1. Who we are
WA Console is operated by Drasken Labs Private Limited ("we", "us", "our"). We provide a hosted console and API for sending and receiving WhatsApp Business Platform messages. We are a Tech Provider on the Meta WhatsApp Business Platform (Cloud API), which means we build and host the software that connects a business's own WhatsApp Business Account (WABA) to WhatsApp's Cloud API. We are an independent company. We are not Meta, and we are not affiliated with, endorsed by, or acting on behalf of Meta Platforms, Inc. or any of its group companies.
This policy explains what we do with personal data. It applies to the console at https://wa.draskenapis.com, to our public APIs, and to the supporting websites and emails we send.
- Customer
- The business that holds an account with us and connects its WhatsApp Business Account to the platform.
- User
- An individual who signs in to the console under a Customer's organisation — for example an administrator, developer or agent.
- End user
- A person a Customer messages on WhatsApp — typically that Customer's own customer, and not someone who has any account with us.
- Controller / Processor
- A controller decides why and how personal data is used. A processor only acts on a controller's documented instructions. Which role we play depends on the data — see section 2.
2. Our role: when we are a controller and when we are a processor
The distinction matters because it determines who you should contact about your data and who is legally answerable for it.
| Data | Our role | What that means for you |
|---|---|---|
| Account and organisation data of our Customers and their Users | Controller | We decide how this data is used to run the service, bill it and secure it. Direct your privacy requests to us. |
| WhatsApp message content, recipient phone numbers, contacts and conversation history | Processor | We only store and transmit this to carry out the Customer's instructions. The Customer is the controller — send erasure or access requests to that business first. We will assist them. |
| Technical logs, security telemetry and abuse signals | Controller | We decide to collect these to keep the platform available, secure and compliant. |
If you received a WhatsApp message from a business
We are almost certainly not the sender. We host the software the business used. Ask the business to stop messaging you or to delete your data; if you cannot reach them, contact us at [email protected] and we will pass the request on and support the business in acting on it.
3. What personal data we process
We keep the data set deliberately small. We do not ask for, and you should not send us, special category data (health, biometric, religious, political or sexual-orientation data) or government identity numbers through message content unless you have your own lawful basis and safeguards for it.
| Category | Examples | Source |
|---|---|---|
| Identity and account data | Name, email address, profile picture, user id, organisation name, role and permissions | You, via DraskenLabs single sign-on (SSO) when you create or join an organisation. Your name and email are also copied here at each sign-in, so we can email you about your account when you are not signed in |
| Authentication data | Session access token, active organisation id, sign-in and sign-out events, IP address at sign-in | Generated when you sign in |
| WhatsApp Business Account data | WABA id, Meta business id, business display name, phone numbers and their ids, verification and quality ratings, messaging limits, message templates | Meta, when you complete Embedded Signup and thereafter via the Graph API and webhooks |
| Access credentials | Meta system-user access tokens issued for your WABA, our API keys, webhook verify tokens and signing secrets | Meta and our own key issuance. Stored encrypted at rest; an API secret key is shown once at creation and never displayed again |
| Push notification registrations | A Firebase Cloud Messaging device token for each browser or app you switch notifications on in, the device's user agent, and which notifications you chose to receive | Your browser, when you allow notifications. Held only while the device stays registered — turning notifications off, signing out or deleting your account removes it |
| Message data | Recipient and sender phone numbers, message id, template name and parameters, message body and media references, timestamps, delivery/read/failure status, error codes, inbound replies | You (outbound) and Meta's webhooks (inbound and status updates) |
| Contact data | Contact name, phone number, tags, opt-in status and the notes a Customer chooses to store | Uploaded or entered by the Customer |
| Usage and technical data | API request paths and timings, response codes, feature usage, browser and device type, approximate location derived from IP | Collected automatically when you use the console or API |
| Billing data | Plan, invoices, conversation counts and payment reference (card details are handled by the payment provider, never by us) | You and our payment provider |
| Support data | Emails and tickets you send us, and the diagnostic information you choose to attach | You |
4. Data we receive from Meta (Embedded Signup and the Cloud API)
When you connect a WhatsApp Business Account you complete Meta's Embedded Signup flow inside a Meta-hosted window. You authenticate with Meta directly — we never see your Facebook or WhatsApp password. When the flow completes, Meta returns to us an authorisation code that we exchange, server-side, for an access token scoped to your business.
- What Meta sends us: the WABA id, the Meta business id, the phone number(s) and phone number ids you selected, and an access token limited to WhatsApp business management and messaging permissions for those assets.
- What we do with it: register your webhook subscription, read and sync your phone numbers, templates and quality ratings, and send messages on your instruction.
- What we never receive: your Meta login credentials, your personal Facebook profile data, your friends or contacts, your ad accounts, or any asset you did not select during signup.
- What we send to Meta: the message content and recipient numbers you ask us to deliver, plus template submissions, phone-number registration and configuration calls. Meta processes those under its own terms.
Meta's handling of WhatsApp business messaging is governed by the WhatsApp Business Terms (https://www.whatsapp.com/legal/business-terms) and Meta's Privacy Policy (https://www.facebook.com/privacy/policy). You can revoke our access at any time from Meta Business Settings → Business Integrations (https://business.facebook.com/settings/business-integrations); see /data-deletion for what happens next.
We do not use your message data to build products or train models
Message content and contact data are processed solely to deliver the service to the Customer that owns them. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it to train machine-learning models — our own or anybody else's.
5. Why we use personal data, and our legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and administer your account and organisation | Identity, account, authentication | Performance of a contract |
| Connect your WABA and send/receive messages on your instruction | WABA data, credentials, message and contact data | Performance of a contract; for end-user data we act on the Customer's instructions as processor |
| Show reporting, delivery status and analytics in the console | Message metadata, usage | Performance of a contract |
| Keep the platform secure — abuse detection, rate limiting, fraud and spam prevention, audit trails | Authentication, usage, technical logs | Legitimate interests (protecting our service, our Customers and message recipients) |
| Diagnose faults and provide support | Support data, logs, message metadata | Performance of a contract; legitimate interests |
| Bill you and keep accounting records | Billing, usage | Performance of a contract; legal obligation |
| Send service notices (outages, policy changes, security advisories) | Identity, account | Legitimate interests; legal obligation where notice is required |
| Send product marketing to business contacts | Identity, account | Consent, or legitimate interests where permitted — you can opt out from any message |
| Comply with law, respond to lawful requests, enforce our terms and Meta's policies | Any of the above, as strictly necessary | Legal obligation; legitimate interests |
Where we rely on legitimate interests we have assessed that our interest does not override your rights and freedoms. You can ask us for a summary of that assessment. Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.
6. Consent and opt-in for WhatsApp messaging
WhatsApp requires that a business obtain prior opt-in from a person before messaging them. Our Customers are responsible for obtaining, recording and honouring that opt-in. We do not collect opt-in on their behalf and we do not verify it for them.
- Opt-in must be given by the recipient, in a channel the recipient controls, and must clearly name the business that will message them and state that messages will arrive on WhatsApp.
- The business must keep evidence of opt-in and produce it if the recipient, we, or Meta ask for it.
- Opt-out requests must be honoured promptly and across all future campaigns.
- The full rules we enforce are set out in our Acceptable Use Policy (/acceptable-use) and in WhatsApp's Business Messaging Policy (https://www.whatsapp.com/legal/messaging-policy).
8. International transfers
The WhatsApp Business Platform is global, so data may be processed outside the country where you or a message recipient are located — including in the United States, the European Union and India, depending on your deployment region and on Meta's own infrastructure.
- Where we transfer personal data out of the UK or EEA we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.
- Transfers to Meta are governed by Meta's own transfer mechanisms under the WhatsApp Business Terms and the associated data-transfer addendum.
- We apply the same technical safeguards — encryption in transit and at rest, access control, logging — regardless of where data is processed.
9. How long we keep data
We keep personal data only as long as we need it for the purpose it was collected, plus any period the law requires. Customers on a paid plan can configure shorter message retention on request.
| Data | Retention period |
|---|---|
| Account, organisation and user records | 30 days after account closure, then permanent deletion |
| Message rows, delivery statuses and conversation history | 24 months from the date the message was sent or received |
| Raw webhook payloads received from Meta | 30 days from receipt |
| Application, access and security logs | 90 days from creation |
| Contacts | Until deleted by the Customer, or until account closure |
| API keys | Until you delete them with your account. A revoked key is kept in a disabled state so it can never be used again |
| Email delivery records — which email was sent to which address, and whether it arrived | 12 months, then deleted. Suppressed addresses (a bounce, a complaint or an unsubscribe) are kept until you ask us to remove them, because forgetting them means mailing you again |
| Push notification device tokens | Until you turn notifications off, sign out on that device, or Firebase reports the token as dead — whichever comes first |
| Encrypted backups | 35 days, after which backups containing the record have expired |
| Invoices and accounting records | as long as applicable tax and company law requires (typically 7–8 years) |
Deleting data in the console removes it from the live system immediately. Copies inside encrypted backups age out over the backup window (35 days, after which backups containing the record have expired) and are not restored into production except in a disaster-recovery event, in which case the deletion is re-applied.
10. How we protect data
- Encryption in transit: TLS 1.2 or higher on every connection to the console, our API and Meta's Graph API.
- Encryption at rest: databases, object storage and backups are encrypted with provider-managed keys.
- Credential handling: API secret keys are encrypted at rest with AES-256-GCM and displayed once at creation, never again; Meta access tokens and webhook secrets are encrypted the same way and never returned to the browser.
- Webhook integrity: inbound webhooks from Meta are verified against the signature header before they are processed, and the verify token is never exposed to the client.
- Access control: least-privilege, role-based access for Customers and for our own staff; administrative access is limited to named personnel and logged.
- Tenant isolation: every query is scoped to the caller's organisation, so one Customer cannot read another Customer's WABAs, messages or contacts.
- Monitoring: audit logs of authentication, key issuance, configuration changes and administrative actions, retained per section 9.
- Vendor management: sub-processors are assessed before onboarding and bound by written data-protection terms.
Breach notification
If a personal data breach affects your data we will notify the relevant supervisory authority within 72 hours where required, and notify affected Customers without undue delay with the facts, the likely consequences and the steps we are taking. Report a suspected vulnerability or breach to [email protected].
11. Your rights
Depending on where you live, you have some or all of the rights below. They apply to data for which we are the controller. If your data sits in a Customer's account — for example because a business messaged you — that business must action the request; we will help them do it.
- Access
- Get a copy of the personal data we hold about you, and information about how we use it.
- Rectification
- Have inaccurate or incomplete data corrected.
- Erasure
- Have your data deleted where we no longer have grounds to keep it — see /data-deletion.
- Restriction
- Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
- Portability
- Receive the data you gave us in a structured, machine-readable format, or have it sent to another provider where technically feasible.
- Objection
- Object to processing based on legitimate interests, and to direct marketing at any time — marketing objections are always honoured.
- Withdraw consent
- Withdraw consent you previously gave, without affecting processing already carried out.
- No selling or sharing
- Under US state privacy laws: opt out of any sale or sharing of personal information. We do neither, so there is nothing to opt out of.
- Complain
- Lodge a complaint with your data protection authority — for example the ICO in the UK, your national DPA in the EEA, or the Data Protection Board in India.
To exercise a right, email [email protected] from the address on your account, or use the instructions at /data-deletion. We will verify your identity before acting, and respond within 30 days. We do not charge for requests, and we will not treat you differently for making one. If a request is manifestly unfounded or excessive we may explain why and decline it, in writing, with your right to complain.
13. Children
The platform is a business tool and is not directed at children. You must be 18 or older to hold an account. WhatsApp's own terms set a minimum age for its users. We do not knowingly collect data from children; if you believe we have, contact [email protected] and we will delete it.
14. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone. We do apply automated rate limiting and abuse heuristics that can throttle or suspend sending; a human reviews any suspension you contest.
15. Changes to this policy
We update this policy when the service or the law changes. The effective date and version at the top of this page always reflect the current text. For material changes we give at least 30 days notice by email or in-console notice before they take effect. Continuing to use the platform after that date means you accept the updated policy.