Platform Privacy Policy
This Platform Privacy Policy explains how ARTHIQ TECH PTE. LTD. (“Arthiq”, “we”, “us”, “our”) handles data when we provide Arthiq Messaging — our business messaging service built on the WhatsApp Business Platform (Cloud API), Instagram Messaging and the Messenger Platform (together, the “Meta Platforms”). Arthiq operates on those platforms as a Meta Tech Provider.
This is not the arthiq.co website policy. Marketing-site visitors, enquiries and training clients are covered by our website Privacy Policy. This document covers only the messaging service. Where both could apply, this document governs data reached through the Meta Platforms. Read it with our Platform Terms of Service and our Data Deletion Instructions.
1. Who we are
ARTHIQ TECH PTE. LTD. is a company incorporated in Singapore (UEN 202545750G), with its registered office at 68 Circular Road #02, Singapore 049422.
- Privacy and data protection: privacy@arthiq.co
- Deletion requests: privacy@arthiq.co
- Security reports: security@arthiq.co
Our Data Protection Officer, appointed under section 11(3) of the Singapore Personal Data Protection Act 2012 (“PDPA”), is reachable at privacy@arthiq.co.
2. Who this policy is about
Three groups of people appear in this document, and they are treated differently:
- Client Businesses
- Organisations that engage Arthiq to run their messaging on the Meta Platforms, and the individual administrators and agents who use our service on their behalf. For their own account and administrator data, Arthiq is the controller.
- End Customers
- People who message a Client Business on WhatsApp, Instagram or Messenger, or whom a Client Business messages. For their data, the Client Business is the controller and Arthiq is a processor acting only on that Client Business’s documented instructions.
- Visitors
- People who simply visit our web pages. They are covered by the website Privacy Policy.
If you are an End Customer, the business you were messaging decides what happens to your data. Contact that business first. We will still act on a request sent directly to us — see Data Deletion Instructions — and we will pass it to the relevant Client Business where we are only the processor.
3. Data we collect
3.1 Client Business account data (Arthiq as controller)
- business name, registered address, country and industry;
- administrator and agent name, work email, work phone number and role;
- authentication data: login credentials, session tokens, multi-factor authentication status;
- billing and contractual records, including invoices and payment status; and
- support correspondence with us.
3.2 Meta Platform data we receive on connection
When a Client Business connects its Meta assets to Arthiq — through WhatsApp Embedded Signup or by granting access to a Facebook Page or Instagram professional account — Meta provides us with, and we store:
- Meta Business Portfolio ID, WhatsApp Business Account (WABA) ID, phone number ID, verified display name, quality rating and messaging limits;
- Facebook Page ID and Instagram professional account ID and username;
- access tokens and the permission scopes granted, which we hold encrypted and use only to operate the service; and
- message template names, categories, languages and approval status.
Connecting an asset requires an authorised administrator of the Client Business to sign in with their Meta credentials and approve the permissions requested. Arthiq never sees, receives or stores Meta account passwords.
3.2.1 Permissions we request, and what each one is for
We request the narrowest set of permissions that lets the service work, and we use each one only for the purpose stated below. Granting them does not give Arthiq access to a Client Business’s Meta account beyond the assets that administrator selects during connection.
| Permission | Why we request it |
|---|---|
whatsapp_business_messaging | To send and receive messages in the conversation an End Customer started, on the Client Business’s behalf and from the Client Business’s own number. This is the service itself. |
whatsapp_business_management | To register the Client Business’s phone number for the Cloud API, subscribe our application to that account’s webhooks so incoming enquiries reach us, read the number back to confirm the connection succeeded, and manage message templates. Without this, messages from End Customers never arrive. |
business_management | To read the Business Portfolio the administrator selects while connecting, so the correct WhatsApp Business Account is attached to the right Arthiq account. Used at connection time only. |
pages_messaging, pages_show_list | Only where a Client Business connects a Facebook Page: to list the Pages that administrator manages, and to reply in Messenger conversations an End Customer started. |
instagram_basic, instagram_manage_messages | Only where a Client Business connects an Instagram professional account: to identify the account and to reply in conversations an End Customer started. |
A Client Business can revoke any of these at any time, from its own Meta Business settings or by asking us. Revocation stops the service for that channel immediately; §12 covers what happens to data already held.
3.3 End Customer data (Arthiq as processor)
We process the following on behalf of, and on the instructions of, the Client Business:
- WhatsApp: the End Customer’s phone number in E.164 format, WhatsApp profile name, WhatsApp ID, and message content — text, images, video, audio, documents, stickers, locations, contacts, interactive replies and reactions;
- Instagram and Messenger: the Instagram-scoped ID (IGSID) or page-scoped ID (PSID), username or display name, profile picture URL where provided, and message and attachment content;
- delivery metadata: timestamps, message and conversation IDs, delivery, read and failure receipts, and the channel used;
- opt-in and opt-out records: how, when and where consent to be messaged was obtained, and any subsequent stop, block or unsubscribe signal; and
- any additional information an End Customer chooses to send in a message, and any data the Client Business separately imports into the service about that person.
Scoped IDs (IGSID, PSID) are specific to the Client Business’s Meta assets. They cannot be used to identify a person on any other business’s account, and we do not attempt to resolve them across Client Businesses.
3.4 Technical and log data
- IP address, user agent, device and browser type for administrator sessions;
- API request and webhook logs — endpoint, timestamp, status code, latency, error detail and correlation IDs; and
- audit records of administrator actions inside the service.
3.5 What we do not collect
We do not ask for, and ask you not to send us, government identifiers, payment card numbers, health records or other special-category data through the messaging channels. We do not collect device contact lists, precise background location, or data from any Meta Platform beyond the permissions a Client Business has explicitly granted.
4. Where the data comes from
- directly from Client Businesses and their administrators;
- directly from End Customers, in the messages they send;
- from Meta, through the WhatsApp Business Platform, Instagram Messaging and Messenger Platform APIs and webhooks, under the permissions the Client Business granted; and
- automatically, through our own logs and audit trail.
5. How we use data, and why we are allowed to
We use data only for the purposes below.
| Purpose | Data used | Basis (GDPR) / PDPA position |
|---|---|---|
| Deliver, route and display messages between a Client Business and its End Customers | §3.3 End Customer data | Processing on the controller’s instructions (Art. 28); PDPA — the Client Business’s consent or deemed consent |
| Create and manage accounts, connect Meta assets, authenticate administrators | §3.1, §3.2 | Contract (Art. 6(1)(b)); PDPA — necessary to provide the service |
| Bill for the service and pass through Meta’s messaging charges | §3.1, aggregate message counts | Contract; legal obligation for tax records |
| Support, troubleshooting and incident response | §3.1, §3.4, and §3.3 strictly where necessary | Legitimate interests (Art. 6(1)(f)) / controller instruction; PDPA — legitimate interests exception |
| Security, abuse prevention, spam and fraud detection, rate limiting | §3.2, §3.4, message metadata | Legitimate interests; legal obligation |
| Service reliability and capacity planning | Aggregated and de-identified metrics only | Legitimate interests |
| Complying with law, Meta’s terms, and lawful requests | As required | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms, and you may object at any time using the contacts in section 1.
6. What we will never do with Platform Data
These are commitments, not aspirations. They reflect the Meta Platform Terms, the WhatsApp Business Terms of Service and the Meta Developer Policies, which bind us as a Tech Provider.
- We do not sell, rent or licence Platform Data. Not to anyone, at any price.
- We do not transfer Platform Data to data brokers, ad networks, monetisation partners, or information-resale services, and we do not use it to build or enrich any marketing or identity graph.
- We do not use Platform Data to make, or help anyone make, eligibility decisions — about credit, insurance, housing, employment, education or a similar benefit or entitlement.
- We do not use Platform Data for surveillance, including for law enforcement or intelligence purposes, or to profile people by race, ethnicity, religion, political affiliation, sexual orientation, health status, trade union membership or immigration status.
- We do not use Platform Data to train generalised or foundation AI models, our own or anyone else’s. Where a Client Business enables AI-assisted features, see section 7.
- We do not mix one Client Business’s data with another’s. Data is logically segregated per Client Business and per connected Meta asset.
- We do not use End Customer data for our own marketing, and we do not message End Customers on our own behalf.
7. AI-assisted features
A Client Business may switch on features that use AI models to draft replies, classify or route incoming messages, or summarise conversations. Where those features are enabled:
- message content is sent to the model provider only for the duration of that request, and only for the Client Business that enabled the feature;
- we contract with model providers on terms that prohibit them from retaining the content beyond what is needed to return a result, and from training their models on it;
- output is a draft or a suggestion. A Client Business remains responsible for what it sends, and no automated decision producing a legal or similarly significant effect on an End Customer is made by the service; and
- the Client Business can disable these features, and they are off unless switched on.
8. Opt-in, opt-out and messaging rules
Meta requires that a business hold valid opt-in before sending proactive messages, and honour opt-outs promptly. Our Client Businesses are contractually required to obtain and evidence that opt-in, and our Platform Terms make it a condition of using the service.
- An End Customer can stop messages at any time by replying STOP (or an equivalent word) to a WhatsApp conversation, by using an unsubscribe control in a message, or by blocking or reporting the business inside WhatsApp, Instagram or Messenger.
- We record the opt-out and suppress further proactive messages from that Client Business to that person. We keep a minimal suppression record — the identifier and the date — precisely so the opt-out cannot be undone by a later data import. That record survives a deletion request; see Data Deletion Instructions.
- Outside Meta’s customer-service window, businesses may only send pre-approved message templates in the categories Meta permits.
9. Who we share data with
We do not sell data. We share it only with the categories of recipient below, under written contracts that limit them to processing on our instructions.
| Recipient | Purpose | Data |
|---|---|---|
| Meta Platforms, Inc. and its affiliates | Operating WhatsApp, Instagram and Messenger message delivery — the service cannot function without it | Message content and recipient identifiers, as required to send and receive |
| Cloud hosting and infrastructure providers | Running the service, storing data, backups | All categories in section 3 |
| AI model providers (only where a Client Business enables AI features) | Generating drafts, classifications and summaries — see section 7 | Message content passed for that request |
| Error monitoring, logging and analytics providers | Diagnosing faults and keeping the service available | Technical and log data (§3.4); message content only where it appears in an error payload |
| Payment and accounting providers | Invoicing Client Businesses | Client Business billing data (§3.1) |
| Professional advisers, auditors and insurers | Legal, tax and audit advice | As strictly necessary |
| Authorities and courts | Where required by law or valid legal process | As compelled — see section 10 |
| An acquirer | Merger, acquisition or sale of assets, subject to this policy continuing to apply | As relevant |
A current, named list of our sub-processors is available to Client Businesses on request to privacy@arthiq.co. Client Businesses are notified before we add a sub-processor that processes End Customer data, and may object under the data processing terms in our Platform Terms.
10. Government and legal requests
We disclose data to a public authority only where we are legally required to. Where we receive a request that relates to a Client Business’s data and we are permitted to do so, we notify that Client Business before responding so it can seek to challenge the request. We review requests for validity and scope and push back on those that are overbroad.
Where we are compelled to disclose, we disclose only the minimum data necessary to satisfy the request, and we refuse requests that seek more than that. A request for a named individual is answered for that individual alone; we do not hand over a wider export because it is easier to produce.
We keep a record of every request we receive: what was asked for, what we disclosed, the legal basis we relied on, who authorised the decision, and the date. We retain these records so that our handling of a request can be reviewed after the fact.
11. International transfers
Arthiq is based in Singapore, and our providers may process data in other countries, including the United States and the European Union. Where personal data leaves its country of origin we rely on appropriate safeguards: the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) for data from the EEA and UK, and, for data subject to the PDPA, contractual terms requiring the recipient to protect it to a standard comparable to the PDPA, as required by regulation 10 of the Personal Data Protection Regulations 2021. Meta’s own transfers are governed by Meta’s terms and privacy policy.
12. How long we keep data
| Data | Retention |
|---|---|
| End Customer message content and media | For the period the Client Business configures, and in any event no longer than the term of its agreement with us — deleted within 30 days of the end of that term unless the Client Business exports or extends it in writing |
| Delivery metadata and conversation records | Up to 24 months, for billing reconciliation and dispute resolution |
| Opt-in and opt-out / suppression records | For as long as the Client Business uses the service, plus 6 years — these are the evidence that consent existed and that an opt-out was honoured |
| Technical and API logs | 90 days, then deleted or aggregated beyond re-identification |
| Client Business account and administrator data | Term of the agreement plus 90 days |
| Billing, tax and accounting records | 5 years from the end of the relevant financial year, as required by Singapore law |
| Backups | Rolling 35-day window; deleted records age out of backups within that window and are not restored selectively |
13. Security
- encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
- access tokens and secrets held in a managed secret store, encrypted, never written to logs and never exposed to Client Businesses other than the one they belong to;
- role-based access control on a least-privilege basis, multi-factor authentication for all staff and administrative access, and access reviews;
- logical segregation of each Client Business’s data, and audit logging of staff access;
- secure development practices, dependency scanning and change review; and
- a documented incident response plan, tested periodically.
Breach notification. If a personal data breach occurs, we notify affected Client Businesses without undue delay and, where the GDPR applies, within 72 hours of becoming aware where we are the controller. Where the PDPA’s notification thresholds are met we notify the Personal Data Protection Commission and affected individuals as required. As a processor, we notify the Client Business so it can meet its own obligations.
Please report a suspected vulnerability to security@arthiq.co. We will not pursue legal action against good-faith research that respects user privacy and avoids service disruption.
14. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable form, and withdraw consent. You also have the right to complain to a supervisory authority — in Singapore, the Personal Data Protection Commission; in the EEA or UK, your local data protection authority.
- Client Businesses and administrators — email privacy@arthiq.co. We act as controller and will respond directly.
- End Customers — contact the business you were messaging, which controls the data. You may also write to us at privacy@arthiq.co; we will act where we can and otherwise forward the request to that business and support it in responding.
We verify identity before acting on a request, and we respond within 30 days — or such shorter period as your local law requires. We do not charge for a first request unless it is manifestly unfounded or excessive.
Deleting your data. Step-by-step instructions — including how to disconnect Arthiq from your Meta assets and what we can and cannot delete — are on the Data Deletion Instructions page. We acknowledge requests within 5 business days and complete verified requests within 30 days.
15. Cookies
Our messaging application uses strictly necessary cookies for session management, security and load balancing. It does not use advertising cookies and does not run third-party trackers in the authenticated application. Cookies on our marketing website are described in the website Privacy Policy.
16. Children
The service is provided to businesses and is not directed at children. Administrators must be at least 18. We do not knowingly process the data of a child in circumstances requiring parental consent; if you believe we have, contact privacy@arthiq.co and we will delete it.
17. Relationship with Meta
Arthiq is an independent company. We are not Meta, and Meta does not endorse us. When you message a business through WhatsApp, Instagram or Messenger, Meta processes that message under its own terms and policies, which we do not control. See Meta’s Privacy Policy, the WhatsApp Privacy Policy and the WhatsApp Business Data Processing Terms. Where a Client Business uses WhatsApp’s cloud-hosted messaging, message content is stored by Meta under those terms in addition to ours.
18. Changes to this policy
We may update this policy. The current version is always at this URL with the effective date shown above. For material changes affecting Client Businesses, we give at least 30 days’ notice by email or in the application before the change takes effect.
19. Contact
ARTHIQ TECH PTE. LTD. (UEN 202545750G), 68 Circular Road #02, Singapore 049422. Privacy and data protection: privacy@arthiq.co. General legal: legal@arthiq.co.