1. Who we are
The Digilistan WhatsApp Platform is a software service operated by Digilistan, a digital agency and verified Meta Tech Provider. The platform lets businesses connect their WhatsApp Business account and manage customer conversations, broadcasts and simple automations. In this policy, "we", "us" and "the platform" mean Digilistan and this service.
2. The data we process
Account data (you give us this directly)
- Your name, business name and email address when you register.
- Your password, stored only as a strong one-way hash. We never store or see your plain password.
- Team members you add, and their names, emails and roles.
WhatsApp data (received through Meta, on behalf of a connected business)
When a business connects its WhatsApp Business account to the platform through Meta's Embedded Signup, we receive and process the following data through the WhatsApp Business Platform (Cloud API):
- The business's WhatsApp Business account ID, phone number and display name.
- Messages sent to and from the connected number: message text, media references, timestamps, and delivery states (sent, delivered, read, failed).
- The phone numbers and profile names of people who message the business.
- Message templates the business creates or syncs, and their approval status.
- Contact records the business creates or imports, including names, phone numbers, tags and notes.
- Technical events from Meta's webhooks, such as account updates and template status changes.
Technical data
Standard server logs (IP address, browser type, request times) kept for security and abuse prevention, and essential cookies used only to keep you signed in.
3. Why we process it
- To provide the service: showing conversations in the shared inbox, sending messages and campaigns the business asks us to send, running its chatbot rules, and syncing templates.
- To operate accounts: sign-in, password resets, team access and plan management.
- To keep the platform safe: preventing abuse, investigating errors and enforcing WhatsApp's policies.
- To support you: answering questions you send us.
We do not sell personal data. We do not use the WhatsApp message content of a business or its customers for advertising, and we do not train models on it.
4. Our role: controller and processor
For account data (the details of the businesses registered with us), Digilistan is the data controller. For customer conversation data (the messages and contacts of a connected business), the business is the controller and Digilistan acts only as its processor: we process that data solely on the business's instructions, through the features it uses.
5. Who we share data with
| Recipient | What and why |
|---|---|
| Meta Platforms (WhatsApp) | Messages, templates and account events needed to operate the WhatsApp Business Platform. WhatsApp messages are also governed by WhatsApp's own privacy policy. |
| Hosting provider (Hostinger) | Our servers and database run on hosted infrastructure; the provider stores the data on our behalf. |
| Email delivery | Your email address, for account emails such as password resets. |
| Authorities | Only where the law requires it. |
We do not share data with advertisers or data brokers.
6. How long we keep data
- Account data: while your account is active, and deleted or anonymised within 30 days of account closure, except records we must keep for legal, tax or security reasons.
- Conversation data: while the business's account is active, so the inbox remains useful. When a business disconnects its number or closes its account, its conversation data is deleted or anonymised within 30 days.
- Server logs: up to 90 days.
7. Your rights and how to delete your data
You can ask us at any time what personal data of yours we hold, and ask us to correct or delete it:
- Businesses: disconnect your WhatsApp number or close your account in Settings, or email admin@digilistan.com.
- Customers of a business: contact the business first, since it controls its conversation data. You can also write to us and we will forward and assist.
- Facebook users: if you connected through Facebook and later remove the app, Meta sends us a deletion request automatically and we act on it. The full steps are on our Data Deletion page.
We respond to deletion requests within 30 days and confirm completion.
8. Security
Passwords are hashed, access tokens are stored server-side only, traffic runs over HTTPS, and webhook events from Meta are signature-verified before we act on them. Each business's data is isolated from every other business at the database level. Details are on our Security page.
9. Children
The platform is a business tool and is not directed at children. Business accounts must be held by adults.
10. Changes to this policy
If this policy changes in a material way, we will publish the updated version on this page and update the effective date. Continued use of the platform after a change means you accept the updated policy.
11. Contact
Questions about this policy or your data: admin@digilistan.com. Digilistan, Lahore, Pakistan (team base), with a listed head office in Manchester, United Kingdom.