CodeBitel Messaging – Privacy Policy
Nov 2, 2026 · @Ajay
1. Who we are and what this policy covers
CodeBitel (codebitel.com) runs CodeBitel Messaging at wa.codebitel.com, a platform for sending and receiving WhatsApp messages through Meta's WhatsApp Business Platform. This policy explains what data the platform handles, why, who can see it, and how people can control or delete it.
It covers wa.codebitel.com, our Meta app "CodeBitel Messaging", and every feature we add later, including the inbox, message templates, campaigns, automation, reporting, integrations and Embedded Signup for client businesses.
Today we use the platform for CodeBitel's own customer communication. We are building it so that other businesses (our clients) can connect their own WhatsApp numbers and run their own workspaces. This policy applies to both uses.
In this policy, a client is a business with its own workspace, a user is a person who logs in to a workspace, and a contact is a person who exchanges WhatsApp messages with a workspace's number.
Legal entity: CodeBitel Technologies, Dehradun, Uttarakhand, India. Contact: [email protected].
2. Our role: controller and processor
We act in two different roles depending on whose data it is.
| Data | Our role | What that means |
|---|---|---|
| Login details of our own users and workspace owners | Controller | We decide why and how this data is used, and we answer to you for it. |
| Contacts and messages in CodeBitel's own workspace | Controller | CodeBitel is the business messaging its own customers. |
| Contacts and messages in a client's workspace | Processor (service provider) | The client decides who to message and why. We store and process the data only on the client's behalf and under its instructions. |
If you are a contact of one of our clients, the client is the business responsible for your data. Please contact the client first for access or deletion requests. We will help the client respond, and we will act on any request the client passes to us.
Clients must have a lawful basis, including each contact's opt-in, before they message anyone through the platform. Our terms require this and the platform enforces opt-in records (see section 6).
3. Data we collect
We collect only what the platform needs to work. The categories below describe what exists today. If a new feature needs a new kind of data, we update this policy before the feature goes live.
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, hashed password, workspace name, role | You, when you sign up or are invited |
| Contact data | WhatsApp phone number, name, tags, notes a client adds | The client, or the contact when they message us |
| Consent records | Which categories the contact agreed to (updates, offers), the source of the opt-in, date and time, every later change including STOP | The client, and the contact's own STOP or START messages |
| Message data | Text and media sent or received, message type, delivery status (sent, delivered, read, failed), timestamps, WhatsApp message IDs | WhatsApp Business Platform webhooks and our sending requests |
| Template and campaign data | Template names, text, variables, approval status, campaign audiences and results | The client and Meta |
| WhatsApp connection data | WhatsApp Business Account ID, phone number ID, display name, quality rating, access token (stored encrypted) | Meta and the client, during setup or Embedded Signup |
| Technical data | IP address, browser and device type, log-in times, error logs, webhook delivery logs | Automatically, when you use the platform |
Data we do not want: The platform is not meant to receive card numbers, bank details, government ID numbers, passwords or health information. If a contact sends something that looks like card or ID data, the platform hides it in the inbox, tells the contact not to share it, and the client can delete it.
We do not use cookies for advertising or cross-site tracking. We use only the session cookie needed to keep you logged in and a security token that protects forms.
4. How we use data
We use data to run the messaging service and for nothing unrelated to it.
- Provide the service: send and receive WhatsApp messages, show conversations in the inbox, manage contacts, templates and campaigns, and report delivery status.
- Respect consent: check opt-in and opt-out status before every business-initiated message, and keep an audit log of consent changes.
- Automate replies: run optional menu-style automated replies. Every automated reply offers a way to reach a person, and we do not use bots to invent order, booking or account facts.
- Keep the platform safe: detect abuse, spam and unauthorised access, enforce WhatsApp's policies, and fix errors.
- Support and communication: answer support requests and send service notices such as security alerts or changes to this policy.
- Meet legal duties: keep records the law requires and respond to lawful requests.
What we do not do: We do not sell personal data. We do not use message content or contact lists to build advertising profiles, and we do not share one client's data with another client. We do not use contact data to train AI or machine-learning models. If we add AI features later, we will update this policy first and give clients control over whether their data is used.
Legal bases: Where laws such as the GDPR apply, we rely on performance of our contract with you (running the service), our legitimate interest in keeping the service secure and reliable, legal obligation, and consent where required, for example a contact's opt-in to receive messages. Where India's Digital Personal Data Protection Act, 2023 applies, we process personal data with consent or for the other lawful uses the Act allows.
5. WhatsApp and Meta
The platform connects to WhatsApp through Meta's WhatsApp Business Platform (Cloud API). When a workspace sends a message, our server sends it to Meta, and Meta delivers it. When a contact writes to a workspace's number, Meta sends the message and its delivery status to our webhook at wa.codebitel.com, which verifies Meta's signature before accepting it.
Meta receives the phone numbers and message content needed to deliver messages and handles them under its own terms and privacy policies. We encourage contacts to read WhatsApp's Privacy Policy and the WhatsApp Business Terms.
When a client connects its WhatsApp account, we receive only what Meta grants through the permissions whatsapp_business_messaging and whatsapp_business_management. We use them to send messages, receive webhooks, read and create message templates, and read the phone number and account details of that client's own WhatsApp Business Account. We do not use these permissions to access any other Meta account data.
The access token Meta gives us is stored encrypted, is never shown in the interface, and is deleted when the client disconnects its number. We do not use data we receive from Meta for any purpose other than providing the messaging service to the workspace it belongs to.
Messages that a contact sends to a business number can be read by that business and by the service providers it uses, including us. Contacts should not share anything they would not want a business to see.
6. Consent, opt-out and messaging rules
The platform is built to follow WhatsApp's Business Messaging Policy, and several of the rules are enforced in the software itself:
- Opt-in first: A contact cannot be saved in a workspace without recording what they agreed to, how and when. Business-initiated messages go only to people who opted in to that type of message.
- Opt-out any time: A contact who sends STOP, UNSUBSCRIBE or OPT OUT is opted out immediately, receives one confirmation, and gets no further automated or marketing messages. Sending START opts them back in. Opt-outs are checked again at the moment each campaign message is sent.
- Approved templates: Business-initiated messages use templates approved by Meta. Free-form text is allowed only inside the 24-hour window after the contact last wrote.
- Restricted categories: Marketing templates must include a way to opt out, and we block categories WhatsApp restricts, such as gambling, adult content, drugs and similar.
- A human is always available: Automated replies offer a way to talk to a person, and a person can take over any conversation from the inbox.
A contact who no longer wants messages can reply STOP to any message, tell the business directly, or write to us using the contact details in section 10.
7. Who we share data with
We do not sell personal data and we do not share it for advertising. We share it only in these situations:
| Recipient | Why | What they receive |
|---|---|---|
| Meta Platforms (WhatsApp) | To deliver messages and manage templates and phone numbers | Phone numbers, message content, template content, account identifiers |
| Hosting and infrastructure providers | To run our servers, database and backups | Data stored on our servers, under confidentiality and security terms |
| The client that owns the workspace | Because the data belongs to that client | Contacts, messages and consent records of its own workspace only |
| Professional advisers, authorities, courts | To meet legal duties or defend legal claims | Only what the law or the claim requires |
| A buyer or successor of our business | If CodeBitel merges, is acquired or sells assets | Data stays under this policy, and we will tell you before it changes |
We will list any new category of service provider here, such as email delivery, analytics, payments or AI services, before we start using it with personal data.
Workspace isolation: One workspace can never see another workspace's data. The platform separates every record by workspace, and our automated tests check that this separation holds.
8. Security, retention and transfers
Security: We protect data with HTTPS on all connections, encrypted storage of WhatsApp access tokens, hashed passwords, signature checks on every incoming webhook, rate limits, separation of workspaces, restricted server access, and regular database backups. No system is perfectly secure. If a breach affects personal data, we will notify affected clients and, where the law requires, the authorities and the people concerned without undue delay.
Retention: We keep data only as long as it is needed for the purposes in this policy.
| Data | How long we keep it |
|---|---|
| Account data | While the account is active, then deleted within 30 days of closure |
| Contacts, messages, templates and campaigns | While the workspace is active, or until the client or contact asks for deletion |
| Consent records | Kept for 3 years after the last change, so we can prove consent or opt-out |
| Technical and webhook logs | Up to 90 days |
| Database backups | Up to 14 days, after which deleted data disappears from backups |
These retention periods represent our current operating standards; we will update this table if any periods change.
International transfers: Meta, and our hosting providers, may process data in countries other than yours, including outside India and the European Economic Area. Where the law requires it, we use appropriate safeguards such as contractual protections.
9. Your rights and data deletion
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy, withdraw consent, and complain to a data protection authority. In India you may also nominate someone to exercise your rights and use our grievance process.
How to ask for deletion: You can request deletion of your data at any time:
- Visit our data deletion page at https://wa.codebitel.com/data-deletion, or email us at the address in section 10 with the phone number or account email concerned.
- We confirm your identity where needed, for example by replying on the WhatsApp number concerned.
- We delete or anonymise the data within 30 days, except records we must keep by law, such as an opt-out record we keep so we do not message you again.
Inside the platform, a workspace user can delete a contact and their data with the "Delete data" button. When a client disconnects a WhatsApp number or closes a workspace, we erase the stored access token and delete the workspace data according to the retention table above.
If you remove our app from your Facebook or WhatsApp settings, we stop receiving data through it. You can still ask us to delete data already stored.
We respond to rights requests within the time the law sets, and in any case within 30 days. We do not charge a fee unless a request is clearly unfounded or excessive.
10. Children, changes and contact
Children: The platform is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18, or under the age of digital consent in their country, without the consent of a parent or guardian. If you believe a child's data is in the platform, contact us and we will delete it.
Changes: We will update this policy as the platform grows, including when we add features, new service providers or new types of data. We will change the effective date at the top and, for material changes, tell workspace owners by email or in the platform before the change takes effect.
Contact: For privacy questions, rights requests or complaints, write to us at [email protected]. Grievance Officer (India): Ajay, Email: [email protected].
Website: https://codebitel.com · Platform: https://wa.codebitel.com.
This policy is available at https://wa.codebitel.com/privacy-policy and at https://wa.codebitel.com/privacy.