PT Alia PrimaveraContact →

Legal & Compliance

Privacy Policy

Effective ·Meta Tech Provider Architecture

1. Scope & Application

This Privacy Policy applies to all services provided by PT Alia Primavera ("Provider", "we", "us", or "our") relating to WhatsApp Business Platform onboarding, Meta Graph API connectors, and the Chatwoot multi-agent customer communication software ("Service").

By initiating Meta Embedded Signup or connecting a WhatsApp Business Account, your organization agrees to this Policy, Meta's Commercial Terms, and the WhatsApp Business Data Processing Terms.

2. Information We Collect

We collect only the minimum operational data necessary to enable bidirectional messaging between Meta's WhatsApp Cloud API and your customer support workspace:

A. Business & Authentication Data

  • Meta Identifiers: Meta User ID, WhatsApp Business Account ID (WABA ID), Phone Number ID, and business profile metadata granted during Embedded Signup.
  • Administrative Contact Data: Organization name and administrator email address submitted during account registration.
  • Access Tokens: Scoped System User access tokens required to register webhooks and authenticate Cloud API requests.

B. Messaging & Telemetry Data

  • Conversational Messages: Text, interactive responses, and sender phone numbers received via official Meta webhooks.
  • Media Attachments: Temporary image, audio, document, and video assets routed to customer support agent threads.
  • Delivery Telemetry: Webhook status receipts (sent, delivered, read, failed) provided by Meta Cloud API.

3. Purposes of Processing

Your data is processed strictly for the following business objectives:

  • Provisioning and maintaining dedicated Chatwoot tenant accounts, inboxes, and agent permissions.
  • Dispatching outbound customer replies from support agents back to Meta's WhatsApp Cloud API.
  • Ensuring infrastructure integrity, preventing fraudulent abuse, and validating webhook signatures using HMAC-SHA256.

4. Infrastructure & Subprocessors

We do not sell, rent, or commercialize your data. Infrastructure providers are strictly limited to:

  • Meta Platforms, Inc. / Meta Platforms Ireland Ltd.: Provider of WhatsApp Business Platform and Cloud API messaging infrastructure.
  • Cloudflare, Inc.: Edge DNS, DDoS protection, and secure serverless API execution.
  • Secure Internal Database Clusters: Dedicated PostgreSQL (pgvector) and Redis instances isolated behind firewall boundaries.

5. Security & Encryption Standards

All communication across client browsers, Cloudflare edge functions, and Chatwoot Core is encrypted in transit using Transport Layer Security (TLS 1.3). Sensitive credentials and access tokens are encrypted at rest using AES-256 ciphers.

6. Data Retention & User Deletion Rights

We retain data only as long as your service subscription remains active. In compliance with Meta Platform Policies, GDPR, and CCPA, users have the right to request complete data erasure at any time.

To submit an erasure request, please review our User Data Deletion Instructions or submit a direct erasure request using our automated compliance portal.

7. Privacy & DPO Contact

For any questions or compliance inquiries, please contact our Data Protection Officer: