Privacy Policy
Template for review by qualified counsel before public launch. Replace every [FILL] marker. Last updated: 2026-10-10.
Who we are
WhatsTIG is operated by [FILL: legal entity name], registered in [FILL: country] under number [FILL: registration number], with its registered office at [FILL: address] ("we", "us"). Questions about this policy: [FILL: privacy contact email].
What we process
| Data | Why | Retention |
|---|---|---|
| Account data (name, email, password hash, sessions) | To run your WhatsTIG account | Until account deletion |
| WhatsApp session credentials | To keep linked accounts connected | Until logout or instance deletion; encrypted at rest |
| Message metadata (recipient/sender number, status, timestamps) | Delivery tracking, billing, audit | Plan retention × 2, then deleted |
| Message content and media | Sending, and history if you enable it | Plan retention period; can be disabled per project |
| Inbound media you choose to store | History and downloads through the API | Your plan's media retention period |
| Team inbox contacts (number, WhatsApp name, names and notes your team adds) and internal notes | Running your shared inbox | Contacts until you erase them; notes for your plan's message retention period |
| Team inbox conversation metadata (status, assignment, response times; no message content) | Inbox reports | 400 days |
| Webhook events and delivery logs | Reliable event delivery and debugging | 30 days |
| Audit logs (who changed what, with IP address) | Security and accountability | 365 days |
| Detailed usage records | Limits and billing | 400 days (daily totals kept for the life of the organization) |
| Server logs | Operating and securing the service | [FILL: log retention, e.g. 30 days] |
QR codes and pairing codes are held only in memory/cache for their short validity and are never stored permanently.
Roles
For messages and contacts you process through WhatsTIG you are the controller; WhatsTIG is your processor. For your own account data WhatsTIG is the controller.
Security
- Session credentials and webhook secrets are encrypted with AES-256-GCM using keys stored separately from the database.
- API keys are stored only as keyed hashes; the full key is shown once.
- Access to customer data is limited to the owning organization; internal access is logged.
Your choices
- Disable message-content retention per project (content is then kept only as long as needed to send).
- Delete instances, messages and media through the dashboard or API.
- Erase a team inbox contact together with all their conversations, messages, notes and attachments (for data subject requests).
- Close your organization to delete all of its data after the grace period.
Legal bases
We process account data to perform our contract with you, security and audit data for our legitimate interest in protecting the service, and billing records to meet legal obligations. [FILL: confirm bases for your jurisdictions.]
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| [FILL: hosting provider] | Application servers and database | [FILL] |
| [FILL: object storage provider] | Media storage | [FILL] |
| [FILL: email provider] | Account and notification emails | [FILL] |
We will announce new sub-processors at least 30 days in advance at [FILL: where changes are announced].
International transfers
[FILL: where data is stored and the safeguards (e.g. standard contractual clauses) used for transfers outside it.]
Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a supervisory authority ([FILL: lead authority]). You can change most account data and delete your account yourself in Account settings. For everything else write to [FILL: privacy contact email]; we answer within 30 days.
Recipients of messages you send through WhatsTIG should contact the organization that messaged them, which is the controller of that data; we assist our customers in answering such requests.
Data processing agreement
Our data processing agreement (DPA) for customers forms part of the Terms of Service. [FILL: link to the DPA, or how to request a signed copy.]
Cookies
The dashboard uses only strictly necessary cookies: a session cookie and a short-lived cookie used during sign-in security checks. We do not use advertising or third-party analytics cookies. [FILL: update if analytics are added.]
Changes
We will notify account owners by email of material changes at least 30 days before they take effect.
Contact
[FILL: privacy contact email] · [FILL: postal address]