Privacy notice · 15 November 2026

A clear purpose for your data.

This notice explains the current reviewer demo and the intended WhatsApp integration. The service is in development and is not yet approved to onboard client businesses.

Who is responsible

Bakir Technologies Ltd, company number 17413557, operates this service. Its registered office is 2 Grange Way, Iver, SL0 9NU, United Kingdom. Contact ali.m.bakir@gmail.com for privacy questions.

We are responsible for the reviewer workspace, account administration and service security data. In the planned client service, each business determines why it communicates with its customers; we process those conversations on that business’s instructions. A client data-processing agreement and accurate live-service notice are required before onboarding real customers.

Information processed in this demo

• Fictional contact names and identifiers, messages, template drafts and demonstration actions entered in the workspace.
• A reviewer password is checked against a stored password hash. Session identifiers and security tokens keep the workspace protected.
• Necessary technical request information, such as connection address and timestamps, may be handled for rate limiting and security. We do not need message contents in routine operational logs.
• If controlled Meta API testing is separately configured, designated test account and phone identifiers, test messages, templates, API results and delivery events are processed for that test. The demo is not evidence that Meta has approved these permissions.

The website does not use advertising trackers or third-party analytics. It uses a necessary first-party session cookie to authenticate the reviewer and protect requests. It does not set advertising cookies, load external fonts or use conversation data to train an AI system.

Why we use it

We use demonstration data to show the messaging workflow, maintain the reviewer account, investigate faults and protect the service. Necessary account and security processing supports our legitimate interests in operating a safe business service. If you contact us, we use your details to respond to your request. Real client conversations will only be processed under the client’s instructions and relevant contract; the client is responsible for its lawful basis and customer notices.

Hosting and other recipients

During the synthetic pilot, application storage and access are isolated on a shared AWS host in London. Temporary backups are encrypted local copies retained for seven days, with an independent recovery copy held by Bakir; daily independent S3 backups are not yet commissioned. The selected live-service hosting plan is an Amazon Web Services Lightsail instance in London (eu-west-2), with private encrypted daily backups in Amazon S3 in London. These are the build requirements; they are not a statement that every operational control has already been commissioned. The authenticated About & support screen reports the environment’s configuration and backup status.

AWS provides infrastructure processing. The initial service has no external AI or analytics processor. We do not sell messages or use them for unrelated advertising. Data is accessible only to authorised administrators or service providers who need it to operate the integration. We will assess any new provider or processing location before introducing it.

Meta independently operates the WhatsApp platform. If a designated API test is enabled, information needed to deliver that test is sent to Meta. Selecting London for our own storage does not mean all processing by Meta takes place in the UK. For the platform’s processing, see WhatsApp’s privacy policy. AWS’s relevant entities depend on the services and region selected; see AWS’s processor information. Message data must not be copied into external support tickets.

Retention and deletion

These are the service’s retention defaults, not a claim that Meta mandates these exact durations. The hosted backup and operational log controls must be commissioned and verified before real client use. The synthetic demo may reset to its original examples when no reviewer is active.

After an authorised deletion, live data is removed promptly. A residual copy may remain in encrypted backups until scheduled backup expiry. Backups are scheduled for deletion after seven days; provider lifecycle processing can finish later. Deleted data must remain beyond operational use, and a restore must reapply recorded deletions before data is made available again. A narrowly scoped legal requirement may justify longer retention; it must be documented and disclosed when lawful. See how to request deletion.

Security

The application separates authenticated access from public policy pages, validates requests and limits repeated authentication attempts. The hosted build requires HTTPS, restricted administrator access, encryption, scoped credentials, isolated client records and tested recovery. No software is risk-free. We will not describe an untested control as an operational guarantee.

Your choices and rights

You can ask about access, correction, deletion, restriction or objection, or request information about how your data is handled. Email ali.m.bakir@gmail.com. We may need to verify your authority before acting. Do not send an identity document or API credential with your initial request. For a conversation with a client business, contact that business first; we can help route your request.

We aim to respond without undue delay and normally within one month, subject to any lawful extension. You can complain to the UK Information Commissioner’s Office. This business tool is not intended for children.

Changes to this notice

We will update this page when the service, processors or purposes change, and provide additional notice where appropriate. The current notice date appears above.