This Privacy Policy describes how the WhatsApp messaging platform operated at webocode.me (“we”, “us”, “the Service”) collects, uses, stores, and protects information when business customers use our API to send WhatsApp messages on behalf of their end users.
We provide a business-to-business messaging platform that connects client businesses to the Meta WhatsApp Business Platform (Cloud API). Our clients (tenants) use the Service to send transactional notifications such as warranty documents and appointment or results-ready alerts, and - where a client has been enabled for it and the recipient has separately opted in to offers and promotions - marketing messages. We act as a data processor on behalf of our business clients, who remain the data controllers for their customers’ personal data.
Depending on how the Service is used, we may process:
Device contacts (ZLA Inbox mobile app). If the business user turns on “Show names from your contacts” and grants the permission, the ZLA Inbox app reads the contacts saved on that user’s own phone to show the name they saved next to a customer’s number in the inbox. The matching happens on the phone only: contacts are held in the app’s memory while it runs, are never uploaded to us, never stored by the app, and never shared with Meta or anyone else. The feature is off until the user turns it on, and can be turned off in the app or by revoking the permission in the phone’s settings at any time.
We do not sell personal data or use end-user phone numbers for marketing on our own behalf. A client’s marketing messages are sent only to people for whom that client holds a separate opt-in to offers and promotions, and a request to stop them is honoured immediately and recorded.
Our business clients are responsible for obtaining valid opt-in from recipients before sending WhatsApp messages, honoring opt-out requests, and ensuring they have a lawful basis to process personal data. Clients must not send PHI or medical test results through WhatsApp; lab notifications must use secure, compliant portals linked separately.
We retain message records and usage ledger entries for as long as needed to provide the Service, resolve disputes, and meet billing and legal obligations, typically up to 24 months unless a longer period is required by law or agreed with the client. Encrypted business tokens are retained while the client account remains active.
We use encryption in transit (HTTPS/TLS), encrypt WhatsApp business tokens at rest, hash API keys, verify Meta webhook signatures, and restrict database access to internal networks. No system is completely secure; clients should protect their API keys.
Data may be processed on servers located outside your country. Meta may process message data in jurisdictions where it operates. Appropriate safeguards are applied as required by applicable data protection law.
End users should contact the business that sent them the WhatsApp message to exercise privacy rights (access, correction, deletion, objection). Business clients may contact us to export or delete tenant data associated with their account, subject to legal retention requirements.
The Service is intended for business use only and is not directed at children under 16.
We may update this policy from time to time. The “Last updated” date at the top will reflect changes. Continued use of the Service after updates constitutes acceptance.
For privacy questions or data requests regarding this Service, contact:
Email: privacy@webocode.me
Website: https://webocode.me