Privacy policy

This policy explains which personal data Masal Global LLC ("Masal", "we") processes when providing Masal Connect, why, with whom it is shared and what rights each person has. Last updated: October 24, 2026.

1. Who we are

Masal Global LLC is a limited liability company organized in Wyoming, United States, with its registered address at 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States. Its team operates from Montevideo, Uruguay. Privacy contact: hola@masalglobal.com.

Masal Connect connects the official WhatsApp Business API (Meta’s platform) with the CRM of each customer company ("the Customer").

2. Our role depending on the data

• Data of the Customer’s WhatsApp contacts (its clients and prospects): the Customer is the controller of that data and Masal processes it only on the Customer’s behalf and instructions, as a processor. The terms are in the Data Processing Agreement.
• Data of portal users and the Customer’s billing data: Masal is the controller of that data.

3. What data we process

• WhatsApp contacts: phone number, WhatsApp profile name, content of messages and files sent and received, dates and delivery/read statuses, and their marketing-message preference.
• Portal users: name, email, language, password (stored irreversibly, never readable), two-step verification settings, sign-in and activity (audit) records and IP addresses used for security.
• Billing: company name, contact details and payment details, processed by Stripe. Masal does not store card numbers.
• Technical data: system operation logs, without message content or passwords.

4. Why we use it

We do not sell personal data, we do not use it for advertising and we do not train artificial intelligence models on message content.

• To deliver messages between WhatsApp and the Customer’s CRM, with their delivery statuses.
• To provide secure access to the portal and manage users, roles and permissions.
• To prevent fraud, abuse and unauthorized access.
• To bill the service and meet legal obligations.
• To contact the Customer about the service (technical, security or change notices).

5. Opting out of WhatsApp messages

If you do not want to receive marketing messages from a company that uses Masal Connect:

• Use the WhatsApp option to stop receiving marketing messages from that company. Meta notifies us and Masal Connect records the opt-out automatically: from then on, no marketing templates are sent to your number, even if you write again.
• You can also ask the company in any other way, for example by replying "STOP" in the conversation. Our terms and the WhatsApp Business Messaging Policy require the company to honour that request immediately.
• Blocking or reporting the company on WhatsApp also stops the communication.
• If a company does not honour your request, write to hola@masalglobal.com with your number and the company’s name.

6. Who we share it with

Only with the providers needed to run the service, which process the data under contract and solely for that purpose:

Meta policies that govern the Customer’s use of WhatsApp Business: WhatsApp Business Messaging Policy (whatsappbusiness.com/policy/), Meta Terms for WhatsApp Business Platform (facebook.com/legal/Meta-Terms-for-WhatsApp-Business-Platform) and Meta Hosting Terms for Cloud API (facebook.com/legal/Meta-Hosting-Terms-Cloud-API).

• Cloudflare, Inc. (United States, global network): service hosting, database, file storage and processing queues.
• Resend (United States): portal emails (invitations, password recovery).
• Stripe, Inc. (United States): subscription billing. It only receives the Customer’s billing data, never messages.
• Meta Platforms (WhatsApp Business Platform, Cloud API): the Customer contracts the platform directly with Meta and accepts its terms. When providing the Cloud API, Meta processes messages as the Customer’s processor under the Meta Hosting Terms for Cloud API and may keep copies of messages in its infrastructure for up to 30 days. Masal sends and receives messages through that API on the Customer’s instructions.
• The CRM the Customer chooses to connect (for example, Bitrix24) receives messages and contacts because the Customer configures it so, and processes them under the Customer’s own terms with that provider.
• Authorities, only when required by law and after verifying the request.

7. International transfers

Data may be processed in the United States and other countries where our providers operate. We require adequate protection safeguards from each provider, and the Data Processing Agreement includes the clauses needed for these transfers.

8. How long we keep it

• Messages, files and contacts: while the Customer’s account is active. When the service ends, the Customer has 30 days to export them; they are then deleted within 90 days at most.
• Technical copies of notifications received from Meta: up to 30 days.
• Security and audit records: as long as needed for security and legal obligations.
• Billing data: for the period required by accounting and tax law.
• Copies Meta keeps in its Cloud API infrastructure: up to 30 days, under Meta’s terms. Masal does not control that period.

9. How we protect it

If a security incident affects personal data, we will notify the Customer without undue delay and, where possible, within 72 hours of confirming it.

• Encryption of all communications and of data stored by the infrastructure.
• Additional encryption of WhatsApp and CRM access tokens and credentials.
• Strict separation of data between customers: each company only accesses its own.
• Two-step verification, lockout after repeated attempts and roles with limited permissions.
• Files are kept in private storage, with no public access.

10. Cookies

The portal uses only two essential cookies: one to keep you signed in and one to remember your language. We do not use third-party advertising or analytics cookies.

11. Individual rights

Anyone can request access to, correction or deletion of, or object to the processing of their data by writing to hola@masalglobal.com. If the data belongs to a Customer’s WhatsApp contact, we will coordinate the request with that Customer, who is the controller. You may also file a complaint with the data protection authority of your country of residence.

12. Applicable law, legal bases and response times

• Masal Global LLC is organized in Wyoming, United States, and its team operates from Uruguay. We apply this policy in every country where we provide the service and respect the data protection law of each person’s country where it applies, including Uruguay’s Law 18.331 and, for people in the European Economic Area or the United Kingdom, the GDPR.
• Legal bases: performance of the contract with the Customer (portal users and billing); compliance with legal obligations (billing, security); our legitimate interest in keeping the service secure; and, for WhatsApp contacts’ data, the Customer’s instructions, since the Customer is the controller and must have its own legal basis, such as the contact’s consent.
• Response times: we confirm every access, correction, deletion or objection request within 5 business days and resolve it within the following 30 days. If a complex request needs more time, we say so before that period ends.
• Complaints: with the data protection authority of your country of residence; in Uruguay, the Unidad Reguladora y de Control de Datos Personales (URCDP).

13. Minors

Masal Connect is a business service. Portal users must be adults acting on behalf of a company.

14. Changes to this policy

If we make material changes, we will notify Customers by email or in the portal at least 30 days in advance, unless the law requires applying them sooner.