WhatRoomWhatRoom
Privacy Policy
1. About this policy
WhatRoom is provided by White Room (M) Sdn Bhd ("White Room", "we", "us"). WhatRoom lets businesses connect their WhatsApp Business app number to their own systems, through Meta's WhatsApp Cloud API. This policy covers WhatRoom, this website and enquiries to us under Malaysia's Personal Data Protection Act 2010, as amended (PDPA).
We process WhatsApp data on behalf of and at the direction of the business using WhatRoom (as its data processor). We are the data controller for portal accounts, website visits and enquiries. Each business's own use of data is covered by its privacy notice.
2. Data we process
- WhatsApp messaging: phone numbers, profile names, usernames or user identifiers, message IDs, delivery status, timestamps, template names, and message content, including photos, depending on the connection setup.
- Portal accounts: names, email addresses, hashed passwords, two-factor authentication settings, and session IP addresses and browser details.
- Business connections: business names, WhatsApp numbers, Meta account identifiers, templates and the access Meta grants us.
- Enquiries and administration: contact details, information you provide, and records of data requests and legally required disclosures.
- Website visits: IP addresses and browser details received by our hosting provider to serve the pages.
Data comes from you, the business and its systems, Meta, and technical information from website visits and portal sessions.
Account details and sign-in credentials are required for portal access; business details and Meta authorisation for connections; and recipient identifiers and message details for messaging. Without them, we cannot provide the relevant service. Extra information in enquiries is optional, but we need contact details to reply.
3. How we use it
We use data to send and receive messages for businesses, provide conversation views where included, manage connections and templates, secure and support the service, answer enquiries and data requests, and meet legal obligations.
We do not sell personal data, build profiles of people, or use personal data for marketing or advertising. We do not store sign-in code values sent through WhatRoom or import contacts or past chat history from the WhatsApp Business app.
4. Sharing and overseas processing
We share data with Meta, the business and its systems, contracted hosting and service providers, professional advisers where needed, and authorities only when required by law.
Where Meta delivers incoming messages directly to a business's systems, they bypass WhatRoom. We still process outgoing messages, account and template updates, and photos requested by those systems.
WhatRoom stores data outside Malaysia, and Meta processes messages in other countries. Overseas providers must protect personal data under their contracts with us. Transfers must meet the PDPA's requirements, and we remain responsible for data under our control.
5. Security and cookies
Connections use HTTPS. Stored message content, Meta access credentials and backups are encrypted; encryption keys are kept separately. Access is limited by role and business, including authorised White Room staff who operate and support the service. Our staff must use two-factor authentication. Logs contain no message content.
6. How long we keep it
We keep personal data only as long as we need it for the purposes above. Message content is kept for at most 30 days, and message details for 90 days. When a number is disconnected, we delete the access Meta granted us at once and the rest of its connection data within 30 days. Portal accounts are deleted within 30 days after access ends. Backups expire within 30 days.
7. Your rights
Subject to the PDPA's conditions and exceptions, you can request access or correction, withdraw consent where processing relies on it, object to processing likely to cause unwarranted damage or distress, and request transfer to another data controller where technically feasible and formats are compatible. Withdrawing consent may prevent us from providing the relevant service.
Contact us in English or Bahasa Malaysia. We may verify your identity. We respond to access and correction requests within 21 days; a permitted extension requires written reasons within that period and completion within a further 14 days. For data processed for a business, we work with that business to handle your request; you can also contact it directly.
8. Deleting data
Email hello@whiteroom.work with the subject "Data deletion request". Include your WhatsApp number with country code (or the user identifier Meta provided) and the business's name. Business requests must come from the business owner's or a portal admin's email and identify the number to delete. We may verify your identity or authority.
For an individual, we delete message details, content and portal conversations we can link to them for that business. For a business, we delete connection data, credentials and keys, stored templates, message records and applicable staff portal accounts. We complete deletion within 30 days and confirm by email. Backup copies expire within a further 30 days. We keep a record of the request and its outcome for 5 years.
Direct-connection photos may not be linked to your number; they expire within 24 hours of the business's photo request. We cannot delete data on the business's phone, in its own systems or held by Meta. Contact the business or Meta for those copies. Businesses can end WhatRoom's access by disconnecting in the WhatsApp Business app.
9. Changes to this policy
We publish updates here with a revised "Last updated" date. We email businesses using WhatRoom before significant changes to our handling of personal data take effect.
10. Contact us
For questions, complaints or data requests, contact White Room:
- Company
- White Room (M) Sdn Bhd (1509000-P)
- hello@whiteroom.work
- Address
- 169, Lebuh Victoria, 10300 George Town, Penang, Malaysia