & Open/Click Tracking:Transactional and promotional emails may contain anonymized 1x1 tracking pixels to calculate open rates and redirected links to measure click performance. Recipients may disable image loading in their email client to prevent open telemetry.

Section 4: SMS & RCS Messaging Addendum

Dedicated Policy: /privacy/sms

4. SMS & RCS Carrier Privacy Regulations

SMS and RCS message traffic is governed by carrier guidelines (The Campaign Registry / 10DLC) and the Telephone Consumer Protection Act (TCPA).

Explicit Written Opt-in: Promotional text messages may only be sent to individuals who have given express written consent specifying that marketing text messages will be delivered to their mobile number.
Quiet Hours Enforcement: Automated campaigns automatically restrict SMS dispatches outside of 8:00 AM to 9:00 PM recipient local time.
Standard Carrier Keywords: Our system immediately processes standard carrier keywords: STOP, HELP, INFO.

Section 5: Data Deletion & Rights (GDPR / Meta Callback)

Meta Requirement

5. User Data Deletion Request & Meta Callback Protocol

In accordance with Meta Platform Policy and GDPR Article 17 (Right to Erasure), any user whose data has been processed by our platform via Facebook Login or WhatsApp Business has the right to request deletion of their personal information.

How to Request Immediate Erasure:

Visit our dedicated deletion portal at https://xyz.com/data-deletion.
Enter your WhatsApp phone number (in international E.164 format) or your verified email address.
Upon submission, our automated compliance engine deletes your conversation history, contact tags, and marketing profile from active databases within 48 hours.
You will receive a unique cryptographic Confirmation Code and a permanent status URL to verify deletion status.

Go to Data Deletion Request Portal

Section 6: Authorized Third-Party Sub-Processors

6. Third-Party Infrastructure & Data Transfers

We engage the following vetted cloud infrastructure and telecommunication sub-processors under Standard Contractual Clauses (SCCs) to deliver our services:

Sub-Processor	Purpose	Location	Security Standard
Meta Platforms, Inc.	WhatsApp Cloud API messaging infrastructure	USA / EU	SOC 2 / ISO 27001
Amazon Web Services (AWS)	Database hosting, backups, & SES email gateway	US-East / Frankfurt	FedRAMP / ISO 27001
Twilio Inc.	Carrier SMS / MMS telecommunication routing	USA	SOC 2 Type II
Cloudflare, Inc.	DDoS mitigation, CDN, & TLS 1.3 termination	Global Edge	PCI-DSS / SOC 2