Data processing agreement

Roles

You decide which numbers are linked, who may see the archive, and what the monitoring is for. That makes you the controller and us the processor. We act on your documented instructions, which for most purposes means the configuration you set in the product.

Scope of processing

Categories of data: message content and metadata on linked numbers, attachments, the phone numbers and display names of participants, and your users' account details.

Data subjects: your employees who use the linked numbers, and the customers who message them.

Purpose: archiving, search, reporting and export, as configured by you.

Duration: the retention period you set, which is 12 months by default and three years for the access audit, plus 30 days after termination for export.

Security measures

The measures are described in detail on the security page. In summary:

• Row-level isolation between tenants, enforced by the database and not only by application code.
• WhatsApp session credentials readable by a single service, with no grant to the internet-facing application.
• Media encrypted at rest with per-tenant keys; decryption keys held only while a download is incomplete and deleted on completion.
• An append-only archive with a per-number hash chain, so alteration is detectable.
• A synchronous access audit: every read is recorded before data is returned, and a failed audit write fails the read.

Sub-processors

We use cloud hosting and storage, a transactional email provider, and a payment processor. Only for workspaces whose owner switches AI assessments on, we also use DeepSeek, which receives conversation text as described on the security page. We will give you notice before adding a sub-processor that handles conversation content, and you may object.

Breach notification

We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time and what we are doing. We will not wait until we have a complete picture to tell you something happened.

What we publish about capture and availability, and how each figure is measured, is set out on the public reliability page.

Return and deletion

On termination you may export the archive for 30 days. After that it is deleted, including from backups on their normal rotation. We will confirm the deletion date in writing.