Privacy Policy

Brandtimacy (“we”, “us”, “our”) operates BCRM, a WhatsApp Business CRM platform that lets businesses (“Clients”) manage customer conversations over the WhatsApp Business Platform, operated by Meta Platforms, Inc. (“Meta”). This policy explains what data we collect, including data processed through WhatsApp, why we collect it, and how it is handled — for both our business Clients and the end customers who message them.

1. Who this policy applies to

This policy covers three groups: Clients — businesses that sign up for BCRM to manage their WhatsApp Business number; Client staff — the agents and admins a Client adds to their BCRM workspace; and end customers— the people who message a Client's WhatsApp Business number.

2. What data we collect

• Account data: business name, email address, phone number, and login credentials for Clients and their staff.
• WhatsApp conversation data:messages, timestamps, delivery/read status, contact names, and phone numbers exchanged between a Client's WhatsApp Business number and their customers, received and sent via the WhatsApp Business Platform (Meta Cloud API).
• Media: images, documents, audio, and video attachments sent or received in WhatsApp conversations, stored in our cloud storage.
• Business configuration data: message templates, automation rules, broadcast lists, tags, and knowledge-base content a Client creates.
• Usage data: log data such as feature usage and error reports, used to operate and improve the platform.

3. How we use data

• To display and operate the shared WhatsApp inbox for a Client's team, including sending and receiving messages via the WhatsApp Business Platform.
• To power optional AI-assisted replies: when a Client enables this feature, relevant message content and the Client's own knowledge-base documents are sent to our AI provider to generate a suggested or automatic reply. Only the context needed for that specific reply is sent — not a customer's full message history.
• To send broadcast messages and approved WhatsApp templates that a Client has created, to the contacts that Client has added or imported.
• To enforce plan limits (agent seats, WhatsApp numbers, AI credits, storage) tied to a Client's subscription.
• To provide customer support and maintain platform security.

We do not use conversation content for advertising, and we do not sell Client or end-customer data to third parties.

4. Legal basis and consent for WhatsApp messaging

Clients are responsible for obtaining valid opt-in consent from their customers before messaging them on WhatsApp, in line with Meta's WhatsApp Business Messaging Policy. Every end customer can reply STOP at any time to opt out of further messages from a Client, and START to opt back in; BCRM enforces this automatically across every Client workspace.

5. Third-party data processors

BCRM relies on the following processors to operate the service:

• Meta / WhatsApp Business Platform— to send and receive WhatsApp messages on behalf of Clients. Meta's own handling of WhatsApp data is governed by the WhatsApp Business Data Processing Terms and Meta Privacy Policy.
• Cloudflare — for infrastructure, DNS, and secure media storage.
• Anthropic — to generate AI-assisted replies, only for conversations where a Client has explicitly enabled AI.

6. Data storage and security

Conversation and account data is stored in encrypted databases, access-controlled by workspace. Media is stored with signed, time-limited URLs rather than public links. API keys and credentials are stored hashed or encrypted — never in plain text.

7. Data retention and deletion

We retain a Client's data for as long as their account is active, so they retain their own customer history. If a Client closes their account, we delete their workspace data within 30 days unless we are legally required to retain it longer. End customers may request deletion of their own conversation data by contacting the business they messaged directly, or by emailing us at the address below and we will forward the request.

8. Children's privacy

BCRM is a business tool and is not directed at children. We do not knowingly collect data from children through the platform beyond what a Client's own end customers may send in the ordinary course of messaging that business.

9. Your rights

Clients can export or delete their own customers' data from within the BCRM product. Anyone may request a copy of the data we hold about them, or ask us to delete it, by contacting us using the details below.

10. Changes to this policy

We may update this policy as BCRM evolves. Material changes will be reflected by updating the “Last updated” date above.

11. Contact

Questions about this policy or data requests: privacy@brandtimacy.com