How WhatsApp Message Data Is Processed
When an enterprise merchant or customer interacts with our WhatsApp messaging gateway, message payloads are processed using Meta Platforms, Inc. Cloud API (Graph API v26.0).
Direct server-to-server TLS 1.3 cryptographic tunnels with HMAC-SHA256 signature verification on every incoming webhook.
Customer service chats are strictly bounded by Meta's 24h rolling care window. Out-of-window messages require pre-approved templates.
Consent Collection Before Outbound Dispatches
In accordance with the WhatsApp Business Messaging Policy, merchants utilizing our SaaS agree to the following obligations:
- Unambiguous Prior Consent: Merchants must obtain clear, affirmative opt-in consent from recipients before sending any marketing or transactional message. Consent must clearly state the business name and types of messages to be sent.
- Audit Proof Maintenance: Merchants must record the date, time, IP address, or physical form where consent was obtained, and furnish this proof within 48 hours upon audit request.
- No Purchased Lists: Uploading third-party lists, rented directories, or scraped contact numbers is grounds for permanent WABA suspension.
1-Tap Customer Opt-Out Safeguard
Our platform features an automated webhook processor that listens for incoming opt-out keywords:
Upon receipt of any opt-out keyword:
- The recipient's status is instantaneously changed to OPTED_OUT.
- The phone number is quarantined in the Unsubscribe Contacts directory.
- Future marketing campaign dispatches to this number are hard-blocked by our queue engine.
Meta Cloud Infrastructure & Right to Erasure
Sub-Processor: Meta Platforms, Inc. acts as our primary telecommunication and Cloud API infrastructure provider. Data is stored in ISO 27001 / SOC 2 certified data centers located in the United States and the European Union.
Data Deletion Requests: Any recipient wishing to delete their phone number, message history, and metadata from our servers can submit a request at our dedicated portal:
dpo@xyz.com