Meta API Privacy Policy

01. About this policy

Avaloka Tech (referred to as “Avaloka Tech”, “we”, “our” or “us”) develops and operates business software and integration services. This Meta API Privacy Policy explains our data practices in connection with access to Meta technologies, particularly the WhatsApp Business Platform and Cloud API.

This policy applies to our use of information in connection with Meta integrations. It does not replace the separate privacy notices of Meta, WhatsApp, or a business that communicates with you using our technology.

02. Services and scope

Our relevant services may include:

• Central WhatsApp Engine (CWAE): a multi-tenant integration system that routes WhatsApp messages and events to the appropriate connected business application.
• AvaSutra: clinic and hospital workflows, including appointments and related customer notifications.
• AvaSalon: appointment and customer communication workflows for salons and similar businesses, where integrated.
• Other authorized applications: software that a business elects to connect to our WhatsApp integration services.

Available features and integrations may vary by product, subscription and customer configuration.

03. Our role and the role of connected businesses

A clinic, salon or other connected business generally determines why it communicates with its customers, which contacts it uses, and what information is included in those communications. Avaloka Tech provides the supporting software, integration and message-processing functions.

Depending on the processing activity and applicable law, we may process information on a business customer's instructions or for our own limited purposes, such as account administration, billing, platform reliability and security. Customers should consult the privacy notice of the business they are communicating with for details of that business's own records and practices.

04. Information we may process

The types of information may include:

• Business information: business name, representative contact details, business profile settings and associated account identifiers.
• Meta integration identifiers: WhatsApp Business Account IDs, phone number IDs, WhatsApp user identifiers, template details and integration permissions.
• Customer contact information: names, phone numbers, messaging identifiers and the business relationship or booking reference required for the service.
• Communication data: message content, interactive replies, attachments where supported, message identifiers, timestamps and conversation context needed to process a request.
• Message status and activity: delivery, read or failure events, webhook events, template usage, opt-out signals and operational activity records.
• Service-related information: appointment details or other fields that the connected application shares for its selected workflow.
• Technical and security data: necessary logs, user/account actions, API request information, authentication data and authorized integration credentials.

We do not necessarily collect every category above for every individual or every service.

05. Where information comes from

• Businesses and their authorized representatives who register or connect an integration.
• Individuals who message a participating business on WhatsApp or submit an appointment request.
• Meta's authorized APIs, account connection flows and event/webhook notifications.
• Authorized connected applications, such as a clinic's appointment management system.
• Technical systems that generate security, diagnostic or service-usage records.

06. How we use information

We process relevant information only for purposes connected to delivering and operating the services, including:

• Connecting and maintaining authorized WhatsApp Business integrations.
• Receiving, delivering and routing messages to the correct participating business.
• Enabling appointment booking, confirmations, reminders, cancellations and status updates.
• Managing message templates, delivery events, failure handling and support requests.
• Measuring usage, applying agreed service limits, and maintaining business subscriptions.
• Preventing unauthorized access, misuse, fraud and technical incidents.
• Meeting applicable legal, regulatory or platform requirements.

Where consent or another legal basis is required, the relevant business and Avaloka Tech must have an appropriate basis for their respective processing activities. We do not use WhatsApp message content or contact lists for sale to data brokers or unrelated advertising.

07. Meta API permissions and business authorization

Depending on the integration, the Meta app may request permissions such as whatsapp_business_messaging and whatsapp_business_management. These enable authorized messaging functions and management of permitted WhatsApp Business Account resources, including message templates and related account information.

A business may authorize access through Meta's available account-connection process, including Embedded Signup where supported. We use the resulting identifiers, authorizations and necessary access credentials to provide the requested integration. We do not request customers' personal Facebook or WhatsApp passwords to operate the integration.

A business can request disconnection or revoke applicable authorization through the relevant Meta business settings. Disconnecting may interrupt WhatsApp-enabled features; it does not by itself delete all data already stored by Meta or the connected business.

08. WhatsApp messaging, consent and preferences

Participating businesses are responsible for obtaining and honoring the permissions needed to message recipients, including any required opt-ins, and for complying with applicable WhatsApp and Meta rules. Where required, business-initiated communications use approved message templates.

If you no longer want a business to send you messages, contact that business directly, use any opt-out mechanism it provides, or reply with an opt-out request where supported. You may also use WhatsApp's own blocking and reporting features. Service messages and account notices may have different lawful grounds from optional marketing messages.

09. Healthcare and sensitive information

For AvaSutra and related clinic workflows, information may include a patient's name, contact details, appointment time, clinic or doctor selection, and booking status. A person may also choose to disclose other information in a conversation with a clinic.

Clinical records maintained separately by a clinic or hospital in its application are governed by that application's privacy arrangements and the clinic's legal responsibilities.

10. Data sharing and disclosures

Information may be disclosed to the following parties, as relevant to the service:

• The authorized business: to deliver the customer's messages and carry out requested business workflows.
• Meta and WhatsApp: through the WhatsApp Business Platform and associated services under Meta's applicable terms and policies.
• Infrastructure and technical providers: hosting, storage and essential support providers acting for service-operation purposes and subject to applicable safeguards.
• Professional or legal recipients: where necessary to meet a lawful request, protect rights, investigate abuse, or comply with law.

We do not authorize one unrelated tenant to access another tenant's business messages as part of the intended operation of CWAE. We do not sell WhatsApp contact data or message content to third-party advertisers.

11. International data processing

WhatsApp, Meta and some infrastructure services may process information in countries other than the country where a user or participating business is located. Cross-border processing is subject to applicable legal requirements and the relevant providers' terms. We seek to limit the information shared to what is necessary for the selected integration.

12. Security practices

We take reasonable technical and organizational measures intended to protect data, including access restrictions, authentication controls, separation of tenant records, credential-handling controls, monitoring and operational security practices as appropriate to the service. We review safeguards as our platform evolves.

No internet transmission or storage method is completely risk-free. If you believe information associated with our integration has been exposed or misused, please contact us using the details below.

13. Data retention

We retain information only for as long as reasonably needed for the relevant service, authorized business workflow, troubleshooting, security, billing, dispute resolution, or applicable legal and platform obligations. The period can differ for message events, account connections, security logs and subscription records.

Where information is no longer required, we delete or de-identify it according to our applicable processes, subject to lawful retention requirements. Backups may be removed in accordance with their normal retention cycle. Records separately retained by a connected business or by Meta are governed by those parties' respective practices.

14. Your privacy rights and choices

Depending on your location and applicable law, you may have rights to request access to, correction of, or deletion of personal information, to withdraw consent where relevant, or to raise a privacy concern.

If your request relates to a business's own customer or medical records, that business may need to handle the request directly. We will review requests concerning information we control or process and, where appropriate, coordinate with the relevant business.

15. How to request data deletion

Anyone whose personal information is processed through our Meta API integrations can submit a deletion request, without needing to create an Avaloka Tech account.

16. Children's privacy

Our Meta API integration services are offered to businesses, not designed as independent consumer services for children. However, businesses such as pediatric clinics may handle appointment information relating to minors through their lawful and authorized workflows. Where necessary, the business should obtain appropriate permission from a parent or guardian and comply with applicable protections for children's information.

17. Third-party platforms and policies

WhatsApp and Meta operate their own platforms and have their own privacy practices. You can learn more by reviewing the WhatsApp Privacy Policy and the Meta Privacy Policy. Avaloka Tech is an independent software provider and this policy is not issued by Meta.

18. Changes to this policy

We may update this policy as our services, Meta integrations, legal requirements and data practices change. The updated version will be published at this URL with a revised “Last updated” date. Where required, we will provide any additional notice.

19. Contact Avaloka Tech

Please use the subject “Meta API Privacy Inquiry” for questions about this policy, or follow the specific deletion-request instructions in Section 15.