Privacy policy

WapKit does not have consumer users. Two kinds of people appear in it: the businesses that connect a WhatsApp Business account, and the WhatsApp users who message those businesses.

For messages between a business and its customers, the business is the controller and WapKit is a processor acting on its instructions. WapKit does not use message content for any purpose of its own: not for analytics, not for profiling, not to train anything.

• Messages sent and received through a connected account: the text or media description, direction, type, timestamps, delivery status history, and the provider's message identifier.
• Contacts: the WhatsApp identifier of a person who messaged a connected business, their WhatsApp profile name if the platform supplied one, consent and opt-out state, and when they were last active.
• Telephone numbers of message senders and recipients, in international format.
• Connection details: the WhatsApp Business account and phone number identifiers a business authorised, and an access token or API key for reaching them.
• Operational records: an append-only log of what happened to each message, webhook deliveries to the business's own systems and every attempt at them, and an audit log of credential and key actions.
• Administrator accounts: the email address, name and password hash of the person operating this deployment, plus session records.

Access tokens, provider API keys, webhook signing secrets and two-step verification PINs are encrypted at rest with AES-256-GCM, each bound to the row it belongs to. They cannot be read back through the interface, only replaced.

Message content and telephone numbers are stored unencrypted. This is a deliberate, recorded trade-off rather than an oversight: operators need to search message history to investigate delivery problems, and application-level encryption would make that impossible without a search index this product does not justify. The database is reachable only by the application server, message content is never written to infrastructure logs, and nothing is exposed outside the project that owns it.

Raw payload bodies, meaning the exact requests received from WhatsApp and the exact bodies delivered to a business's systems, are erased automatically after 30 days. The surrounding record is kept: identifiers, timestamps, statuses, retry history and correlations all remain, so the processing trail stays auditable without the personal data in it persisting.

Message and event rows are kept for as long as the project exists. That is a decision, not an omission. The operational history is what this product is for. A business that wants its data removed can have it removed; see data deletion.

Idempotency records expire after 24 hours. Rate-limit counters and sign-in backoff records are swept once they lapse.

• The administrator of this deployment, through an authenticated console. There is no public registration and no self-service account creation.
• The business's own application, through an API key scoped to exactly one project. A key cannot read another project's data.
• Meta, or the messaging provider a project is connected through, because that is who carries the messages.
• The infrastructure providers hosting the application and its database.

Message content is never sold, never shared with advertisers, and never used for any purpose other than delivering and recording the messages themselves.

When a business connects a WhatsApp Business account, Meta provides an access token scoped to that business. WapKit uses it only to send and receive that business's WhatsApp messages, read its message templates, and subscribe to its webhooks. The token is stored encrypted and is deleted when the connection is disconnected.

A business can revoke WapKit's access at any time from Meta Business Manager, which takes effect immediately and independently of anything WapKit does.

• All traffic is served over HTTPS; the application refuses to start in production on a non-HTTPS origin.
• Secrets are encrypted at rest and never returned through any interface.
• Inbound webhooks from Meta are verified against a cryptographic signature before anything is processed.
• Message content, telephone numbers and credentials are stripped from application logs.
• Every project's data is isolated at the query level, and that isolation is covered by an automated test suite.

Material changes to this policy will be reflected in the date at the top of this page. The description here is generated from the running deployment where a value is configurable, so it cannot drift from what the software actually does.