Privacy Policy

1. Information We Collect

We collect the following information when you use WhatsRB Cloud:

• Account information: email address, phone number, and hashed password
• Billing information: processed securely by Lemon Squeezy, LLC (we never store card numbers)
• Message data: message content, recipient phone numbers, delivery status, and associated metadata (see Section 3)
• Usage data: API call timestamps, session metadata, webhook delivery logs
• Technical data: IP addresses, browser type, and access logs for security purposes

2. How We Use Your Information

• Provide and maintain the Service
• Process payments and manage subscriptions
• Monitor usage against plan limits
• Send transactional emails (account verification, billing receipts)
• Detect and prevent abuse or unauthorized access
• Improve the Service based on aggregate usage patterns

3. Message Data

To provide the Service, WhatsRB Cloud temporarily stores message content, recipient information, and API request/response payloads. This data is necessary to route, deliver, and troubleshoot your messages.

• Message content and recipient phone numbers are stored for up to 90 days, then permanently deleted
• We do not sell, share, or use your message content for advertising or profiling purposes
• Access to message data is restricted to you through your authenticated dashboard and API

You are the sole data controller for the messages you send and receive through the Service. We act as a data processor on your behalf.

4. Data Sharing

We do not sell your personal information. We share data only with:

• Lemon Squeezy, LLC — for payment processing
• Infrastructure providers — for hosting and delivering the Service
• Law enforcement — only when required by law or valid legal process

5. Data Retention

We retain your account data for as long as your account is active. The following retention policies apply:

• Message logs, webhook delivery logs, and routing logs: automatically deleted after 90 days
• Monitoring probes: automatically deleted after 30 days
• Account deactivation: upon deactivation, your account enters a 30-day grace period during which you can reactivate it by signing in
• Permanent deletion: after the 30-day grace period, all account data (including messages, sessions, API keys, agents, and business account connections) is permanently and irreversibly deleted

6. Security

We implement industry-standard security measures including: encrypted connections (TLS), hashed passwords (bcrypt), scoped API keys, and isolated session storage. However, no method of transmission over the internet is 100% secure.

7. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

8. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Deactivate your account (30-day grace period before permanent deletion)
• Export your data in a portable format
• Object to data processing

To exercise any of these rights, contact us at [email protected].

9. International Data Transfers

Your data may be processed in countries outside your own. We ensure appropriate safeguards are in place for any international data transfers in compliance with applicable data protection laws.

10. Children's Privacy

WhatsRB Cloud is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related inquiries, contact us at [email protected].