WhatsapBox

WhatsAppBox is a software product operated by My-Conect Enterprise, a business registered in Kenya (BN-9PCKJ599).

Privacy Policy

Effective date: 20 September 2026 Last updated: 20 September 2026

WhatsAppBox is a software product operated by My-Conect Enterprise, a business registered in Kenya under registration number BN-9PCKJ599 ("we", "us" or "the Platform"). This Privacy Policy explains how we collect, use, share, store and protect personal information when merchants, their staff, sales agents and other users access our website, applications and WhatsApp Business tools (the "Services").

This policy should be read with our Terms of Service, Acceptable Use and WhatsApp Messaging Policy, Data Processing Addendum and Cookie Policy.

1. Our roles

For account, billing, security, support and website data, we generally act as the data controller (or equivalent role under applicable law).

For customer contacts, WhatsApp messages, order details, CRM records and other information a merchant uploads or processes through the Services ("Merchant Data"), the merchant determines why and how that data is used. The merchant is the controller and we act as its processor or service provider. Each merchant must provide its own privacy notice to its customers and have a lawful basis for processing and messaging them.

Meta Platforms, Inc., WhatsApp LLC, WhatsApp Ireland Limited and other third parties process information under their own terms and privacy notices. We do not control their independent processing.

2. Information we collect

Depending on how the Services are used, we may process:

  • account and identity data, such as names, emails, telephone numbers, company details, roles and login credentials;
  • merchant configuration data, including WhatsApp Business Account identifiers, phone-number identifiers, templates and integration settings;
  • Merchant Data, including customer names and phone numbers, messages and media, consent status, tags, CRM notes, orders, delivery details, survey responses and support history;
  • transaction data, including plan, credits, invoices, payment status and limited payment references; payment providers process card or mobile-money credentials under their own policies;
  • technical and usage data, including IP address, browser, device, timestamps, logs, webhook events, error reports and security events;
  • communications with us; and
  • cookies and similar technologies described in our Cookie Policy.

Do not use the Services to collect sensitive data unless strictly necessary, lawful, disclosed and protected. Do not send passwords, full payment-card details, government credentials or medical secrets through ordinary chat fields.

3. How we use information

We use information to provide, secure, troubleshoot and improve the Services; authenticate users; administer workspaces; transmit merchant-requested WhatsApp communications; provide inbox, campaign, automation, analytics, CRM, catalogue, order, survey and reporting functions; manage billing; prevent fraud and abuse; comply with law; and establish or defend legal claims.

Where required, our legal bases may include performance of a contract, legitimate interests, legal obligations and consent. Merchants are responsible for identifying and documenting the legal basis for their processing of Merchant Data.

4. WhatsApp and Meta processing

When a merchant connects a WhatsApp Business Account, information may be sent to or received from Meta and WhatsApp, including business identifiers, recipient numbers, templates, message content, delivery status, quality signals and webhook events. That processing is also governed by the current WhatsApp legal terms and WhatsApp Business Messaging Policy.

Communications with a business may not have the same privacy characteristics as personal WhatsApp conversations. Merchants and their authorized providers may access, store and manage business messages through this Platform.

5. Sharing and subprocessors

We may share information with Meta and WhatsApp; hosting, storage, email, security and support providers; payment processors; merchant-enabled integrations such as webhooks, CRMs, AI or logistics providers; professional advisers; transaction counterparties under confidentiality; and authorities where legally required.

We do not sell Merchant Data or use it to independently market to a merchant's customers. Service providers processing Merchant Data for us must use it only for contracted services and apply appropriate safeguards.

6. International transfers

Our providers, Meta, WhatsApp and merchant-enabled integrations may process information in other countries. Where required, we use recognized transfer safeguards. Merchants are responsible for assessing transfers caused by integrations they enable.

7. Retention

We retain information as reasonably necessary to provide the Services, comply with law, resolve disputes and protect the Services. Retention varies by data type, merchant instructions, plan settings and legal requirements. Backups may remain for a limited period after deletion. De-identified information may be retained.

Merchants should establish appropriate retention schedules. Closing an account does not delete information held independently by Meta, WhatsApp or other integrations.

8. Security

We use administrative, technical and organizational safeguards, including access controls, tenant scoping, authentication, logging and encryption or masking for designated data. No system is completely secure. Merchants must protect credentials, restrict staff access and report suspected compromise.

9. Rights and choices

Depending on law, individuals may have rights to access, correct, delete, restrict or object to processing, withdraw consent, receive portable data and complain to an authority. A customer seeking rights over Merchant Data should first contact the merchant that communicated with them. We will reasonably assist verified merchant requests as required by law.

10. Children

The Services are for businesses and authorized adults and are not directed to children. Merchants must not knowingly use them to unlawfully collect or exploit children's data.

11. Changes

We may update this policy for changes in law, technology, Services or provider requirements. We will post a revised effective date and provide additional notice where required.

12. Contact

Privacy questions and verified rights requests may be submitted through the Platform's published support channel or the email shown in the website footer. If you are in Kenya, you may also contact the Office of the Data Protection Commissioner; elsewhere, contact your competent supervisory authority.