Privacy Policy

1Overview & Scope

This Privacy Policy explains how Rich Rlephant Marketing Whatsapp API (“we”, “our”, or “the Platform”) collects, processes, stores, and protects data when businesses and end-users utilize our WhatsApp Business SaaS platform, developer APIs, bulk campaigns, and shared team inbox.

We operate exclusively through official Meta Cloud API endpoints (Meta Platforms, Inc.) and are committed to maintaining the highest standards of data integrity, confidentiality, and regulatory compliance across global data protection frameworks (including GDPR, CCPA, and UAE Federal Decree Law No. 45 of 2021).

2Information We Collect & Process

To deliver enterprise WhatsApp messaging services, we process the following categories of information:

• Customer Profile & Contact Data: E.164-formatted phone numbers, customer names, contact tags, custom CRM attributes, and verifiable opt-in source metadata.
• Message Content & Transmission Logs: Inbound and outbound message text, interactive button payload identifiers, media attachments (images, PDFs, audio voice notes), and timestamped delivery receipts (sent, delivered, read, failed).
• Consent & Opt-Out Records: Verifiable consent timestamps, opt-in source categories, and suppression entries triggered by automated opt-out keywords (e.g., STOP, CANCEL, UNSUBSCRIBE).
• Meta Cloud API Credentials: WhatsApp Business Account (WABA) IDs, Phone Number IDs, App IDs, and encrypted System User access tokens.
• Platform Usage & Audit Logs: User session data, IP addresses, audit log entries of administrative actions, API key generation records, and webhook delivery attempts.

3How We Use Your Information

We process data strictly for the following operational purposes:

• Transmitting WhatsApp marketing broadcasts, utility notifications, and authentication codes via official Meta Cloud API v21.0.
• Powering the Shared Multi-Agent Inbox with real-time collision locks, team triage, and conversation assignments.
• Validating and submitting WhatsApp message templates to Meta for approval.
• Executing visual no-code chatbots and automated intent routing.
• Enforcing strict suppression lists to protect end-users from unwanted communications and guarantee zero ban risk.
• Authenticating developer REST API requests using SHA-256 hashed keys and HMAC-SHA256 signed webhooks.

4Meta Platforms, Inc. & Sub-Processors

Our platform connects to official APIs operated by Meta Platforms, Inc. (1601 Willow Road, Menlo Park, CA 94025, USA). When messages are transmitted, message data passes through Meta’s global Cloud API infrastructure in accordance with the Meta Commercial Terms and WhatsApp Business Terms of Service.

Our authorized sub-processors include:

5Data Security & Tenant Isolation

We implement industry-grade security measures to protect customer data:

• Row Level Security (RLS): Strict database isolation guarantees that no workspace or tenant can ever view or access data belonging to another tenant.
• Cryptographic Envelope Encryption: Meta Access Tokens and sensitive webhook secrets are encrypted at rest using AES-256-GCM authenticated encryption.
• Role-Based Access Control (RBAC): Granular permissions ensure customer contact lists cannot be exported by unauthorized personnel or Super Admins.
• TLS 1.3 Encryption in Transit: All web traffic, API requests, and Meta webhook events are encrypted using modern TLS certificates.

6End-User Rights & Opt-Out

Every WhatsApp recipient maintains complete sovereignty over their data. Recipients can opt out at any time by replying with the keyword STOP. Our automated suppression engine immediately adds the number to the tenant suppression registry, preventing any further marketing broadcasts.

Under GDPR and CCPA, users have the right to request access to, correction of, or deletion of their personal data (Right to Erasure). Requests may be submitted directly to our Data Protection team.

7Contact Information

For privacy inquiries, Data Protection Officer requests, or compliance auditing, contact our team: