Privacy Policy

1. Information We Collect

We may collect and process the following categories of information:

• Account information — such as your name, email address, phone number, company details, and login credentials.
• Client integration data — WhatsApp Business Account (WABA) identifiers, business phone numbers and phone number IDs, access tokens, webhook configuration, and message templates that you authorize us to access through Meta APIs.
• Messaging data — the content and metadata of messages you send or receive through the WhatsApp Business Platform and other connected channels, including End Customer phone numbers, contact names, timestamps, delivery status, and any media exchanged.
• Meta Platform Data — information made available through Meta APIs, subject to the permissions you explicitly grant during onboarding (for example, whatsapp_business_messaging and whatsapp_business_management).
• Technical data — IP address, browser type, device information, and usage logs.

2. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve our services.
• Authenticate users and enable the Meta and WhatsApp integrations you request.
• Send and receive messages, and create and manage message templates, on behalf of our Clients.
• Communicate with you about service updates, security alerts, and support matters.
• Monitor performance, prevent abuse and fraud, and enhance security.
• Comply with legal obligations and Meta Platform Terms and Developer Policies.

3. WhatsApp Business Platform & Meta Platform Data

When you connect a WhatsApp Business Account or other Meta asset, we access and process information through the Meta Graph API and the WhatsApp Business Platform (Cloud API) strictly according to the permissions you authorize and only to provide the functionality you request.

Messages and related data sent through the WhatsApp Business Platform are transmitted to and processed by Meta Platforms, Inc. and its affiliates, which host the Cloud API. In providing the Cloud API, Meta acts as a data processor/service provider on behalf of the business, and message data is subject to Meta's retention periods (for example, the Cloud API retains message content for up to 30 days to provide its features). We use Meta Platform Data only in accordance with Meta's Platform Terms, Developer Policies, and applicable law, and we do not use it for advertising or sell it.

4. Our Role as a Tech Provider

For personal data relating to our Clients' End Customers, our Clients act as the controllers and Smart TI acts as a processor, processing that data only on the documented instructions of the Client to deliver the messaging services. Each Client is responsible for obtaining the appropriate legal basis and consent from its End Customers and for complying with WhatsApp and Meta messaging policies.

5. Data Sharing

We do not sell personal information. We share information only in the following cases:

• With Meta Platforms, Inc. and WhatsApp, as necessary to deliver messages and manage assets through the WhatsApp Business Platform and Meta APIs.
• With service providers who help us operate our infrastructure and services, under confidentiality obligations.
• With the Client on whose behalf the data is processed.
• When required by law, regulation, legal process, or a valid government request.
• To protect our rights, our users, our systems, and platform security.
• As part of a business transfer such as a merger, acquisition, or asset sale.

6. Data Retention

We retain information only for as long as necessary to provide the service, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Message content processed by the WhatsApp Cloud API is retained by Meta for up to 30 days. When Platform Data is no longer needed for an authorized business purpose, or upon a valid deletion request, we delete it as described in Section 9.

7. Data Security

We implement reasonable administrative, technical, and organizational safeguards — including access controls, the principle of least privilege, and encryption in transit — to protect information against unauthorized access, loss, misuse, or alteration. Access tokens and credentials are stored encrypted at rest. No method of transmission or storage is completely secure.

8. Your Rights

Depending on your location and applicable law (including the EU/UK General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados (LGPD)), you may have the right to:

• Request access to the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict certain processing activities.
• Request a copy of your data in a portable format where applicable.
• Withdraw consent at any time, without affecting prior lawful processing.

9. Data Deletion Requests

You can request deletion of the personal data associated with you or your account at any time. To submit a request:

• Email us at [email protected] with the subject line "Data Deletion Request"; and
• Include the name, email address, and/or WhatsApp phone number associated with the data so we can locate and verify it.

After verifying your request, we will delete the associated Platform Data within 30 days, except where we are required or permitted by law to retain it. You may also trigger deletion by (a) deleting your Smart TI account, or (b) removing Smart TI's access from your Meta Business settings, which revokes our access to your WhatsApp Business Account and related data.

If you are an End Customer who exchanged WhatsApp messages with a business that uses Smart TI, you may contact that business directly or email us at [email protected], and we will coordinate the deletion of your data with the relevant business.

10. Children's Privacy

Our services are not directed to children under the age required by applicable law, and we do not knowingly collect personal information from children without appropriate authorization.

11. International Data Transfers

Your information may be processed in countries other than your own, including by Meta Platforms, Inc. in the United States. Where required, we and our processors rely on appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.

12. Compliance with Meta Platform Terms

Our access to and use of data obtained through Meta platforms is governed by, and we comply with, the Meta Platform Terms, the Meta Developer Policies, and the WhatsApp Business Terms and Data Processing Terms.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, or to exercise your rights, contact us at:

Smart Tecnologia da Informação LTDA
Email: [email protected]
Website: https://smart-ti.com