WhatsApp Data Policy

1. Scope

This document supplements the Privacy Policy and applies specifically to data received, processed and sent through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc.

It applies when a business connects its WhatsApp Business number to VybeFlow, and when someone sends a message to that number.

VybeFlow does not use QR-scanning gateways and does not take over anyone's personal WhatsApp session. Numbers are registered through Embedded Signup using the relevant business's own Facebook Business account.

2. Who plays which role

If you are a customer and want to know how your messages are handled, or want your data deleted, contact the business you were messaging. They are the controller; we process on their instructions.

3. What we receive

When someone messages a WhatsApp Business number connected to VybeFlow, we receive from Meta:

• the sender's phone number and the WhatsApp profile name they display;
• the message content — text, image, document, audio, location, or interactive message;
• message metadata — message identifier, timestamp, and delivery status (sent, delivered, read, failed);
• account identifiers — the business phone number and the WhatsApp Business Account identifier.

We do not receive and cannot access: the customer's contact list, their conversations with anyone else, or any WhatsApp history outside the conversation with that business number. The WhatsApp Business Platform gives nobody such access.

4. What it is used for

• Presenting the conversation in the business's Inbox and organising it into tickets.
• Generating automatic replies through an AI agent, where the business has enabled it for that conversation. Relevant content is sent to AI model providers as described in Privacy Policy section 6.
• Sending outbound messages composed by the business or its agent, including campaigns using Meta-approved templates.
• Showing delivery status and usage figures to the business owning the number.

Data received through WhatsApp is not used for advertising, not sold, and not used to train AI models.

5. The 24-hour window and templates

These rules come from Meta, not from us, and we cannot relax them.

• Within 24 hours of the customer's last message, the business may reply with free-form messages.
• Outside that window, messages can only be sent using a template reviewed and approved by Meta. Template content cannot be freely altered at send time; only the defined parameters may be filled in.
• The number of new customers that may be contacted per day is capped by the messaging tier Meta assigns to that number.
• Meta assigns each number a quality rating based on recipient responses. A deteriorating rating can lower the tier or disable the number.
• WhatsApp Status/Story is not available on the Business Platform.

6. How to stop receiving messages

A customer can stop receiving messages from a business at any time, by any of these means:

• replying with STOP, BERHENTI, or a comparable request in plain language;
• tapping the unsubscribe button where a template message provides one;
• blocking the business number directly in the WhatsApp app;
• reporting the number to WhatsApp.

Businesses using VybeFlow must honour opt-out requests and stop sending marketing messages to that number. This duty is also stated in Terms & Conditions section 5, and breaching it can lead to account suspension here and to action by Meta against the number itself.

7. Storage and retention

Conversation contents are stored in the relevant business's account for as long as that account is active, because that history is what lets an agent recognise a returning customer and lets tickets be traced.

• A business can delete a conversation or a contact from the console at any time.
• After a business account is closed, all conversations are deleted or anonymised within 90 days.
• Media attachments are stored with their conversation and follow the same period.

Note that Meta also processes and retains message data under its own policies, independently of what we keep.

8. Who the data is shared with

Data received through WhatsApp is shared only with: Meta Platforms, Inc. (as the platform operator), AI model providers when an automatic reply is generated, and the infrastructure providers the Service runs on. The full subprocessor list is in Privacy Policy section 7.

We may disclose data where required by law or a valid court order.

9. Deletion requests

If you are a customer and want your conversation deleted, ask the business you were messaging — they are the controller and can delete it directly from the console. If you get no response, you may contact us at the address in section 11 and we will pass the request on to that business.

If you are a business wanting to delete all of your account data, follow the procedure in Privacy Policy section 11.

To revoke app access from your Facebook account: Settings & privacy → Settings → Apps and websites, then remove VybeFlow. Revoking access stops new data from flowing but does not delete data already stored.

10. Compliance with Meta's policies

Use of the WhatsApp Business Platform through VybeFlow is subject to Meta's policies, including the WhatsApp Business Messaging Policy and the WhatsApp Business Solution Terms. Meta may change those policies at any time, and such changes apply regardless of what this document says.

VybeFlow is an independent Tech Provider. We are not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. WhatsApp, Instagram and Meta are trademarks of Meta Platforms, Inc.

11. Contacting us