1. Who we are
PangoTalk is a multi-tenant WhatsApp commerce and customer-messaging platform. We provide software that helps merchants communicate with customers on WhatsApp, manage orders, team inboxes, automation, and related business operations.
2. Who this policy applies to and our role
- Merchants / business users — individuals or organizations that register for a PangoTalk account.
- Merchant staff — users invited by a merchant to access dashboards or team tools.
- WhatsApp end users / customers — people who message a merchant through WhatsApp when the merchant uses PangoTalk.
- Platform administrators — authorized operators who manage the PangoTalk platform.
- Website visitors — people who browse our marketing site or legal pages.
For merchant account, website, security, billing, and platform administration data, PangoTalk generally determines why and how that data is processed and acts as the data controller. For customer conversations, contacts, orders, and other records a merchant submits to PangoTalk, the merchant generally acts as the controller and PangoTalk acts as its data processor / service provider. We process that data on the merchant’s documented instructions, to provide and secure the Services, and as required by law. Each merchant is responsible for giving its customers an appropriate privacy notice and having a lawful basis for its processing. The merchant’s privacy policy therefore applies in addition to this policy.
3. Information we collect
We collect information in the following categories, depending on how you use the Services:
3.1 Account and business information (merchants & staff)
- Name, email address, phone number, and login credentials
- Business name, category, billing details, and account settings
- Staff roles, permissions, and activity within merchant dashboards
3.2 WhatsApp and Meta Platform Data
When a merchant connects WhatsApp through Meta’s WhatsApp Business Platform (Cloud API), we receive and process data made available to our application in accordance with Meta’s Platform Terms and Developer Policies. This may include:
- WhatsApp phone numbers (sender and recipient)
- Message content (text, media, templates, interactive messages, and delivery/read status)
- WhatsApp profile names and identifiers (e.g. WhatsApp IDs / message IDs)
- WhatsApp Business Account (WABA) IDs, phone number IDs, and message template metadata
- Webhook event data from Meta (inbound messages, status updates, account or template status events)
- Embedded Signup / onboarding data required to connect a merchant’s WhatsApp assets to PangoTalk
We refer to data received from Meta platforms collectively as “Platform Data” where applicable under Meta’s terms.
3.3 Customer and order information
- Customer contact details, order history, cart contents, delivery details, and support conversations
- Team inbox messages, agent notes, canned replies, and conversation routing metadata
- Loyalty, promotions, events, or catalogue data configured by the merchant
3.4 AI-assisted features (when enabled)
If a merchant or platform operator enables AI features, we may send portions of conversation text and configured prompts to third-party AI providers (such as OpenAI) solely to generate suggested or automated replies. The AI provider processes that content under its applicable API terms and data-processing commitments. Merchants should not submit sensitive information that is unnecessary for the requested interaction.
3.5 Technical and usage information
- IP address, browser type, device information, and log files
- Pages viewed, feature usage, timestamps, and error diagnostics
- Cookies and similar technologies on our website (see Section 11)
3.6 Sources of information
We receive information directly from merchants, staff, website visitors, and WhatsApp users; from merchants that upload or create customer and order records; automatically from devices and our Services; from Meta/WhatsApp through API and webhook events; and from service providers acting on our behalf. If a merchant gives us information about another person, the merchant is responsible for having authority to do so.
3.7 Sensitive and special-category information
The Services are not designed to collect health, biometric, precise financial-account, religious, political, sexual-orientation, or other sensitive/special-category information unless a particular feature expressly requires it and a valid legal basis and safeguards are in place. Please do not send such information through WhatsApp or free-text fields when it is not necessary.
4. How we use information (purposes of processing)
We use personal information for the following purposes:
- Provide the Services — operate accounts, route WhatsApp messages, display team inboxes, process orders, and deliver merchant-configured automation
- WhatsApp messaging — send and receive messages, templates, media, and status updates through Meta’s WhatsApp Business Platform
- Merchant onboarding — connect WhatsApp Business assets, verify credentials, subscribe webhooks, and manage WABA resources
- Support and security — troubleshoot issues, prevent fraud or abuse, enforce terms, and protect Platform Data
- Improvement and analytics — understand feature usage and improve reliability (using aggregated or de-identified data where possible)
- Legal compliance — comply with applicable laws, respond to lawful requests, and meet Meta platform obligations
- Communications — send service announcements, security alerts, and account-related messages
We do not sell personal information. We do not use Platform Data for purposes prohibited by Meta’s Platform Terms, including using Platform Data to build unrelated profiles for advertising outside the Services without appropriate consent and permissions.
5. Legal bases (EEA / UK users)
Where applicable data-protection law requires a legal basis, we rely on:
- Contract — to provide the Services you or your organization requested
- Legitimate interests — to secure, maintain, and improve the platform, balanced against your rights
- Consent — where required (e.g. certain cookies or optional marketing)
- Legal obligation — where we must retain or disclose information by law
Where we act as a processor, the merchant determines the applicable legal basis. We do not rely on consent where it is not freely given or where another legal basis is required.
7. Data retention
We apply storage-limitation and data-minimization principles. We retain personal information only for as long as reasonably necessary for the purpose collected, the merchant’s documented settings or instructions, and any legal, tax, accounting, security, dispute-resolution, or Meta Platform requirements. Our current retention criteria are:
- Merchant account and configuration data: for the active subscription, then normally up to 90 days after closure to allow recovery and resolve account issues, unless law requires longer retention.
- WhatsApp messages, media, contacts, orders, and inbox records: for the period selected or reasonably required by the merchant and while the merchant account is active; deleted or de-identified after account closure or a valid deletion instruction, subject to the exceptions below.
- Security, access, webhook, and diagnostic logs: normally up to 12 months, or longer when required to investigate fraud, abuse, or a security incident.
- Billing, transaction, and tax records: for the period required by applicable financial and tax laws, which may be up to seven years.
- Support records: normally up to 24 months after a case closes, unless needed for an active dispute.
- Meta Platform Data: no longer than necessary for the disclosed service purpose and deleted promptly when Meta, the user, or the controlling merchant validly requires deletion.
Data scheduled for deletion may remain temporarily in encrypted or access-restricted backups until the backup is overwritten under our backup cycle. It is not restored for ordinary business use and will be deleted again if a backup must be restored. We may retain a minimum record of a request, transaction, or dispute where necessary to demonstrate compliance, prevent fraud, establish legal claims, or meet a legal obligation. When data is no longer required, we delete, aggregate, or irreversibly de-identify it.
The periods above are operational defaults and may be shorter where a merchant configures shorter retention. Merchants may contact us for the retention period that applies to their account.
8. Security
We implement administrative, technical, and organizational measures designed to protect personal information, including access controls, encrypted transport (HTTPS/TLS), tenant isolation for merchant data, and restricted access to production systems. Measures are reviewed in light of the nature of the information and relevant risks. We maintain procedures to investigate and respond to suspected personal-data breaches and will notify affected controllers, individuals, Meta, and competent authorities when and within the time required by applicable law or contract. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
Merchants are responsible for safeguarding their account credentials, Meta access tokens, and staff access permissions.
9. Your rights and choices
Depending on your location, you may have rights to:
- Access a copy of personal information we hold about you
- Correct inaccurate information
- Delete personal information (see Section 10)
- Restrict or object to certain processing
- Data portability (where applicable)
- Withdraw consent where processing is based on consent
- Object at any time to direct marketing
- Lodge a complaint with a supervisory authority
To exercise these rights, contact us at [email protected]. We may need to verify your identity and authority before responding. Authorized agents may submit a request where permitted by law, but we may require proof of authorization. We will not discriminate against you for exercising an applicable privacy right.
If your request concerns data controlled by a merchant, we may refer the request to that merchant and assist it in responding. You may complain to the data-protection authority in your country.
10. How to request deletion of your data
Meta requirement: this section explains how users can request deletion of data collected through our app. Use it as your Data Deletion Instructions URL in the Meta App Dashboard.
10.1 WhatsApp end users (customers of a merchant)
- Email [email protected] with the subject line “Data Deletion Request”.
- Include the WhatsApp phone number you used to message the merchant and, if known, the merchant/business name.
- Describe what you want deleted (for example, conversation history, profile name, or order details linked to your number). Do not send passwords, access tokens, or identity documents unless we specifically request them through a secure method.
- We will acknowledge and verify the request, coordinate with the controlling merchant where necessary, and respond within 30 days, or sooner where required by law or Meta Platform Terms.
You may also contact the merchant directly. Merchants using PangoTalk can delete or anonymize customer records in their dashboard where available, or ask us to assist at the email above.
10.2 Merchant account holders and staff
- Email [email protected] from the email address associated with your account.
- State that you want your PangoTalk account and associated business data deleted.
- If you connected WhatsApp, we will also disconnect integrations and delete Platform Data we control, subject to legal retention requirements.
10.3 Platform Data from Meta
When we receive a valid request from a user, merchant, or Meta, we will promptly delete or update the Platform Data in systems we control as required by Meta’s Platform Terms. We may ask for enough information to locate the relevant records, but we will not require unnecessary personal data. Some data may remain in systems controlled by Meta/WhatsApp under their own policies; you may also use Meta’s tools or contact the merchant for WhatsApp-side deletion where applicable.
10.4 What deletion covers and lawful exceptions
An approved deletion request covers active records and data we can reasonably link to the verified identifier, including applicable profile, conversation, contact, and integration records. We will also instruct relevant processors to delete the data where required. We may deny or limit deletion only where retention is necessary and lawful—for example, to comply with tax or accounting law, protect security, prevent fraud, complete a transaction, exercise or defend legal claims, or preserve evidence of compliance. We will explain any applicable exception. Residual backup copies are handled as described in Section 7.
12. International transfers
We may process and store information in countries other than your own, including where our service providers operate. Those countries may have different data-protection laws. Where required, we use a legally recognized transfer mechanism and supplementary safeguards appropriate to the transfer, and assess service providers before transferring personal information.
13. Children’s privacy
The Services are not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact [email protected] and we will take appropriate steps to delete it.
14. Automated processing and AI
AI-assisted features may classify a message or generate a suggested or automated conversational reply. They are not intended to make decisions that produce legal or similarly significant effects about individuals. Users can request a human agent through the conversation where that option is offered, and merchants remain responsible for reviewing AI configuration and outputs appropriate to their use case.
15. Meta platform compliance
Our use of Meta products (including WhatsApp Business Platform) is subject to the Meta Platform Terms, Meta Privacy Policy, and applicable WhatsApp Business policies. We use Platform Data only as permitted to provide the Services to merchants and their customers.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. Material changes may be communicated by email or in-product notice where appropriate. Where required, we will obtain consent before applying a materially different processing purpose to previously collected data.
17. Contact us
For privacy questions, data access requests, or deletion requests:
