Privacy Policy

Effective date: 10 June 2026

Summit Automates ("we", "us") provides a customer-relationship-management platform that lets businesses ("Customers") manage their WhatsApp Business communication through the WhatsApp Business Platform operated by Meta Platforms, Inc. ("Meta"). This policy explains what data we collect, why, and how it is handled.

1. Data we collect

• Account data — name, business email, password (stored as a salted bcrypt hash), organization name, and team-member roles.
• WhatsApp Business assets — when a Customer connects their WhatsApp Business Account (WABA) through Meta's Embedded Signup, we receive identifiers (WABA id, phone number id, display number, verified name) and an access token scoped to that Customer's WABA. Tokens are encrypted at rest with AES-256-GCM and are never shown in the interface or written to logs.
• Messages and contacts — message content, delivery states, and contact records (phone number, name, attributes, tags, opt-in status) that Customers process through the platform. We process this data on the Customer's behalf and on their instructions.
• Technical data — server logs (IP address, timestamps, request paths) kept for security and troubleshooting.

2. How we use data

• To operate the service: deliver and receive WhatsApp messages, manage message templates, run Customer-initiated broadcasts, and display conversation history to authorized team members.
• To protect the WhatsApp ecosystem: we enforce recipient opt-in for business-initiated messages, automatically honor STOP/UNSUBSCRIBE requests, and throttle sending.
• To secure accounts: authentication, role-based access control, and audit logging of sensitive actions.

We do not sell personal data. We do not use Customer message content for advertising or to train models.

3. Sharing

Data is shared only with: (a) Meta, as necessary to send and receive WhatsApp messages via the WhatsApp Business Platform, governed by Meta's terms and the WhatsApp Business Data Processing Terms; (b) our hosting and infrastructure providers, bound by data-processing agreements; (c) authorities where required by law.

4. Retention

Account data is kept while the account is active. Message and contact data is retained per the Customer's configuration and deleted upon verified deletion requests or account termination. Backups roll off within 35 days.

5. Security

Transport encryption (TLS) everywhere; WABA access tokens encrypted at rest (AES-256-GCM); passwords hashed with bcrypt; role-based access; audit trails for sensitive operations.

6. Your rights

End customers of our Customers should direct requests (access, correction, deletion) to the business they communicated with; we support our Customers in fulfilling them. Platform users may contact us directly at the address below for access, correction, export, or deletion of their account data.

7. Meta platform compliance

Our use of WhatsApp Business Platform data complies with the Meta Platform Terms and the WhatsApp Business Messaging Policy. Upon request from Meta or a Customer disconnecting their WABA, we delete the associated access token and stop all processing for that WABA.

8. Contact

Summit Automates — admin@summitautomates.com

See also our Terms of Service.