Privacy Policy

1. Introduction and Who We Are

Welcome to Sunny WhatsUp ("we," "us," "our," or the "Platform"). Sunny WhatsUp is a cloud-based, multi-tenant Software-as-a-Service (SaaS) platform that enables WhatsApp Business API access for businesses ("Companies") through integration with the Meta WhatsApp Business Platform.

This Privacy Policy ("Policy") explains how Sunny WhatsUp collects, uses, discloses, stores, retains, and protects personal information about:

• Visitors to our public-facing web properties
• Company Admins — representatives of businesses that register on the Platform and connect their Meta WhatsApp Business Accounts (WABAs)
• Super Admins — platform operators and administrators employed or authorised by Sunny WhatsUp
• Message Recipients — end users whose phone numbers are sent WhatsApp messages by Companies using our Platform

By accessing or using Sunny WhatsUp, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please discontinue use immediately.

2. Scope of This Policy

This Policy applies to:

• The Sunny WhatsUp web application and all subdomains
• Our backend API services
• All data collected through the platform including registration flows, WhatsApp Business Account connection, template management, and message dispatch
• All integration data exchanged with Meta Platforms, Inc. ("Meta") via the WhatsApp Business Platform API

This Policy does not apply to:

• Third-party websites, services, or products linked from our platform
• Meta's own data practices — please review Meta's Privacy Policy
• The end-users' own WhatsApp data, which is governed by Meta's terms between the Company and Meta

3. Definitions

4. Information We Collect

4.1 Account and Registration Data

When a Company Admin registers on Sunny WhatsUp, we collect:

• Identity data: First name, last name
• Contact data: Email address, contact phone number
• Company data: Company name, legal name, website URL, contact email, contact phone number
• Authentication data: Hashed passwords (bcrypt, cost factor 10 — we never store plaintext passwords)
• Account metadata: Registration timestamp, last login timestamp, account status (pending / approved / rejected / suspended), approval/rejection reason

4.2 WhatsApp Business Account (WABA) Data

When a Company Admin connects their Meta WABA via our platform, we collect and store:

• WABA identifiers: Meta WABA ID, Meta Business ID
• Business profile data: WhatsApp Business display name (as returned by Meta's Graph API)
• System User Access Token: The OAuth access token issued by Meta that grants our platform permission to send messages on behalf of the Company. This token is encrypted at rest using AES-256-GCM with a 256-bit key stored in a separate environment variable. The stored format is ivHex:authTagHex:cipherHex. The plaintext token is never logged and never written to disk unencrypted.
• Connection metadata: Connection timestamp, onboarding flow used (Meta Embedded Signup, existing account onboarding, or manual sandbox token entry), IP address of the connecting user
• Phone number data: Meta phone number IDs, display phone numbers, verified names, quality ratings, default status

4.3 Message Template Data

• Template names, languages, categories (Marketing, Utility, Authentication)
• Template component structures including header text, body text with positional variables, footer text, and button configurations — stored as structured JSON
• Meta-assigned template IDs and approval status
• Quality scores and rejection reasons returned by Meta
• Template sync timestamps and raw metadata from the Meta Graph API
• The identity of the Sunny WhatsUp user who created the template

4.4 Message Logs

For every WhatsApp message sent via our platform, we log:

• Sender company and user identity
• Recipient phone number
• Message type (template-only)
• Full message payload as submitted to Meta's API (template name, language code, and resolved variable values)
• Meta's message ID returned upon successful submission
• Delivery status (Queued, Sent, Delivered, Read, Failed)
• Error payloads from Meta (if message delivery failed)
• Timestamp of dispatch

4.5 Usage and Technical Data

• Authentication tokens: JWT tokens (HS-256, 1-day expiry) stored in browser localStorage and mirrored to HTTP cookies for server-side route validation
• IP addresses: Captured for security-relevant actions (WABA connect, disconnect/purge)
• Audit logs: Records of administrative actions (company approval/rejection, WABA connection/disconnection, template creation/deletion) including actor identity, action type, target entity, and timestamp
• HTTP access logs: Standard server access logs including request method, path, status code, and response time

4.6 Data Collected from Third Parties (Meta)

When you authorise our platform via the Meta Embedded Signup flow, Meta returns:

• An authorization code (short-lived, exchanged server-side for an access token — the code itself is not persisted)
• WABA metadata (business name, currency, timezone)
• Phone number details (display number, verified name, quality rating)
• Message template listings including approval status and quality scores
• Token debug information (scopes, expiry) used during validation

5. How We Collect Information

1. Directly from you: Registration forms, the WABA connection flow (Embedded Signup or manual token entry), template creation forms, and message sending actions
2. Automatically via our systems: Server-side logging, JWT validation middleware, and audit trail creation on every significant action
3. From Meta's Graph API: WABA metadata, phone numbers, template status updates (pulled during sync operations triggered by you or automatically after WABA connection)
4. From your browser: Cookies and localStorage for authentication state persistence; no third-party analytics trackers are embedded in the current platform version

6. How We Use Your Information

6.1 Service Provision

• Creating and managing Company and Super Admin accounts
• Facilitating the Meta Embedded Signup onboarding flow
• Storing and managing WABA credentials securely to enable message dispatch on your behalf
• Syncing and displaying your Meta message templates
• Sending WhatsApp messages via the Meta Graph API using your WABA credentials
• Displaying message delivery logs and statistics on your dashboard

6.2 Platform Administration

• Super Admin review and approval/rejection of Company registrations
• Monitoring platform health, usage, and message delivery statistics
• Displaying cross-tenant aggregate statistics to Super Admins

6.3 Security and Fraud Prevention

• Verifying identity and authentication at every API request via JWT validation
• Rate limiting (300 requests per 15-minute window per IP by default) to prevent abuse
• Audit logging of all sensitive administrative actions for security investigation
• Detecting and preventing unauthorised access

6.4 Legal Compliance

• Maintaining records as required by applicable law
• Responding to lawful requests from authorities
• Enforcing our Terms of Service

6.5 Service Improvement

• Internal aggregate analytics to understand usage patterns and improve features

7. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we rely on the following legal bases under GDPR Article 6:

For special categories of data: We do not intentionally collect special category data (health, biometric, racial/ethnic, etc.). If any such data appears incidentally in message content, it is not processed or used for any purpose other than transmission to Meta's API.

8. Multi-Tenant Data Architecture and Isolation

Sunny WhatsUp is a multi-tenant platform. Each Company's data is logically isolated using a company_id foreign key present on every data table. Our architecture enforces the following isolation guarantees:

• Every API endpoint that returns tenant-specific data applies a WHERE company_id = [authenticated company's ID] filter, enforced server-side through authenticated middleware
• Company Admins are only ever authorised to access, manage, and view data belonging to their own company
• Super Admins may view data across all tenants for platform administration purposes but cannot impersonate Company Admins or access their login sessions
• All role-based authorisation checks occur server-side via middleware — client-side roles are never trusted

9. Meta (WhatsApp Business Platform) Integration

9.1 How the Integration Works

Sunny WhatsUp integrates with Meta's WhatsApp Business Platform API (Meta Graph API v21.0 or later). When you connect your WABA:

1. You are redirected through Meta's Embedded Signup popup, which is governed by Meta's own terms and privacy policy
2. Upon your authorisation, Meta returns an OAuth code to our backend
3. Our server exchanges this code for a System User Access Token via a server-to-server call to Meta's OAuth endpoint using your App ID and App Secret — this exchange never passes through the browser
4. The resulting access token is immediately encrypted (AES-256-GCM) and stored in our database. The plaintext token exists only transiently in server memory during API calls

9.2 Data Meta Shares With Us

Through the WhatsApp Business API, Meta shares with us (subject to your authorisation):

• WABA metadata (name, currency, timezone)
• Phone number details and quality ratings
• Message template definitions and approval statuses
• Message delivery status callbacks (if webhook integration is configured)

9.3 Data We Share With Meta

When you use our platform to send messages or manage templates:

• Recipient phone numbers
• Template names, languages, and variable values
• Your WABA credentials (access token transmitted server-side only, over HTTPS, never client-side)

9.4 Meta as an Independent Data Controller

For data processed through Meta's infrastructure (message delivery, template review, phone number verification), Meta operates as an independent or joint data controller subject to their own Privacy Policy and WhatsApp Business Terms of Service. We are not responsible for Meta's data practices.

9.5 Sandbox and Development Accounts

During development and testing, Companies may use Meta's test phone numbers, temporary 24-hour access tokens, or System User tokens. These are treated identically to production credentials in terms of encryption and storage practices.

10. Data Sharing and Disclosure

We do not sell, rent, or trade your Personal Data. We share data only in the following limited circumstances:

10.1 With Meta Platforms, Inc.

As described in Section 9, we transmit WABA credentials and message data to Meta's Graph API to perform the services you've requested. This is fundamental to platform operation.

10.2 With Infrastructure Providers

Our platform runs on cloud infrastructure (hosting, databases, networking). These providers process data as sub-processors under appropriate data processing agreements. We select providers that offer adequate data protection guarantees.

10.3 Legal Requirements

We may disclose Personal Data if required to do so by law or in good faith belief that such action is necessary to: comply with a legal obligation or court order; protect and defend our rights or property; prevent or investigate possible wrongdoing; or protect the personal safety of users or the public.

10.4 Business Transfers

In the event of a merger, acquisition, asset sale, or bankruptcy, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different privacy policy.

10.5 With Your Explicit Consent

We will share data with additional third parties only with your explicit, informed consent.

10.6 Within the Platform (Super Admins)

Super Admins have access to aggregate statistics across all tenants and may view individual Company registration details (name, contact email, approval status) for platform administration purposes. Super Admins cannot access message content, WABA tokens, or other sensitive Company operational data beyond what is needed for administrative oversight.

11. Data Security

We implement technical and organisational security measures appropriate to the sensitivity of the data we process:

11.1 Encryption

• In transit: All communications between clients and our servers use TLS 1.2+ (HTTPS enforced)
• At rest — access tokens: Meta System User tokens are encrypted using AES-256-GCM (Galois/Counter Mode), providing both confidentiality and authenticated integrity. Each encryption operation generates a cryptographically random 96-bit IV; the encrypted record is stored as ivHex:authTagHex:cipherHex. The master encryption key (256-bit) is stored as an environment variable, never in source code or version control.
• At rest — passwords: User passwords are hashed using bcrypt with a work factor of 10 and never stored in plaintext anywhere — not in logs, databases, or backups.
• JWT secrets: Authentication token signing secrets (HS256) are long-lived, randomly generated, and stored exclusively as environment variables.

11.2 Authentication and Access Control

• All API endpoints require a valid JWT bearer token (1-day expiry)
• Role-based access control (RBAC) enforced server-side: company_admin and super_admin roles with distinct permission sets
• JWT validation middleware verifies token signature, expiry, and issuer on every request
• Company admins with unapproved company status are blocked from accessing the dashboard even with a valid token

11.3 Rate Limiting

API rate limiting is applied (300 requests per 15-minute window per IP by default) to help mitigate brute-force attacks and API abuse.

11.4 Security Headers

HTTP security headers are applied via Helmet.js: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Content-Security-Policy, and others. The X-Powered-By header is removed to reduce fingerprinting surface.

11.5 Audit Logging

All sensitive actions (login, company approval/rejection, WABA connect/disconnect, template create/delete) are recorded in audit_logs with actor identity, action type, target entity, and timestamp. Audit records are append-only and cannot be deleted by Company Admins.

11.6 Data Breach Notification

Despite our measures, no security system is impenetrable. In the event we discover a personal data breach, we will:

• Contain and assess the breach within 24 hours of discovery
• Notify the relevant supervisory authority (e.g., ICO for UK users, relevant EU DPA for EEA users) within 72 hours of becoming aware, where the breach is likely to result in risk to individuals' rights and freedoms
• Notify affected individuals without undue delay if the breach is likely to result in high risk to their rights and freedoms
• Maintain internal records of all breaches regardless of notification obligation

12. Data Retention and Deletion

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy or as required by law.

12.1 Retention Periods

12.2 Account Deletion

Self-service deletion. A Company Admin can permanently delete their company at any time from Settings → Security → Delete account. After an in-app confirmation, this action immediately and irreversibly hard-deletes all of the company's data from our database, including:

• The company record and all of its user accounts
• The WABA account record and its encrypted access token
• All associated phone numbers
• All message templates
• All message logs and delivery history
• All audit logs and any data archive snapshots for the company

This deletion cannot be undone, no recovery copy or archive is retained, and the deletion takes effect immediately rather than over a 30-day window. We may retain anonymised, aggregated statistics that cannot be linked back to you, and a minimal non-identifying application log noting that a deletion occurred.

Deletion by request. Alternatively, you may request deletion by contacting us at sunny_softwares@yahoo.com, and we will carry out the same permanent deletion on your behalf upon verified request.

12.3 WABA Disconnect and Automatic Cleanup

When a Company Admin uses the Disconnect & Purge action in the platform, the following is automatically hard-deleted from our primary database:

• The WABA account record (and encrypted access token)
• All associated phone numbers
• All associated message templates
• All associated message logs

This data is removed from all primary database tables and will no longer appear in any user interface. See Section 13 for archival practices applicable to this action.

13. Data Archival Practices

13.1 Purpose of the Archive

When WABA data is purged (Section 12.3), Sunny WhatsUp creates an archive snapshot in a separate data_archive_events table before deletion. This archive is accessible only to Sunny WhatsUp's authorised technical staff (Super Admins) and is used solely for:

• Debugging and post-incident investigation
• Fraud detection and abuse prevention
• Compliance with our internal audit requirements

13.2 What the Archive Contains

The archive snapshot includes:

• WABA metadata (WABA ID, business name, connection timestamps) — the encrypted access token is REDACTED and not included in the archive
• Phone number records (phone number IDs, display numbers, verified names)
• All message templates at the time of disconnection
• A sample of up to the 200 most-recent message log records (including recipient phone numbers and message payloads)
• Summary counts of total records purged
• Identity of the user who triggered the disconnect and their IP address
• Timestamp of the archive event

13.3 Archive Retention and Access

• Archive records are retained for 3 years from creation
• Archive data is not accessible through any Company Admin interface
• Archive data is never used for marketing or product improvement
• The archive table uses ON DELETE SET NULL for foreign keys to the companies and users tables, so archive records persist even if the triggering company or user is later deleted

13.4 Your Rights Over Archived Data

If you have disconnected your WABA and subsequently submit a verified erasure request, we will delete your archived data from data_archive_events subject to any overriding legal retention obligations. Send requests to sunny_softwares@yahoo.com with subject "Archive Erasure Request."

14. Cookies and Tracking Technologies

14.1 Cookies We Use

14.2 We Do Not Use

• Advertising or tracking cookies
• Third-party analytics cookies (e.g., Google Analytics, Facebook Pixel)
• Cross-site tracking mechanisms

14.3 localStorage

In addition to cookies, we store the following in your browser's localStorage:

• sunny_whatsup_auth_token: Your JWT authentication token
• sunny_whatsup_auth_user: A JSON object containing your non-sensitive user profile data (name, email, role, company name/status)

These values are cleared when you log out.

14.4 Cookie Control

You may configure your browser to refuse cookies. However, refusing functional authentication cookies will prevent you from logging in to the Platform. The Meta Embedded Signup flow (operated by Meta) may set its own cookies; please refer to Meta's Cookie Policy for details on those.

15. International Data Transfers

Sunny WhatsUp may process and store your data in servers located outside your country of residence. If you are based in the EEA, UK, or a jurisdiction with data export restrictions:

• We transfer data only to countries with an adequacy decision, or under appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to Meta (a US-based company) are governed by the EU-US Data Privacy Framework and/or applicable SCCs
• Our infrastructure providers are selected based on their ability to provide GDPR-equivalent guarantees

By using our Platform, you acknowledge that your data may be transferred to and processed in countries outside your jurisdiction.

16. Your Rights and Choices

To exercise any right, contact sunny_softwares@yahoo.com with your name, email address, and a description of your request. We will verify your identity before processing requests.

16.1 Rights Available to All Users

16.2 EEA / UK Users (GDPR / UK GDPR)

You have all rights listed in 16.1, plus the right to Restriction of Processing in certain circumstances. We do not use fully automated decision-making that produces legal effects about you.

Response time: We will respond to verified requests within 30 days (extendable by a further 2 months for complex requests, with notice).

Supervisory Authority: You have the right to lodge a complaint with your national DPA. For UK users: the Information Commissioner's Office (ICO) at ico.org.uk.

16.3 California Users (CCPA / CPRA)

California residents have additional rights:

• Know: The categories and specific pieces of Personal Information collected, disclosed, or sold
• Delete: Request deletion of Personal Information (subject to exceptions)
• Correct: Request correction of inaccurate Personal Information
• Opt-Out of Sale: We do not sell Personal Information. No opt-out is therefore required.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Categories of Personal Information Collected (per CCPA): Identifiers (name, email, phone number, company name); Commercial information (business account details); Internet or electronic network activity information (access logs, authentication events); Professional or employment-related information (company role).

To submit a CCPA rights request, email sunny_softwares@yahoo.com with subject "CCPA Privacy Request."

16.4 Indian Users (DPDP Act 2023)

Under India's Digital Personal Data Protection Act 2023, you have the right to access information about your Personal Data, correction and erasure, grievance redressal, and the right to nominate a representative.

Grievance Officer: sunny_softwares@yahoo.com

17. Children's Privacy

Sunny WhatsUp is a business-to-business (B2B) platform intended solely for use by businesses and their adult employees. We do not knowingly collect Personal Data from individuals under the age of 18 (or the age of majority in your jurisdiction).

If you believe we have inadvertently collected Personal Data from a minor, please contact us immediately at sunny_softwares@yahoo.com and we will take steps to delete such information as quickly as possible.

18. Third-Party Links and Services

The Platform may contain links to third-party websites or services (including Meta's developer documentation and the Meta Business Suite). We are not responsible for the privacy practices or content of those third-party sites. This Policy does not apply to any third-party websites or services.

Key third-party integrations and their privacy policies:

• Meta Platforms, Inc. (WhatsApp Business API, Embedded Signup): https://www.facebook.com/privacy/policy/

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by:

• Posting a notice on the Platform dashboard
• Sending an email to the registered email address of Company Admins
• Updating the "Last Updated" date at the top of this page

Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes. For material changes that require consent (e.g., new processing purposes), we will obtain your explicit consent before the changes apply to your existing data.

20. Contact Us

For any questions, requests, or concerns about this Privacy Policy or our data practices, please contact:

21. Jurisdiction-Specific Addenda

21.1 European Economic Area and United Kingdom

We are committed to processing Personal Data in compliance with GDPR (EU) 2016/679 and the UK GDPR as retained by the Data Protection Act 2018.

Data Processing Agreements: Business customers established in the EEA or UK who use our Platform to process Personal Data of their end users may require a Data Processing Agreement (DPA) with Sunny WhatsUp. Please contact sunny_softwares@yahoo.com to request a DPA.

21.2 Brazil (LGPD)

For users in Brazil, our processing is subject to Lei Geral de Proteção de Dados (LGPD). You have the right to access, correct, anonymise, block, or delete unnecessary or excessive data, and to data portability. Contact sunny_softwares@yahoo.com for requests.

21.3 Canada (PIPEDA / Provincial Laws)

For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. You may request access to and correction of your Personal Information by contacting our Privacy Team.

21.4 Australia (Privacy Act 1988)

For users in Australia, we comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to access and correct information we hold about you. Complaints may be directed to our Privacy Team first; unresolved complaints may be escalated to the Office of the Australian Information Commissioner (OAIC).