Whattabot

Privacy Policy

Whattabot · Effective October 13, 2026

1. Who we are

Whattabot is a platform built and operated by San Roman y Asociados Consultores RL CV ("Onix Digital"), Colina de la Paz 193, Boulevares, Estado de México, México. We are the data controller for the information described here. For any privacy matter, email us at contacto@onixdigital.mx.

2. What data we collect

a) Account data: email, name, hashed password, your business name, and the information you add to your bot (products, FAQs, rules).
b) Data from Meta's WhatsApp Business Platform: when you connect your number through Meta's official Embedded Signup flow, we receive:
  • Messages your customers send to your number (text, image, audio, video, location), plus their WhatsApp number and profile name.
  • Messages sent by you or the bot from Whattabot, and their status (sent, delivered, read, failed).
  • Your WhatsApp Business account details: ID, phone number, display name, status, and quality rating.
  • Your message templates and their approval status.
  • If you connect a number you already use in the WhatsApp Business app (coexistence) and you allow it: your WhatsApp contacts and up to 6 months of chat history.
  • The access token Meta issues so Whattabot can operate your account.
c) Usage data: when you log in, what you configure, and errors, so we can run and improve the service. We don't use third-party advertising trackers.

3. How we use Meta Platform Data (by permission)

  • whatsapp_business_messaging: to receive your customers' messages and send replies from the bot or your team, including media, and to register your number with the Cloud API.
  • whatsapp_business_management: to read your account and phone number details, view your message templates, and subscribe your account to our webhooks so messages reach your dashboard.
We use this data only to provide the service to you: showing your conversations, generating replies, and alerting you when a chat needs a person. We don't sell data, share it with third parties for advertising, use it to profile people, or train general AI models on your customers' messages.

4. Who we share it with

Only with the providers we need to run the service, who process it on our instructions:
  • Meta Platforms, Inc.: WhatsApp Business Platform, to send and receive messages.
  • Google LLC: Gemini API, to generate AI replies.
  • Groq, Inc.: speech-to-text for voice notes.
  • Hostinger International Ltd.: the server that runs Whattabot.
  • Telegram: internal alerts to your team when a chat needs attention.
We may disclose data if a competent authority requires it under applicable law.

5. How long we keep it

We keep your conversations and bot settings while your account is active. When you request deletion or close your account, we delete them within 30 calendar days, except for anything the law requires us to keep.

6. Your rights

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), you can access, correct, delete, or object to the processing of your data, and withdraw your consent. Email us at contacto@onixdigital.mx; we reply within 20 business days. If you are a customer of a business that uses Whattabot, you can also ask that business directly.

7. Data deletion

Instructions to delete your account and all of its data are on the Data deletion page.

8. Security

Passwords are stored with bcrypt. Access tokens Meta issues when you connect your number are stored encrypted. All traffic uses HTTPS, and we verify the signature of every webhook from Meta. Only the staff who operate the service can access the data.

9. Changes

If we change this policy, we update the date above and, for significant changes, we notify you by email.

10. Contact

San Roman y Asociados Consultores RL CV ("Onix Digital"), Colina de la Paz 193, Boulevares, Estado de México, México · contacto@onixdigital.mx