Privacy Policy

This policy explains what KOLab WhatsApp Funnels (“the Service”, “we”) collects, why, and what we do with it. It covers both the businesses who use the Service and the people those businesses message on WhatsApp.

Who we are

The Service is operated by KOLab. We are a technology provider on the WhatsApp Business Platform: businesses connect their own WhatsApp Business Account and use our software to manage their messaging. We do not send messages on our own behalf.

For data about a business's own contacts, the business is the data controller and we act as their processor. For account and billing data about the business itself, we are the controller.

Data we collect from businesses using the Service

• Account details — name, email address, hashed password, and workspace membership.
• WhatsApp connection details — the WhatsApp Business Account ID, phone number ID, display phone number, verified business name, and the access token issued when you complete Meta's Embedded Signup. Access tokens are encrypted at rest.
• Usage data — funnels you build, message templates you create, and server logs (IP address, timestamps, error traces).

Data we process on behalf of businesses

When a business uses the Service, we process the following about their contacts:

• Contact details — WhatsApp phone number, name, email address where supplied, and any custom fields the business adds.
• Message content and metadata — messages sent and received through the connected WhatsApp Business Account, including delivery and read status, so the business can see their conversations in one place.
• Consent records — when and where a contact opted in to receive WhatsApp messages, and the wording they agreed to. WhatsApp requires businesses to hold this before sending marketing messages.
• Segmentation — which lists a contact belongs to, which tags apply to them, and which funnel steps they have reached.

If you connect a number you already use in the WhatsApp Business app

Meta calls this Coexistence. With your explicit consent given during setup, Meta may share with us:

• the WhatsApp contacts saved on that number, and
• up to 180 days of prior message history for one-to-one chats on that number.

You choose whether to share history during setup, and you can decline. Group chats are never shared. After setup, messages you send from the WhatsApp Business app are mirrored into the Service so your inbox stays complete.

Data we receive from Meta

When you connect a WhatsApp Business Account we receive, from Meta, the account and phone number identifiers listed above, an access token scoped to your account, and ongoing webhook events covering messages, delivery statuses, message template approval decisions, contact syncs, and account status changes. We use these only to operate the Service for you.

How we use data

• To deliver the messages and automations a business configures.
• To show conversations, contacts, lists, and tags in the Service.
• To create and submit WhatsApp message templates to Meta for approval on the business's behalf.
• To keep the Service secure, debug faults, and prevent abuse.
• To meet our legal obligations.

We do not sell personal data. We do not use message content to train machine learning or generative AI models, and we do not share it with third-party AI providers for that purpose.

Who we share data with

• Meta Platforms — to send and receive messages and manage message templates on the WhatsApp Business Platform.
• Infrastructure providers — cloud hosting, database, and object storage vendors under contract, acting only on our instructions.
• Authorities — where we are legally required to.

Retention

Account data is kept while the account is open. Contact and message data is kept while the connected business keeps it, and is deleted within 30 days of the business deleting it or closing their account. Coexistence history that a business declines to share is never received. Server logs are retained for up to 90 days.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. If you were messaged by a business using the Service, contact that business first — they control that data — or write to us and we will route your request.

To stop receiving WhatsApp messages from a business, reply to their conversation asking to opt out. We record the opt-out and stop automated sends.

To request deletion of data associated with your Facebook account, see our data deletion page.

Security

Access tokens and message content are encrypted at rest. Traffic is encrypted in transit. Webhook deliveries from Meta are cryptographically verified before we process them. Access to production data is restricted to staff who need it.

International transfers

Data may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Changes

We will post any changes on this page and update the date above. Material changes will be notified to account holders by email.

Contact

Questions or requests: [email protected]