Privacy

WhatsEngage is a platform for sending and receiving WhatsApp messages through Meta's official WhatsApp Business Platform. The company that operates it is not named here yet — see the notice above.

There are two different relationships here and they matter. For your own account — your name, your email, your billing — we decide what is collected and why. For the contacts you message, you decide: they are your customers, you loaded them, and we hold them on your behalf.

Your name and email address, so you can sign in and we can reach you.

Your workspace: its name, the people you invite and the role each has.

Billing records — what plan you are on, what you were charged and what you paid. Card details are never held by us; they are handled by the payment gateway.

Ordinary server logs, which include IP addresses, for security and debugging.

Your contacts: phone numbers, names, tags, custom fields, notes, and their consent history — including every opt-out and opt-in, with when and how it happened.

Your conversations: the messages sent and received through your connected WhatsApp number, and any media attached to them.

Your campaigns, automations, flows and templates, and the per-recipient delivery results behind them.

You are responsible for having a lawful basis to message these people. The product enforces opt-out handling regardless — STOP works in every account and cannot be switched off — but that is a safety net, not your consent record.

Meta Platforms, necessarily. Every message goes through the WhatsApp Business Platform, so Meta processes the phone number and content of anything you send or receive, under its own terms.

Supabase, which hosts the database, authentication and file storage.

The payment gateway, for billing, which sees the payment details we never do.

The AI provider whose key you supply, if you turn on AI replies — and only the conversation content needed to answer. If you do not configure a key, nothing is sent to any AI provider.

Our error reporting, when something breaks. Request bodies, query strings and authorisation headers are discarded wholesale before anything leaves the server — not filtered field by field, because a filter that keeps "safe" fields leaks the first time somebody adds a field it has not heard of.

We do not sell anything to anyone, and there is no advertising or analytics network embedded in the product.

Every workspace is isolated at the database level by row-level security, so one customer's query cannot return another customer's rows even if the application asks it to. That isolation is tested against the live database rather than assumed.

Your WhatsApp access token is encrypted at rest with AES-256-GCM and is never returned by any screen or endpoint, including to you.

Traffic is over HTTPS. Passwords are handled by Supabase Auth and are never visible to us.

Your account data and your contacts and conversations are kept while your workspace exists. Delete a contact and it is removed; delete the workspace and its data goes with it.

Consent events and billing records outlive the rows they refer to on purpose: "this person opted out on this date" and "this invoice was for this amount" are facts we may need to show later, including to prove we stopped messaging somebody.

The admin audit log is append-only. Nobody can edit or delete an entry, including us.

A copy of your data — contacts, conversations, campaign results and consent history are all exportable as CSV from inside the product, without asking us.

Correction or deletion of your own account details, and deletion of your workspace.

If one of your contacts asks you to delete them, you can do it yourself, and doing so removes their messages with them.

Ask us and we will help with anything the product cannot do on its own.

A session cookie so you stay signed in, and a stored preference for your theme. That is all — there are no advertising or tracking cookies, and the public pages set nothing at all until you sign in.

If this policy changes in a way that affects you, we will tell you rather than quietly editing the page.