WhatsApp Web Integration — Privacy Policy

1. Scope and Purpose

This document is a feature-specific privacy addendum to the Autopilot My Business Platform Privacy Policy. It governs the collection, storage, processing, and deletion of data associated exclusively with the WhatsApp Web integration built into the platform.

This feature allows registered business tenants ("Tenants") on the Autopilot My Business platform to link their personal or business WhatsApp accounts, send and receive messages, manage contacts, run broadcast campaigns, and access a shared CRM inbox — all within the platform.

2. Who We Are

Autopilot My Business is a multi-tenant B2B SaaS platform that provides business management tools including CRM, HR, Inventory, and Marketing automation. The registered business entity operating this platform can be contacted at:

• Website: https://autopilotmybusiness.com
• Support Email: [email protected]
• Privacy Contact: [email protected]

For the purposes of data protection law, Autopilot My Business acts as the Data Processor on behalf of its Tenants. Each Tenant is the Data Controller for end-user data (contacts, customers) processed through the WhatsApp integration.

3. Data We Collect and Store

The following categories of data are collected specifically by the WhatsApp Web integration:

3.1 WhatsApp Session Credentials

To maintain a persistent WhatsApp Web connection, the integration generates authentication credentials equivalent to those stored in a WhatsApp Web browser session. These include cryptographic keys, signal protocol state, and registration identifiers. This data is stored encrypted in our database under the WhatsappSession collection, isolated per Tenant (tenantId) and per registered device (deviceId).

3.2 Messages (Inbox Data)

All messages sent or received through a connected WhatsApp device are stored in our database under the WhatsappMessage collection. Each message record may contain:

3.3 Contact Identity Cache

When contacts interact with or are messaged by a connected device, the system caches their identity data in the WhatsappContact collection to resolve display names. This includes:

• WhatsApp JID (unique contact identifier)
• Phone number (where available)
• WhatsApp Push Name (self-set display name)
• Business Verified Name (if the contact is a WhatsApp Business account)
• Linked Device ID (@lid — WhatsApp's privacy-preserving identifier)
• Profile picture URL (cached; refreshed periodically)
• WhatsApp registration status (isOnWhatsapp flag)

3.4 Groups and Participants

For WhatsApp group messaging, the platform stores group metadata including:

• WhatsApp Group ID (@g.us JID)
• Group name and description
• List of participant phone numbers and their admin status
• Group type (business or personal)
• Message count and last activity timestamp

3.5 Message Logs (Delivery Audit)

Every outgoing message action is logged in the WhatsappLog collection for audit and deliverability tracking:

• Sender phone number and device ID
• Recipient phone number
• Delivery outcome: SUCCESS or FAILURE
• WhatsApp message ID (on success)
• Error description (on failure)
• Request type: manual or automation
• Timestamps (createdAt, updatedAt)

3.6 Bulk Campaign Data

When a Tenant runs a broadcast campaign, the following is stored:

• Campaign name, target audience, message template used
• Scheduled send time
• Per-recipient delivery status
• Campaign performance metrics (sent count, failure count)

3.7 Outbound Message Queue

Messages awaiting delivery (due to rate limiting, offline devices, or scheduled sends) are stored in a durable message queue (WhatsappQueue) containing the full message payload, recipient identity, scheduled time, retry count, and processing status.

3.8 Account Health Metrics

To protect connected WhatsApp numbers from being banned, the platform tracks per-device messaging statistics:

• Total messages sent and received over the account's lifetime
• Daily outbound message count (rolling 24-hour window)
• Sent-to-received interaction ratio (used to determine account reputation tier)
• Account age in days (from first message seen)
• Assigned safety tier: New (up to 50/day), Warming (up to 250/day), Established (up to 800/day)

3.9 Device Connection Events

Connection lifecycle events (device connected, disconnected, QR scanned) are logged for operational monitoring. On a manual disconnection (WhatsApp logout or ban), the platform sends an email alert to the Tenant's administrator and creates an in-platform notification. The email contains the device name and business display name — no message content is included.

4. How We Use the Data

5. Data Retention Policy

The default retention thresholds (6-month keep floor and 12-month delete ceiling) are configurable via environment variables WHATSAPP_RETENTION_MIN_KEEP_MONTHS and WHATSAPP_RETENTION_DELETE_MONTHS. These values can only be lowered (more aggressive deletion), never raised beyond the limits stated above, by platform administrators.

6. Security Measures

The following technical and organisational measures are applied specifically to the WhatsApp Web service:

6.1 Authentication & Authorisation

• All API requests require a valid JWT, delivered as an HttpOnly cookie or Authorization: Bearer header — never exposed to JavaScript.
• Socket.IO connections are authenticated at handshake time; unauthenticated sockets are rejected before any data is transmitted.
• Tenant rooms on the real-time layer are enforced by server-side boundary checks: a socket belonging to Tenant A cannot join or read Tenant B's room.

6.2 Tenant Isolation

• Every database record carries a tenantId (MongoDB ObjectId) as the primary discriminator. Queries always include tenantId as the leading index field — no cross-tenant data leakage is architecturally possible.
• The sharedDBAdapter wraps all Mongoose operations with a tenant-scoped Proxy that enforces isolation at the model layer.

6.3 Transport Security

• All traffic is served over HTTPS/TLS. HTTP is not permitted in production.
• CORS is restricted to an explicit whitelist of authorised origins (autopilotmybusiness.com, app.autopilotmybusiness.com, api.autopilotmybusiness.com, whatsappapi.autopilotmybusiness.com).
• Cross-origin preflight requests are validated server-side and rejected if the origin is not on the whitelist.

6.4 Rate Limiting & Anti-Abuse

• Outbound messages are subject to per-device daily quotas (50 / 250 / 800 depending on account reputation tier) to prevent spam and reduce ban risk.
• The built-in safety service enforces these limits in real time, queuing messages when the quota is reached and releasing them after the rolling 24-hour window resets.
• Anti-spam throttling and human-like send delays are applied to bulk campaigns.

6.5 Session & Credential Protection

• WhatsApp Web authentication state (equivalent to a browser session) is stored in MongoDB with tenant-scoped access only. No credentials are exposed through any API response.
• A lock-file mechanism prevents multiple concurrent server instances from simultaneously claiming the same WhatsApp session.

6.6 Stack Trace Suppression

• In production, error responses never include stack traces or internal error details — only a generic message is returned to the client.

6.7 Message Retention Enforcement

• Automated nightly jobs delete messages older than the configured threshold in bounded batches to prevent database load spikes. No operator action is required for routine deletion.

7. Data Sharing and Third Parties

7.1 WhatsApp / Meta Platforms

By using this feature, messages are transmitted over WhatsApp's infrastructure via the WhatsApp Web protocol. Meta Platforms, Inc. processes these messages in accordance with WhatsApp's own Privacy Policy. Autopilot My Business has no control over Meta's data practices. Tenants and their end-users are also subject to WhatsApp's Terms of Service.

7.2 Cloud Infrastructure

The platform's servers, databases (MongoDB), and media storage are hosted on cloud infrastructure (VPS / cloud provider). Data is stored within the provider's data centres. Infrastructure providers operate under their own data processing agreements and do not have independent access to Tenant message data.

7.3 Media Storage

Media files (images, documents, videos, audio) received or sent via WhatsApp may be uploaded to Google Drive and the resulting web-view link stored in the message record. Access to these files is controlled by the Tenant's Google Drive account permissions.

7.4 No Sale of Data

Autopilot My Business does not sell, rent, or share personal data processed through the WhatsApp integration with any advertising networks, data brokers, or marketing analytics providers.

7.5 Sub-Processors

Where sub-processors are engaged, appropriate Data Processing Agreements (DPAs) are in place. Tenants may request a list of current sub-processors by emailing [email protected].

8. Tenant Responsibilities

As Data Controllers for their end-user data, Tenants who enable the WhatsApp Web integration accept the following obligations:

• Lawful basis for messaging: Tenants must ensure they have a valid legal basis (consent, legitimate interest, contractual necessity, etc.) to message each contact via WhatsApp.
• WhatsApp Terms compliance: Tenants must comply with WhatsApp's Terms of Service, Business Policy, and Acceptable Use Policy. Sending unsolicited bulk messages ("spam") is strictly prohibited and may result in the connected number being banned by WhatsApp.
• Contact opt-out: Tenants are responsible for honouring opt-out requests from their contacts and removing them from any future campaigns.
• Transparency to end-users: Tenants must inform their contacts that their WhatsApp data (phone number, message content) is being processed by the Tenant's CRM system.
• Device security: Tenants are responsible for securing the physical devices whose WhatsApp accounts are linked to the platform. Unauthorised access to a linked account constitutes a security incident that must be reported.

9. Rights of End-Users (Data Subjects)

End-users whose personal data (phone number, message content, contact details) is processed through a Tenant's WhatsApp integration may exercise the following rights under applicable data protection law (GDPR, PDPB, or equivalent):

• Right of access — request a copy of their data held by the Tenant.
• Right to erasure — request deletion of their data from the Tenant's CRM.
• Right to rectification — request correction of inaccurate data.
• Right to restrict processing — request that processing be paused.
• Right to object — object to processing based on legitimate interest.
• Right to data portability — receive their data in a structured, machine-readable format.

These requests should be directed to the Tenant (the business that messaged the end-user), who is the Data Controller. If a Tenant fails to respond, end-users may contact Autopilot My Business at [email protected] and we will facilitate the request within our technical capability.

End-users may also exercise their rights directly within WhatsApp (block sender, delete messages, report spam) without needing to contact the Tenant.

10. Children's Data

The WhatsApp Web integration and the Autopilot My Business platform are intended exclusively for B2B use. We do not knowingly collect or process data relating to individuals under the age of 13 (or the applicable minimum age in the user's jurisdiction). Tenants must not use the integration to contact minors without appropriate legal basis and parental consent.

11. International Data Transfers

Data may be stored on servers located outside the Tenant's jurisdiction depending on the cloud infrastructure region selected. Where data is transferred across borders, we ensure appropriate safeguards are in place (Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms). Tenants requiring data residency in a specific region should contact [email protected] before enabling the feature.

12. Data Breach Notification

In the event of a personal data breach affecting the WhatsApp integration, Autopilot My Business will:

1. Contain the breach and assess its scope within 24 hours of detection.
2. Notify affected Tenants within 72 hours of becoming aware of the breach, in accordance with applicable law.
3. Provide details of the categories and approximate volume of data affected, likely consequences, and remedial measures taken.

Tenants are responsible for notifying their own end-users and relevant supervisory authorities where required by applicable law.

13. Cookies and Local Storage

The WhatsApp Web feature uses the following browser-side storage:

• HttpOnly JWT Cookie (token): Used to authenticate WebSocket (Socket.IO) connections to the WhatsApp server. Set as HttpOnly and Secure; inaccessible to JavaScript.
• No third-party cookies are set by this feature.

14. Limitations and Disclaimers

• No official affiliation: The WhatsApp Web integration is not an official WhatsApp or Meta product. Autopilot My Business provides this feature as-is and cannot guarantee continued operation if WhatsApp modifies its protocol or takes enforcement action.
• Message delivery: Delivery of messages via WhatsApp is subject to WhatsApp's infrastructure, recipient settings (blocked contacts, Do Not Disturb), and device connectivity. Autopilot My Business is not liable for undelivered messages.
• End-to-end encryption: WhatsApp messages are end-to-end encrypted in transit between WhatsApp clients. However, once a message is received by the connected device and stored in the platform's database (for CRM inbox purposes), it is stored as plain text and subject to the database security measures described in Section 6.
• Account restriction risk: Use of WhatsApp Web via a third-party integration carries an inherent risk that WhatsApp may restrict the connected number. The platform's safety service (rate limits, reputation tiers) mitigates but cannot eliminate this risk.

15. Changes to This Policy

We may update this policy as we add new capabilities to the WhatsApp integration or in response to changes in applicable law. Material changes will be communicated to Tenant administrators via in-platform notification and/or email at least 14 days before they take effect. Continued use of the WhatsApp integration after the effective date constitutes acceptance of the revised policy.

The version history of this document is maintained in our changelog. Tenants may request previous versions by contacting [email protected].

16. Contact and Complaints

For questions, data requests, or complaints related to this policy:

• Email: [email protected]
• Support Portal: autopilotmybusiness.com

If you are an end-user (contact of a Tenant) and believe your data has been processed unlawfully, you also have the right to lodge a complaint with your local data protection supervisory authority (e.g., the Information Commissioner's Office in the UK, the Data Protection Board of India, or your national equivalent).