WasapFlow Bridge only connects your software to Meta's official WhatsApp Cloud API. Messages pass through us in real time. Your conversations, inbox and customer data live in your own system.
Your inbox, contacts, orders and chat history. You control it.
Passes messages through, signs webhooks, holds tokens encrypted. No inbox.
Delivers to your customers' phones on the official Cloud API.
"We store nothing" is not quite true for any API provider, so here is the full list.
| Data | Why | Retention |
|---|---|---|
| Message content | Passed through in transit only, between Meta and your endpoint. | Not stored |
| Undelivered webhook events | If your endpoint is down, events wait in a buffer so you can replay them, so nothing is lost. | Auto-deleted after 30 days |
| Delivery metadata | Message IDs, timestamps, delivery status and Meta pricing category, used for billing and delivery tracking. No message text. | Account lifetime |
| Access tokens | Meta's token for each connected WhatsApp account, used to send on its behalf. | Encrypted (AES-256) |
| Broadcast jobs (optional feature) | Only if you use our broadcast endpoint: the recipient list and template variables, so the job can run in batches. | Until you ask us to delete |
| Your partner account | Your name, email, company, billing and support tickets. This is about you, not your customers. | Deleted within 30 days of closure |
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms | WhatsApp Business Platform: message delivery | Per Meta's terms |
| DigitalOcean | Server hosting and database | Singapore |
| Cloudflare | Network security, DDoS protection and TLS | Global edge |
| Stripe | Partner billing (your card details, never your customers' data) | USA / global |
| Brevo | Account and billing emails to you | EU |
x-wasapflow-signature), so you can verify that it came from us.Our Data Processing Agreement uses the processor terms that these laws have in common: acting only on your instructions, confidentiality, security, sub-processor notice, breach notice, help with data subject requests, and deletion at the end. It names the laws below. Where your law needs an extra transfer mechanism (for example standard contractual clauses), we add it on request.
This page summarises our practices; the signed DPA and our Privacy Policy are the binding documents.