1) What we collect

Depending on your usage, we may collect and process:

  • Account & business info: business identifiers (e.g., Business Account ID), WABA ID, phone number IDs, app-scoped user IDs.
  • Messaging metadata: timestamps, delivery/read statuses, message IDs (e.g., wamid), template names, and webhook event payload metadata.
  • Customer-provided content: configuration settings, webhook URLs, opted-in phone numbers and consent records you store in our system.
  • Technical data: IP address (for security), browser/device info, logs and diagnostics to prevent abuse and troubleshoot issues.
Note: For WhatsApp Cloud API, message content is transmitted through Meta's systems. We only retain content when necessary for the features you enable (e.g., logs, conversation context).

2) How we use information

  • To provide core functionality (WhatsApp messaging, automation workflows, reporting, and account linking).
  • To operate and secure the service (fraud prevention, rate limiting, abuse detection, and incident response).
  • To support you (debugging issues, responding to requests, and maintaining service reliability).
  • To comply with legal obligations and enforce our terms (where applicable).

3) Legal bases (high-level)

Where applicable, we process data based on: performance of a contract (providing the service), legitimate interests (security and fraud prevention), consent (where you or your users provide it), and legal obligations.

4) WhatsApp & Meta Platform data

Our service integrates with Meta Platforms. When you connect your WhatsApp Business assets, we may access and store identifiers needed to send/receive messages and manage your configuration.

  • We follow Meta Platform Policies and WhatsApp Business Messaging Policies.
  • We recommend you collect clear user opt-in before sending business-initiated messages.
  • Users can opt-out from receiving messages (e.g., "STOP").

4.1) Advertising & measurement cookies

This website can run the Meta Pixel (Facebook/Instagram), the Google Ads conversion tag and Google Analytics. These tools send the provider the pages you visit, your browser and device information, your IP address, and certain interactions on the site (for example, submitting the contact form). We use them to measure ad performance and to show our ads to relevant people.

  • Your form details reach Meta only in hashed form. If you have consented to advertising cookies, the name, email and phone you enter in the contact form are irreversibly hashed in your browser (SHA-256) before being sent to Meta, which compares them against its own records solely for ad measurement and matching. They are never sent in plain text, and are not sent to Google at all. Without your consent, nothing is sent.
  • They only run with your consent. On your first visit a cookie banner asks for your choice; advertising and measurement cookies are off by default and are loaded only if you accept. If you decline, these tools are never loaded and the site keeps working the same way.
  • You can change your choice at any time with the Cookie Preferences link in the footer. Withdrawing consent deletes the first-party cookies these tools have written. You can also block them through your browser's cookie settings or with an ad blocker.
  • You can manage your ad preferences at facebook.com/adpreferences for Meta and myadcenter.google.com for Google.

5) Sharing and disclosure

We may share information only in the following cases:

  • With Meta Platforms to enable WhatsApp Cloud API / Login features.
  • With service providers (hosting, logging, monitoring) under confidentiality obligations.
  • For legal reasons if required by law or valid legal process.
  • Business transfers (merger/acquisition) with appropriate safeguards.

We do not sell personal data.

6) Data retention

We retain information for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods may vary based on the data type.

7) Security

We implement reasonable technical and organizational measures to protect data, including access controls, encryption in transit (HTTPS), and logging/monitoring. No system is 100% secure, but we work to protect your information.

8) Your rights & requests

You can request:

  • Access to the data we hold about you
  • Correction of inaccurate data
  • Deletion of data (where applicable)
  • Information about processing

Contact us at destek@stools.digital. We may need to verify your identity or business ownership before fulfilling requests.

9) International transfers

Our infrastructure and third-party providers may process data in different countries. Where applicable, we use appropriate safeguards for international transfers.

10) Changes to this policy

We may update this policy from time to time. The "Last updated" date above indicates when changes were made.