Privacy Policy
Last updated 14 August 2026 · Version 1.1 (draft)
Draft for legal review. This policy describes how the platform actually works, but it has not yet been reviewed by a qualified lawyer in Kuwait. It should be reviewed against Kuwait’s CITRA Data Privacy Protection Regulation, and against GDPR where customers in Europe are messaged, before the service is offered commercially.
1. Who we are
SocialVibe (“we”, “us”) provides software that lets a business manage its customer conversations on WhatsApp. This policy explains what data passes through our platform, where it is kept, and what rights people have over it.
Two different relationships matter throughout this document, and they carry different responsibilities:
- Businesses that use SocialVibe. We act as a processor: we handle their customers’ data on their instructions.
- People who message those businesses. The business decides why it contacts them and is the controller of that relationship. We provide the tools and hold the data on the business’s behalf.
2. What we collect
From businesses using SocialVibe
- Account details: name, email address, and the role each team member holds.
- Workspace settings: business name, language, and the WhatsApp Business Account and phone number connected to the workspace.
- Credentials issued by Meta that let us send and receive messages on the business’s behalf.
From people who message a business
- The WhatsApp phone number the message came from, and the profile name WhatsApp provides.
- The content of messages exchanged with the business, including text, images, documents, audio and other attachments.
- Delivery information from WhatsApp — whether a message was delivered and read.
- Anything the business chooses to record about the person: tags, notes and custom fields.
- Whether the person has agreed to receive marketing messages, and how that was recorded.
We do not buy contact lists, and we do not use message content to train models or build profiles across different businesses.
3. Where data is stored
All customer data is stored on Google Cloud Platform in the me-central1 region (Doha, Qatar) — the closest available region to Kuwait.
| Data | Where | Notes |
|---|---|---|
| Conversations, contacts, templates | Google Cloud Firestore | Separated by business; encrypted at rest |
| Photos and files sent in chat | Google Cloud Storage | Private bucket, no public access |
| WhatsApp credentials | Google Secret Manager | One separate secret per business |
| Billing records | Google Cloud Firestore | Invoices and payment references |
Message content also passes through Meta Platforms, who operate WhatsApp. Meta’s own terms and privacy policy govern what they do with it, and they are not controlled by us.
4. Photos and files
WhatsApp deletes media from its servers roughly 30 days after it is sent. So that a business does not lose the photo a customer sent them, we copy attachments into our own storage when they arrive. Those copies are private, are stored separately for each business, and are only reachable through a temporary link issued to a signed-in member of that business.
5. Keeping businesses apart
Every record belongs to exactly one business, and access is enforced in two independent places: the database refuses reads from anyone outside the owning workspace, and our API re-checks membership on every request. Removing someone from a team ends their session immediately rather than when their sign-in expires.
6. How we use data
- To deliver messages between a business and its customers.
- To show conversation history, contact records and campaign results to that business.
- To calculate what a business owes for its use of the service.
- To keep the service working — monitoring errors, performance and abuse.
- To meet obligations placed on us by Meta’s WhatsApp Business Platform terms.
7. Marketing messages and consent
WhatsApp requires a person’s agreement before a business may send them marketing. We record when consent was given and how it was obtained, and we refuse to send marketing to anyone who has not given it.
Replying STOP (or إيقاف, إلغاء and similar) to any business using SocialVibe stops marketing messages from that business immediately. Service replies to a question already asked may still be sent, because stopping those would leave someone unable to get help they requested.
8. How long we keep data
- While a business uses the service: conversations and contacts are kept so the business has a history of its customer relationships.
- After a business closes its account: data is deleted within 90 days, except records we must keep for tax or accounting purposes.
- Billing records: retained as long as local law requires.
- Backups: point-in-time recovery keeps a rolling seven days.
9. Your rights
If you have messaged a business that uses SocialVibe and want to see, correct or delete what is held about you, contact that business first — they control the relationship and can act immediately.
If you cannot reach them, write to privacy@socialvibe.tech and we will help, including passing the request to the business. Depending on where you live, you may have rights to access, correct, delete, or object to the use of your data, and to complain to a regulator — in Kuwait, CITRA.
10. Who else sees the data
We do not sell data. We share it only with:
- Meta Platforms — necessarily, to deliver WhatsApp messages.
- Google Cloud — our hosting provider.
- Payment providers — to take subscription payments. They receive billing details, never message content.
- Authorities — where the law requires it.
11. Security
- Encryption in transit and at rest.
- Credentials held in a dedicated secret store, one per business, never in the database.
- Access decided by role, with sessions revoked the moment access is removed.
- Every incoming request from WhatsApp verified by signature before it is trusted.
- Separation between businesses covered by automated tests that run before every release.
12. Changes
We will post any changes on this page and update the date above. Material changes will be notified to businesses using the service.