Privacy Policy

Peak operates a WhatsApp Business messaging platform that lets businesses manage customer conversations, send approved message formats, and automate replies through Meta's official WhatsApp Business Cloud API. This policy explains what we collect, why, and what you can ask us to do about it.

This distinction determines your rights, so it comes before everything else.

For your account data — your name, email, workspace and billing details — we are the controller. We decide how it is used, and this policy governs it.

For the contact data and message content you process through Peak — the phone numbers of your customers and what you say to each other — we are a processor acting on your instructions. You are the controller. We handle that data only to deliver the service you asked for; we do not use it to build profiles, to train models, or for our own marketing. If one of your customers asks to access or delete their data, that request belongs to you, and we will help you honour it.

• Account details: name, email address, workspace name, and password (stored only as a hash).
• Channel credentials: the WhatsApp Business Account and phone numbers you connect, and the access tokens that authorise us to send on your behalf.
• Contact data you import or collect: names, phone numbers, email addresses and any custom fields you add.
• Message content sent and received through the platform, including delivery and read receipts.
• Billing information, processed by our payment provider. We do not store full card numbers.
• Usage and security data: log files, IP addresses, browser type, and an audit trail of significant actions taken in your workspace.

• Operating Peak and delivering your messages through the Meta Cloud API.
• Managing your account, subscription and credit balance.
• Sending service and transactional notices — for example, a warning that your plan is about to lapse.
• Detecting fraud and abuse, and keeping the platform secure and available.
• Meeting legal obligations, including Meta’s requirements for platform providers.

We do not sell your personal information, and we do not sell or rent your contacts' data to anyone.

• Meta Platforms, Inc. — to send and receive messages through the WhatsApp Business Platform on your behalf. Your use of the service is also subject to Meta's terms and policies.
• Infrastructure providers — hosting, database, queue and storage services that process data solely to run the platform on our instructions.
• Payment providers — to take payment and issue invoices.
• Legal authorities — where we are required to by applicable law, court order or regulation.

Peak is built on the Meta WhatsApp Business Platform. Message content, phone numbers and message-format data processed through the platform are also subject to Meta's Privacy Policy and the WhatsApp Business Terms of Service. We access WhatsApp user data solely to deliver the messaging functionality you request, and for no unrelated purpose.

Data is stored on access-restricted servers. Sensitive credentials such as WhatsApp access tokens are encrypted at rest with AES-256. Access to personal data is limited to authorised personnel, and significant actions in your workspace are recorded in an audit log you can inspect. No transmission over the internet is ever completely secure, so we cannot guarantee absolute security.

We use session cookies to authenticate you and keep you signed in. We do not use third-party advertising cookies and we do not track you across other sites. You can disable cookies in your browser, but you will not be able to sign in.

We keep your personal data for as long as your account is active, or as long as we need it to provide the service. You can ask us to delete your account and its data at any time using the contact details below. We will action deletion within 30 days, except where we are required to retain something by law — billing records, for instance.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that is wrong or incomplete
• Ask us to delete your personal data
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent where our basis for processing was consent

To exercise any of these, contact us using the details in the final clause. If you are a customer of one of our users rather than a user yourself, please contact that business directly — they control your data, and we act on their instructions.

We may update this policy. When we do, we will post the revision here with a new “Last updated” date, and we will tell you in the app if the change is significant. Continuing to use the platform after a change means you accept it.

For any question about this policy, or to exercise your data rights, write to support@peakmessaging.tech.