Data processing agreement

This agreement forms part of the Terms of Service and governs how Masal Global LLC ("Masal", the processor) processes the personal data of WhatsApp contacts on behalf of the Customer (the controller). Last updated: October 24, 2026.

1. Subject and scope

• Purpose: to transmit messages between WhatsApp and the Customer’s CRM or systems, store them and show their statuses.
• Data subjects: the Customer’s WhatsApp contacts (clients, prospects and other correspondents).
• Data: phone number, profile name, content of messages and files, dates, delivery statuses and marketing preferences.
• Duration: while the service is in force and until deletion as set out in section 8.

2. Customer instructions

Masal processes the data only on the Customer’s documented instructions, which are these terms and the Customer’s configuration of the service (numbers, connected CRM, webhooks). If an instruction appears unlawful, Masal will inform the Customer.

3. Confidentiality

People who access the data on Masal’s behalf are bound by confidentiality and only access it when needed to provide or support the service.

4. Security

• Encryption in transit and at rest; additional encryption of tokens and credentials.
• Per-customer data isolation, verified by automated tests.
• Role-based access control, two-step verification and an audit log of Masal staff actions.
• Authenticity checks on every notification received from Meta and from CRMs.
• Technical logs exclude message content and credentials.

5. Sub-processors

The Customer authorizes Masal to use the following sub-processors. Masal will give at least 30 days’ notice before adding or replacing one, and the Customer may object on reasonable grounds or cancel the service.

Meta Platforms (WhatsApp Business Platform, Cloud API) is not a sub-processor of Masal: the Customer contracts the platform directly with Meta and accepts its terms, and Meta processes messages as the Customer’s processor under the Meta Hosting Terms for Cloud API, including keeping copies for up to 30 days. Masal uses that API on the Customer’s instructions. The same applies to the CRM the Customer connects.

• Cloudflare, Inc. (United States, global network): service hosting, database, file storage and processing queues.
• Resend (United States): portal emails (invitations, password recovery).
• Stripe, Inc. (United States): subscription billing. It only receives the Customer’s billing data, never messages.

6. Assistance to the Customer

Masal will reasonably assist the Customer in responding to individuals’ requests about their data (access, correction, deletion), assessing risks and meeting its obligations towards authorities.

7. Security incidents

Masal will notify the Customer of any incident affecting its data without undue delay and, where possible, within 72 hours of confirming it, with the available information on what happened, the data affected and the measures taken.

8. Return and deletion

When the service ends, the Customer may export its data for 30 days. Masal then deletes it within 90 days at most, except what the law requires to be kept.

At the end, Masal disconnects the numbers from the service and stops using the access credentials. The Customer keeps its WhatsApp Business account and may revoke Masal’s access from its Meta Business Manager at any time. Any copies Meta keeps are governed by Meta’s terms with the Customer.

9. Audits

Masal will make available to the Customer the information needed to demonstrate compliance with this agreement. On-site audits will be arranged with reasonable prior notice, at the Customer’s cost and without affecting other customers’ security.

10. International transfers

Data may be processed in the United States and other countries where sub-processors operate. Where the law applicable to the Customer requires it, the parties will apply standard contractual clauses or other valid transfer mechanisms, which are deemed incorporated into this agreement.

11. Customer responsibility

The Customer warrants that it has a legal basis to process its contacts’ data, including their consent to receive WhatsApp messages, and that it has informed them appropriately.