Who is responsible
This notice covers signup and the dedicated WhatsApp Business connection service at waba.openally.ai, operated by Matterward Labs Private Limited (“Matterward Labs”, “we”). It supplements the OpenAlly Privacy Policy.
We are responsible for your OpenAlly account, service security, and support information. The business connecting an inbox decides why its customers’ messages are handled and is responsible for its customer privacy notice. We process that business correspondence on its behalf to provide the connection and actions it authorizes. Meta and WhatsApp have their own terms and responsibilities.
Business owners and people who have messaged a connected business can contact support@openally.ai about this service. If your request concerns a business’s customer records, contact that business too.
Information this service handles
- Account and setup: OpenAlly account, workspace and device identifiers; Premium eligibility; signup mode, progress and expiry; the business account and phone-number identifiers selected during Meta signup.
- Connection: Meta authorization grants, the Meta identity returned when we verify a grant, registration credentials where needed, business/display names, business phone number, currency, connection health and import consent.
- Customer correspondence: message text, customer identifiers and names, attachments or media references, delivery/read receipts, interactive replies and submitted form fields. Eligible coexistence can also share contacts, history and messages sent from the WhatsApp Business app.
- Customer memory (AI replies on): short notes the agent or you save about a customer, such as a preference, a size or a past issue, so later replies can use them.
- Your controls: designated device, agent assignment, human takeover, reply approvals, automation rules, spending estimates, consent evidence references and opt-out state.
- Support and service operation: information you send support and categorical reliability counts. The reliability dataset excludes account, device, business, customer and message identifiers, message content, tokens and prices.
Business profiles, templates, linked catalogs/products and supported WhatsApp forms are fetched from Meta when needed. Attachments pass through authenticated service requests between Meta and your device; their identifiers can also appear in retained correspondence.
Where messages go and why
Meta sends events for your connected inbox to our Cloudflare-hosted service. It verifies and stores encrypted correspondence. While you answer yourself, it delivers each message to your designated OpenAlly device and keeps undelivered items for up to seven days. While AI replies are on, the inbox is held in the cloud instead: the service keeps the encrypted conversation for as long as the number stays connected, your signed-in devices receive a copy, and OpenAlly’s cloud responder runs the agent you approved. Authorized outgoing messages pass through this service to Meta and then to the customer.
While you answer yourself, your device keeps the working conversation history and no model sees it. While AI replies are on, OpenAlly’s cloud agent answers with AI models hosted on Cloudflare (Workers AI), reached through a Cloudflare gateway configured not to log or cache prompts and replies. For each reply it uses the recent conversation, your agent’s instructions, that customer’s memory notes and the business records the agent is allowed to use, such as your catalogue and the customer’s orders.
When a customer sends an image, the model reads it to answer. A voice note is transcribed to text on Cloudflare, and only the text joins the conversation; the audio is not written to any log. The agent can send a customer a product photo from your catalogue or an invoice PDF you issued, which the service uploads to Meta for delivery.
Customer memory holds at most 50 notes and 16 KiB of text per customer, with the oldest removed first. It never keeps card or account numbers, one-time codes, passwords, PINs or card security codes; a note containing one is refused. You can read, edit and delete notes in OpenAlly.
We use business correspondence only to deliver the service and authorized business actions. We do not sell it, use it for advertising, or use it to train AI models. Keep your agent’s instructions consistent with the business-data restrictions.
History import is a separate optional choice for eligible coexistence. Imported history does not itself trigger AI replies. You can connect without choosing an import; Meta determines which history is available.
How long information is kept
- Signup: a session is usable for 15 minutes. Temporary authorization material is cleared on completion, cancellation or expiry; progress records remain for one additional day after expiry.
- Message bodies (answering yourself): encrypted incoming correspondence is removed when your designated device acknowledges saving it, or at its original seven-day expiry. Outgoing proposal bodies are also temporary and removed after acknowledgement or expiry. Retries do not restart the seven-day period.
- Message bodies (AI replies on): the encrypted conversation, customer memory notes, the agent’s run records and your conversation labels and notes are kept in the cloud inbox for as long as the number stays connected, bounded per conversation and per inbox with the oldest items trimmed first. They are erased when you disconnect the number or delete your account, and the inbox returns to the device-only arrangement thirty days after a plan ends without renewal.
- Delivery metadata: incoming event identifiers/digests can remain until that original expiry to prevent duplicate delivery. Outgoing status, approval/budget records, conversation control and consent metadata remain with the service inbox after a body is removed, until the inbox’s service data is erased.
- Connection records: grants and connected account settings remain while needed for the connection. Disconnecting one number erases that inbox’s delivery and automation data; account credentials remain if other numbers still use that account. Disconnect every number to remove the account’s service connection.
- Deletion records: a completed Meta deletion job keeps its random confirmation code and result until 30 days from the request. Its identity context is removed on completion. Minimal identifiers and security timestamps can remain to prevent old authorizations or callbacks from restoring deleted data.
- Reliability counts: the categorical dataset has no customer join key and follows Cloudflare Analytics Engine’s three-month retention.
These are active-service storage periods. Cloudflare’s database recovery history can cover the previous 30 days, so removal from the active service does not mean an immediate removal from all infrastructure recovery copies. Device history, your backups, Meta’s records and recipients’ copies have separate lifecycles.
Pending deletion jobs retry until service cleanup finishes; a pending result is not a completed deletion. Support requests and any records we must keep to resolve a dispute or meet a legal obligation are handled under the OpenAlly Privacy Policy.
Security and browser storage
Connection grants, registration credentials and temporary message bodies are encrypted at rest by the service. Account and device authorization, scoped access checks, verified Meta webhook signatures, short-lived signup tickets and limits on request sizes protect access. Encryption does not mean the service cannot process correspondence for delivery, and no system guarantees absolute security.
The signup browser uses an essential, secure, HTTP-only session cookie lasting up to 15 minutes. The one-use link is consumed and removed from the address bar; it is not a password. We do not put Meta access tokens in browser storage. Meta’s login window and signup software receive the information needed to authenticate you and follow Meta’s Privacy Policy and cookie practices. You can cancel before granting access.
Hosting providers necessarily process network requests, including IP addresses and browser information, to serve and protect the site. Our WABA reliability counts do not include this information. These pages do not add advertising trackers.
Recipients and international processing
Cloudflare provides the hosted connection, storage and the AI models behind AI replies. Meta/WhatsApp provides signup, business messaging, asset management and its own billing. Your signed-in devices and authorized business users receive information needed for their role. To alert your devices, our notification service and Google Firebase Cloud Messaging receive inbox and conversation identifiers, never message content. Support providers receive information you include in a support request. We may disclose information where legally required or necessary to protect legal rights.
These services may process information outside your country. We do not promise that the hosted connection is confined to the location of your device. Applicable transfer arrangements and wider account-service recipients are described in the OpenAlly Privacy Policy; contact support@openally.ai for questions about processing arrangements for your business.
Your choices and privacy requests
You can decline optional history import, switch AI replies on or off, read, edit or delete what the agent remembers about a customer, take human control, and disconnect an inbox. The deletion guide explains what each removal method covers and how to request help without access to the app. Removing Meta permissions alone may stop access without removing already-held service records.
Depending on applicable law, you may request access, correction, deletion or a copy of your personal information, object to or restrict processing, or withdraw consent for optional processing. We may verify your authority before acting. Where you are a customer of a connected business, that business handles requests for its own customer records; we can assist with the service data we hold. You may also complain to the competent data-protection authority.
We process account/setup information to provide the service you request; optional history sharing follows your choice; service-security information supports preventing misuse; and legal compliance may require particular records. Your business is responsible for the lawful basis for its customer messaging. The OpenAlly Privacy Policy provides the broader rights and grievance route.
Email support@openally.ai with “WhatsApp Business privacy” in the subject. Include your account email and the business number where relevant. Do not send passwords, verification codes, access tokens, payment-card information or unnecessary customer conversations. If this notice changes, we will update the date above.