1. Who is responsible
Meowsapp, Kuala Lumpur, Malaysia, is the data user (controller) for the data described in sections 2 and 3. For message content that passes through your sessions, you are the data user and we are your data processor (section 4). Questions and requests go to [email protected].
2. Data about you, the customer
- Account data: name, work email, company or website, the plan and number count you chose, and what you told us you are building. Collected when you request access.
- Billing data: handled by our payment provider (Stripe) once card payments are live. We see the last four digits of a card and the invoices, never the full card number.
- Usage data: API calls per session, webhook delivery results, session status and health events. Needed to run the Service, bill correctly and support you.
- Support correspondence: emails and messages you send us.
We use this to provide the Service, to bill you, to answer you, to send service notices, and, if you signed up, to tell you about changes to the Service. You can opt out of anything that is not a service notice at any time.
3. Data collected on this website
We use the Meta Pixel and, when configured, Google Analytics and Google Ads tags to measure how people find this site and which pages lead to a trial. They set cookies and send page views and button clicks, with your IP address and browser details, to Meta and Google. When you submit the access form we may also send Meta a hashed version of your email so that the ad that brought you here can be attributed. We do not send message content or anything about your WhatsApp sessions to any advertising platform.
Server logs on Cloudflare record requests for security and reliability and are kept for a short period. You can block the tracking tags with any content blocker; the site works without them.
4. Message data that passes through your sessions
- Without hosted history: messages are relayed to your webhook and held only as long as needed to deliver and retry. Failed deliveries are discarded after the retry window.
- With hosted history enabled on a session: we store the chats, the contact names and phone numbers WhatsApp exposes to the session, profile pictures, and copies of media at permanent links, so your application can read them over the API. You turn this on per session and you can turn it off.
- We never read, analyse or use message content for our own purposes, and we never share it with third parties except the infrastructure providers below.
You are responsible for having a lawful basis to message the people your sessions talk to and for honouring their requests. Tell us if a recipient asks for their data to be deleted and we will remove it from stored history.
5. Where data is stored and who processes it
- Sessions and hosted history: Singapore, on DigitalOcean infrastructure.
- Website, DNS and edge: Cloudflare, global network.
- Payments: Stripe.
- Email: Google Workspace.
- Advertising measurement: Meta Platforms and Google, as described in section 3.
Some of these providers process data outside Malaysia. We rely on their published data-protection commitments and contractual terms for those transfers.
6. Retention
- Account and billing data: for as long as you have an account, then up to seven years for tax and accounting records.
- Hosted history: for as long as history is enabled on the session, then deleted within 30 days of you disabling it or closing the account.
- Usage logs: 90 days.
- Access requests that never become an account: 12 months.
7. Your rights
Under the PDPA you may ask for a copy of your personal data, ask us to correct it, withdraw consent for direct marketing, and ask us to stop processing it in certain circumstances. You may also close your account, which deletes your data as described above. Email [email protected] from your account address; we answer within 21 days.
8. Security
Transport is encrypted end to end between you and our API. Session credentials are stored encrypted at rest. Access to production systems is limited to the people who operate the Service. Your account token and per-session secrets are the keys to your data; keep them server-side and rotate them if you suspect exposure.
9. Changes
We will post changes here and note them in the changelog. Material changes are also emailed to account holders.