Data Deletion & User Rights

Purpose

To comply with legal obligations and Meta Platform Terms regarding user data deletion, and to respect user requests to erase data.

Retention Periods

• Lead/chat data: retained for up to 12 months post-interaction, then archived.

• Transaction/order data: retained for up to 7 years (for accounting).

• Anonymised AI logs: retained for product improvement; personal identifiers removed after 90 days.

Deletion on Request

If an End-User or Merchant requests deletion:

1. Verify requester identity.

2. Mark related personal data for deletion ("Deletion Pending").

3. We erase or anonymise data within 30 days of request (unless legal retention applies).

4. Confirm deletion completion to requester via email/WhatsApp.

Data Subject Rights

Users may request: access, correction, deletion, restriction. Requests processed free of charge within 30 days.

Integration & Meta Compliance

For WhatsApp/Instagram data captured either by our platform or merchant:

• Ensure deep link or redirection to capture number happens only after user consent.

• For active chats, if user opts out or requests deletion, we remove personal identifiers and optionally retain anonymised logs.

• For data imported from Meta (comments, DMs), we cease processing and delete when required by Meta or user.

Export & Migration

Merchants may export their data (leads, orders, chats) in machine-readable format before deletion. Export available for 90 days post termination.

3.1 Permitted Data Use

You and we agree to use only data permitted by Meta's Platform Terms, including but not limited to:

• User phone numbers, message content only when user initiates chat or opts in.

• No sharing or transferring of phone numbers from Meta to other platforms without explicit consent.

3.2 Webhook & Retention Compliance

• For Instagram comments/DMs: process data only as allowed, respond publicly or direct to DM as needed.

• For WhatsApp: only send messages within the 24-hour window or use Meta-approved templates.

• Store webhook event data no longer than required for business use; anonymise or delete after retention period.

3.3 Opt-in & User Redirects

• When a user transitions from Instagram or website to WhatsApp, clearly disclose the redirect and the fact that the phone number will be captured.

• Obtain explicit consent for proactive messages beyond the session window.

3.4 Deletion & Scope of Rights

• If a user requests deletion, data captured via Meta pipelines must be deleted or anonymised and the event logged.

• Maintain audit logs proving compliance.

3.5 Review & Audit

• We or Meta may audit use of WhatsApp/Instagram data at any time.

• You must maintain records of your opt-in procedures, message templates used, and user deletion requests for at least 12 months.

3.6 Consequences of Non-Compliance

Should any violation of Meta terms be found (e.g., unauthorized messaging or data harvesting), we may suspend access to the Meta features for your account; you indemnify us for any losses or fines.