1. The parties and their roles
1.1. This Data Processing Agreement (the “Agreement”) forms part of the Terms (Public Offer) for WaBizBox. It sets out how AKASOFT processes personal data on the business’s instructions.
1.2. AKASOFT is AKACORP GLOBAL TECH LLC, a limited liability company registered under number 312414442 (TIN), with its registered address at Farg’ona viloyati, Farg’ona shahri, Mash’al MFY, Mustaqillik shoh ko’chasi, 3S-uy, Uzbekistan (“AKASOFT”, “we”). AKASOFT provides WaBizBox, a shared team inbox for WhatsApp on Meta’s WhatsApp Cloud API. For the personal data of the business’s customers, AKASOFT is the processor: it acts only on the business’s instructions and does not decide why the data is processed.
1.3. The business is the company or sole trader that has accepted the Terms and uses WaBizBox. For the personal data of its customers, the business is the controller: it decides why that data is processed and what data goes into WaBizBox.
1.4. A customer is anyone who writes to or calls one of the business’s WhatsApp numbers, anyone the business adds or imports as a contact, anyone who receives its broadcasts or fills in its forms, and anyone else named in their messages, files or form answers.
1.5. Other words used here:
- the desk is the WaBizBox app at app.wabizbox.com, where the business’s team works. Its people are admins and agents;
- a number is one of the business’s WhatsApp numbers connected to the desk;
- the WhatsApp Business Account (WABA) is the business’s own account with Meta, to which its numbers belong.
1.6. Depending on the law that applies to the business, the controller may be called the data fiduciary (India’s Digital Personal Data Protection Act 2023) or the operator (the Law of the Republic of Uzbekistan “On Personal Data”), and the processor the data processor. This Agreement uses “controller” and “processor” for all of them.
1.7. This Agreement does not cover data that AKASOFT is responsible for itself: the business’s account, its admins and agents, billing and contract records, visitors to wabizbox.com, Book a demo requests, people who email AKASOFT, and AKASOFT’s logs and security records. The Privacy Policy covers them.
1.8. If this Agreement and the Terms differ on the processing of customers’ personal data, this Agreement prevails.
2. What the business instructs
2.1. The business instructs AKASOFT to process its customers’ personal data, and AKASOFT agrees to do so, only as far as needed to provide WaBizBox under the Terms.
2.2. Annex 1 describes the subject matter, duration, nature and purpose of the processing, the kinds of personal data and the people it concerns.
2.3. The business’s documented instructions are:
- the Terms, and this Agreement with its annexes;
- what the business’s admins and agents set up and do in the desk: the numbers connected and who answers each one, automation, forms, templates and broadcasts, contacts added or imported, and the team email address that receives alerts for each number;
- the file retention period each number’s admin sets: from 1 to 3,650 days, 365 days unless changed. When it ends, the customer’s pictures, voice notes, audio, video and documents are deleted from the server, and the chat keeps a line showing that a file was there;
- written instructions from the business’s admins, such as a request to erase a customer (7.3).
2.4. Message text, and the rest of a chat, is not deleted automatically. It stays until the business asks AKASOFT to erase the customer (7.3), or until the business’s data is deleted at the end of the contract (12.2).
2.5. AKASOFT processes the data only on the business’s documented instructions. If a law that applies to AKASOFT requires other processing, AKASOFT tells the business before it starts, unless that law forbids telling.
2.6. If AKASOFT believes an instruction breaks data protection law, it tells the business and may hold off carrying out that instruction until the matter is settled.
2.7. Automation follows only the rules the business sets: menus, buttons, lists, questions, forms, exact keywords, working hours and hand-over to a human agent. It does not profile customers and makes no decisions with legal or similarly significant effects for them. If the business uses WaBizBox to make such decisions, the business is responsible for protecting the customer’s rights.
3. The business’s obligations
3.1. The business confirms that it:
- has a lawful basis for each purpose for which it processes its customers’ data;
- gives its customers its own privacy notice, which says that it uses a service provider to handle their messages and that their messages pass through Meta (section 6);
- obtains consent where consent is its basis, and in particular gets each customer’s opt-in before sending them marketing messages. The desk records each opt-in and opt-out with the exact words the customer was asked, the language, how it was given and when. It sends broadcasts only to customers recorded as opted in, and leaves out anyone who has opted out or used WhatsApp’s own “stop”. The business is responsible for the recorded words being accurate and for the opt-in having really been given;
- tells its customers when automation is answering and how to reach a person;
- follows Meta’s terms and policies for its WABA, including the WhatsApp Business Messaging Policy and the Commerce Policy.
3.2. The business decides what data enters WaBizBox: what its forms ask, what it imports and what it asks customers to send. WaBizBox is not meant for special categories of personal data, such as health, biometric or genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or criminal records. The business will not ask for or import such data without AKASOFT’s prior written agreement and a lawful basis.
3.3. AKASOFT does not check customers’ ages. The business is responsible for any age limits and parental consent rules that apply to its customers.
3.4. The business manages its own team. Its admins invite people, give each agent only the numbers they need, and remove access in good time. Deactivating a person signs them out everywhere at once.
3.5. The business is responsible for the accuracy of data it enters or imports, and for having the right to import it.
3.6. The business chooses the team email address that receives alerts for each number. Those emails carry the customer’s name, why they are waiting, and their last message or form answers. The business makes sure those mailboxes are its own and kept safe. The provider of those mailboxes is the business’s choice and is not AKASOFT’s sub-processor.
4. AKASOFT’s obligations
4.1. AKASOFT processes customers’ personal data only on the business’s documented instructions, and only for the purposes in Annex 1.
4.2. Everyone AKASOFT authorises to process the data is bound to keep it confidential, by contract or by law.
4.3. AKASOFT applies the technical and organisational measures in Annex 3.
4.4. AKASOFT does not use the business’s data for its own purposes, does not sell it, and does not give or show it to other businesses. The one exception is usage totals: AKASOFT counts each business’s use of WaBizBox per day (messages, templates, Meta’s charges by category, chats, calls and storage) to run its plans, invoices and Console. These totals hold no customer’s identity or words.
4.5. AKASOFT keeps businesses apart: one business cannot reach another business’s chats.
4.6. AKASOFT helps the business meet its own duties as controller: with customers’ requests (section 7), with security and breaches (sections 8 and 11), and with impact assessments and consultations with regulators, by giving the information it has.
4.7. When the contract ends, AKASOFT deletes the data as section 12 sets out.
4.8. AKASOFT gives the business the information it needs to show that this Agreement is kept (section 13).
4.9. AKASOFT keeps a record of the processing it carries out for the business, as the law requires.
5. AKASOFT’s staff
5.1. WaBizBox has no feature that lets AKASOFT staff sign in to a business’s desk as one of its people.
5.2. AKASOFT staff use a separate owner Console at console.wabizbox.com. It shows counts for each business, never message text or customers’ names or numbers. Staff sign in to it with a password and a six-digit code sent by email every time. The Console keeps a log of staff actions, including the IP address at each sign-in.
5.3. The person who administers the server can technically reach all data stored on it. AKASOFT uses that access only to run, update, back up, restore and repair WaBizBox, to carry out the business’s instructions (such as connecting a number or erasing a customer), and where the law requires it. Server access is limited to the staff who run the server, and uses SSH keys.
5.4. AKASOFT staff reach the server remotely from the countries where they work, which today include India (section 10).
6. The business’s own provider: Meta
6.1. The business has its own agreement with Meta for its WABA and numbers: with Meta Platforms Ireland Limited, or with Meta Platforms, Inc. in the United States and Canada. The business owns its WABA and business portfolio, accepts Meta’s terms itself and pays Meta directly with its own payment method.
6.2. Customers’ messages and calls, and their metadata, pass through Meta before AKASOFT receives them, and the business’s replies pass through Meta to reach its customers. Meta processes them under the business’s own agreement with Meta. Meta’s terms describe Meta as the business’s processor to the extent they state, and as an independent controller for some purposes, such as security and integrity.
6.3. AKASOFT connects to Meta as the business’s solution provider, in one of two ways the business chooses: with an access token the business provides for its WABA, which AKASOFT stores encrypted; or, where the business assigns AKASOFT as a partner on its WABA and messaging account, with AKASOFT’s own access token, which is kept in the server’s settings and not in the database. AKASOFT uses either only to provide WaBizBox. AKASOFT cannot choose, replace or instruct Meta on the business’s behalf.
6.4. Meta is therefore not one of AKASOFT’s sub-processors, and AKASOFT is not responsible for Meta’s processing. Annex 2 names Meta for information only.
6.5. Meta sends a number’s messages to every app the business subscribes to its WABA. Which apps receive them is the business’s choice, and those apps are not AKASOFT’s sub-processors.
6.6. The business must name Meta in its own privacy notice (3.1) and keep its WABA in good standing, as the Terms set out.
6.7. WhatsApp is a trademark of Meta Platforms, Inc. WaBizBox is not affiliated with, endorsed by or sponsored by Meta.
7. Customers’ requests
7.1. Customers’ requests about their rights (access, correction, deletion, restriction, objection and withdrawal of consent) are answered by the business, as controller.
7.2. The desk gives the business tools to handle many requests itself. Its team can find a customer’s chats and contact, correct the contact’s details, labels and notes, and record an opt-out. Its admins can export contacts as a CSV file, and each export is recorded in the business’s activity log. The desk has no screen yet for erasing a customer or exporting everything held about one customer.
7.3. Where the desk’s tools are not enough, AKASOFT helps within a reasonable time, and no later than 10 working days after the business’s written request. To have a customer erased, the business’s admin writes to info@akasoft.io with the customer’s WhatsApp number and a reference of the business’s own. AKASOFT then erases that customer’s chats on all the business’s numbers:
- messages, call records, form answers and files;
- the contact, with its labels, notes and consent records;
- team notes, notifications and broadcast send records.
AKASOFT keeps the business’s own labels and broadcasts, and any data the same person has with another business. The business’s activity log records the erasure with the business’s reference, never the customer’s number. AKASOFT confirms the erasure in writing (12.6).
7.4. If a customer sends a request straight to AKASOFT, AKASOFT does not act on it. It forwards the request to the business without undue delay and tells the person it has done so.
7.5. AKASOFT tells the business of any request from an authority about the business’s data, unless the law forbids it.
8. Personal data breaches
8.1. AKASOFT tells the business of a personal data breach affecting its customers’ data without undue delay, and in any case within 24 hours of becoming aware of it, by email to the business’s admins.
8.2. The notice says, as far as is known: what happened, the kinds and approximate number of people and records affected, the likely consequences, what AKASOFT has done and proposes to do, and who to contact. Anything not known at first is sent as it becomes known.
8.3. The business, as controller, notifies its regulator and its customers where the law requires. AKASOFT gives it the information it has for that.
8.4. AKASOFT itself notifies the competent data protection authority and the people affected of breaches affecting data it is responsible for (1.7), where and as the law requires.
8.5. AKASOFT keeps a record of breaches and of what was done about them.
9. Sub-processors
9.1. The business gives AKASOFT general authorisation to use sub-processors to provide WaBizBox.
9.2. The current sub-processors are listed in Annex 2, published on this page.
9.3. AKASOFT binds each sub-processor by written terms that protect personal data at least as well as this Agreement does, and remains responsible to the business for each sub-processor as for itself.
9.4. AKASOFT tells the business of any intended new or replacement sub-processor at least 30 days in advance, by email to the business’s admins and by updating Annex 2.
9.5. The business may object, with reasons, within 14 days of the notice. The parties will look for a solution in good faith. If none is found, the business may end the contract before the new sub-processor starts, as clause 15.10 of the Terms sets out, with the refund in their clause 9.9.
9.6. Backups are kept on the same server today (12.5). If AKASOFT adds an off-site backup copy, its provider is added as a sub-processor under 9.4 first.
10. Where the data is processed
10.1. Customers’ data, and its backups, are stored on one server in Mumbai, India, rented from Hostinger.
10.2. Customers’ data is also processed in these places:
| Case | What | Where |
|---|---|---|
| Every connection to the desk, and Meta’s deliveries to it, pass through Cloudflare’s network, decrypted at its edge | IP addresses, request details, and everything shown in or sent from the desk, including message content | Cloudflare’s global network (Cloudflare, Inc., a United States company) |
| Resend sends the desk’s emails, including alerts to the business’s team addresses | The recipient’s address and the email’s content, such as a customer’s name, last message or form answers | Tokyo, Japan, on Amazon Web Services |
| Email sent to AKASOFT at info@akasoft.io, such as an erasure request (7.3), is received and read in AKASOFT’s mailbox at Google Workspace | The sender’s address and the email’s content | Google’s global data centres (Google, a United States company) |
| AKASOFT staff reach the server remotely (5.3) | Data on the server, as far as the task needs | The countries where AKASOFT staff work, which today include India |
10.3. Meta processes messages and calls under the business’s own agreement with Meta, on Meta’s own global infrastructure (section 6).
10.4. Where the law that applies to the business requires a basis for these transfers, the parties rely on the grounds that law provides. Where it requires a particular safeguard, such as standard contractual clauses, the parties put it in place on the business’s written request.
10.5. WaBizBox is not meant for data that a law requires to stay in a particular country, such as biometric or genetic data under some laws (3.2). The business will not send such data through WaBizBox unless AKASOFT agrees in writing that the requirement can be met.
10.6. AKASOFT gives the business the same notice as in 9.4 before it moves stored data to another country.
11. Security
11.1. AKASOFT applies the technical and organisational measures in Annex 3.
11.2. AKASOFT reviews the measures as technology and the data processed change. A change must not lower the protection Annex 3 describes.
11.3. The business is responsible for security on its side: its people keep their passwords safe, it removes access when someone leaves, it uses team alert addresses it controls (3.6), and it protects the computers its agents use, including any files they download from the desk.
12. Return and deletion of data
12.1. During the contract, the business’s admins can export its contacts as a CSV file from the desk. There is no tool yet to export all of a business’s data at once. Other exports: on the business’s written request, AKASOFT provides other data it holds for the business, as far as it reasonably can, in a common machine-readable format.
12.2. When the business cancels, the desk stays open until the date set under clause 15.2 of the Terms: the end of the calendar month in which it asked to cancel, or the end of a longer period already paid for. Where the contract ends in another way, the desk closes on the date the Terms give for that case (Terms 15.6). After that, the business’s data is kept for 30 calendar days so that it can be exported, and is then deleted within the following 30 calendar days. AKASOFT carries out the deletion.
12.3. The business may ask in writing for its data, or a customer’s data, to be deleted sooner. Deletion cannot be undone. If a backup is ever restored, every erasure made since that backup is applied again, so erased data does not come back.
12.4. These are kept after deletion:
- invoices and payment records, which accounting and tax law require: for as long as that law requires;
- records of the documents the business accepted, kept as contract evidence: for as long as claims about the agreement can be brought;
- the entries in the erasure log and the opt-out log, which name chats and contacts only by internal ids, never by a customer’s number or name, so that a restore cannot undo an erasure or an opt-out;
- daily usage totals, which are counts only (4.4);
- data AKASOFT is responsible for itself (1.7), as the Privacy Policy sets out.
12.5. Backups are made every night and kept for at most 30 days, on the same server, then deleted by rotation. Deleted or erased data stays in backups until rotation removes it, for up to 30 days. Backups are used only to recover from a disaster, never to look anything up, and a restore applies erasures and opt-outs again (12.3).
12.6. AKASOFT confirms each erasure under 7.3 in writing, within 10 working days of the request. The confirmation gives the business’s reference, the customer’s number masked, who carried out the erasure and when, what was deleted, what was kept, and that the data stays in backups for up to 30 days. On request, AKASOFT also confirms in writing the deletion of the business’s data under 12.2.
13. Showing compliance and audits
13.1. On request, AKASOFT gives the business the information it needs to show that this Agreement is kept: a description of the measures in Annex 3, the list of sub-processors, and where the data is stored.
13.2. The business may audit AKASOFT’s compliance with this Agreement on these terms: the business asks in writing, at least 30 days in advance, and says what it wants to check; AKASOFT first answers with written information and documents, and an inspection follows only if those are not enough; there is no more than one audit in any 12 months, unless a personal data breach affecting the business’s data or a regulator’s request makes another necessary; and the business bears its own costs and those of its auditor.
13.3. An audit takes place in working hours, with notice, and must not disrupt WaBizBox. It does not extend to other businesses’ data, or to AKASOFT’s confidential information beyond what the audit needs. Auditors are bound to keep what they see confidential.
13.4. If AKASOFT believes a request under this section would break data protection law, it tells the business.
14. Liability
14.1. Each party is liable for breaches of data protection law within its own role and for its own acts.
14.2. The limits of liability in the Terms also apply to this Agreement, except where the law does not allow them.
14.3. The business reimburses AKASOFT for any amount AKASOFT has to pay because of an unlawful instruction from the business or a breach of section 3.
14.4. AKASOFT is not liable for Meta’s processing (section 6), or for the mailboxes and apps the business chooses (3.6 and 6.5).
15. Term, changes and law
15.1. This Agreement lasts as long as the contract under the Terms and, for section 12, until deletion is complete.
15.2. The business accepts this Agreement together with the Terms. When a business signs itself up, it ticks a box agreeing to the Terms and this Agreement, and AKASOFT records the version, the language and the time. Where AKASOFT sets up the business’s account itself, the business accepts by confirming to AKASOFT in writing, by email for example, that it accepts the Terms and this Agreement, or by paying AKASOFT’s first invoice, whichever happens first.
15.3. This version takes effect on 31 October 2026. Each version is published on this page with its number and date.
15.4. AKASOFT may change this Agreement by giving the business at least 30 days’ notice, by email or in the desk. A change may not lower the protection of customers’ data. A business that does not accept a change may end the contract before the change takes effect, as clause 15.10 of the Terms sets out.
15.5. This Agreement is governed by the law of the Republic of Uzbekistan. Disputes are resolved as the Terms set out: the competent economic court at AKASOFT’s location.
15.6. Language: this Agreement is written in English. If AKASOFT publishes it in another language, the English version prevails where the two differ.
16. Contact
16.1. Questions about this Agreement, instructions such as erasure requests, and anything about a breach go to:
AKACORP GLOBAL TECH LLC
Farg’ona viloyati, Farg’ona shahri, Mash’al MFY, Mustaqillik shoh ko’chasi, 3S-uy, Uzbekistan
Data protection contact: the Personal Data Protection Officer of AKACORP GLOBAL TECH LLC
Email: info@akasoft.io
Phone: +998 50 744 41 31
Annex 1. Description of the processing
Subject matter: handling the business’s WhatsApp conversations with its customers in WaBizBox.
Duration: the term of the contract under the Terms, plus the periods in section 12, and up to 30 days more in backups.
Frequency: continuous, while the business uses WaBizBox.
Nature and purpose: receiving customers’ messages and calls from Meta; storing them and showing them to the business’s team; assigning, taking over and closing chats; rule-based automation and forms; sending replies, templates and broadcasts through Meta; contacts, labels and notes, CSV import and contacts export; recording marketing opt-ins and opt-outs; answering inbound calls in the browser; reports, notifications and alert emails; backups and restores; erasure and deletion.
People the data concerns:
- customers who write to or call the business’s numbers;
- contacts the business adds by hand or imports;
- people who receive the business’s broadcasts or fill in its forms;
- other people named in customers’ messages, files or form answers.
Kinds of personal data
| Kind | What | Source |
|---|---|---|
| Identifiers | WhatsApp user ID (the phone number) and WhatsApp profile name. Messages from customers whom Meta identifies only by a username, without a number, are not stored | Meta |
| Messages | Text, button and list replies, reactions, locations, shared contacts and stickers; delivery status (sent, delivered, read, failed); times | The customer, the business’s team, Meta |
| Files | Pictures, voice notes, audio, video and documents sent by customers or by the team, and photos and documents picked in WhatsApp Flows forms | The customer, the business’s team |
| Form answers | Whatever the business’s forms ask, for example name, email, phone, dates, choices, free text, photos and documents | The customer |
| Automation state | The step a customer has reached, form answers not yet finished, and the language chosen | Automatic |
| Contact record | Name, email, company, job title, language, labels, team notes, and where the contact came from (WhatsApp, added by hand, or CSV import) | The business’s team, the customer |
| Marketing consent | Opt-ins and opt-outs, with the exact words asked, the language, how and when; WhatsApp’s own “stop”, kept separately | The customer, the business’s team |
| Calls (inbound only) | When the call rang, who answered, how long it lasted, the outcome and Meta’s error code. No audio and no recording. The technical details Meta sends to connect a call are kept only while the call can be answered | Meta, automatic |
| Broadcasts | Which customers a template went to, with each one’s state and reason | Automatic |
| Team activity | Internal notes, mentions, assignments, take-overs, closes, and alerts sent | The business’s team, automatic |
| Alert emails | Sent to the team address the business sets for each number: the customer’s name, why they are waiting, and their last message or form answers | Automatic |
Special categories of personal data: not intended (3.2).
How long the data is kept
| Data | Kept |
|---|---|
| Chats, messages, contacts, form answers, consent records, call records and team notes | While the business’s account exists: until the business asks for the customer to be erased (7.3), or until the business’s data is deleted after the contract ends (12.2). Message text is not deleted automatically |
| Customers’ files | The period each number’s admin sets: 1 to 3,650 days, 365 days unless changed. Expired files are deleted four times a day, and the chat keeps a line showing that a file was there (2.3) |
| Files the team uploads but never sends | Removed within about 25 hours |
| Notifications and emails to the business’s people | 30 days |
| The business’s activity log | For the life of the account. It holds ids and the names of changed fields, never a customer’s name or words |
| Backups | At most 30 days (12.5) |
| Erasure log and opt-out log entries | Kept, so that a restore cannot undo an erasure or an opt-out. Internal ids only (12.4) |
Annex 2. Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Hostinger (Hostinger International Ltd) | Hosting the server: the desk, its database, stored files and backups | All kinds of data in Annex 1 | Mumbai, India |
| Cloudflare, Inc. | DNS, reverse proxy, TLS and protection for wabizbox.com, app.wabizbox.com and console.wabizbox.com | IP addresses and request details of every user. All traffic to and from the desk, including message content and Meta’s deliveries, passes through Cloudflare decrypted at its edge | Global network (a United States company) |
| Resend (a United States company) | Sending the desk’s emails, including alerts to the business’s team addresses; receiving email sent to @wabizbox.com addresses | Sender and recipient addresses and email content, including a customer’s name, last message or form answers | Tokyo, Japan, on Amazon Web Services |
| Google (Google Workspace) | AKASOFT’s mailbox, where email sent to AKASOFT is read, such as a business’s erasure request | The sender’s address and the email’s content | Google’s global data centres (a United States company) |
For information: not AKASOFT’s sub-processors
| Who | Role |
|---|---|
| Meta Platforms Ireland Limited, or Meta Platforms, Inc. in the United States and Canada | Carries messages, calls and their metadata between customers and the business’s numbers, under the business’s own agreement with Meta (section 6) |
| The business’s own email provider | Receives the alert emails sent to the team addresses the business chooses (3.6) |
| Other apps the business subscribes to its WABA | Receive the number’s messages from Meta, by the business’s choice (6.5) |
WaBizBox uses no outside service to read text in pictures: the desk does this on the agent’s own computer, and the picture is not sent anywhere. It uses no relay servers for calls, no SMS provider and no analytics or advertising trackers.
Annex 3. Technical and organisational measures
| Area | Measure |
|---|---|
| Connections | HTTPS only. Cloudflare sits in front, with full (strict) TLS to a Let’s Encrypt certificate on the server |
| Server | The firewall accepts web traffic only from Cloudflare’s addresses, plus SSH. SSH sign-in is key-based. Security updates install daily. The desk runs as its own unprivileged system user, and its stored files have owner-only permissions |
| Stored data | Access tokens a business provides are encrypted with AES-256-GCM. The key is kept outside the database and never in a backup. AKASOFT’s own access token, used where a business assigns AKASOFT as a partner (6.3), is kept in the server’s settings file, readable only by the desk’s system user, and never in a backup. So a backup alone cannot send messages as anyone. Other data is protected by the server’s access controls and file permissions; the database and disk are not encrypted as a whole |
| Passwords | Hashed with scrypt, with a salt for each password. Sign-in gives the same answer, in the same time, for an unknown email and a wrong password. Wrong guesses are limited per connection and email, and per connection, never per account, so nobody can lock another person out. Two-factor sign-in is not available for the business’s people |
| Sessions | Session and password-link tokens are stored only as SHA-256 hashes. Session cookies are host-only, HttpOnly, SameSite and Secure. A new password ends every other session, and deactivating a person signs them out everywhere. People can see their sessions and sign out other browsers; admins can see and end their team’s |
| Separation | One business cannot reach another’s chats. Every inbox request checks that the person answers that number. Roles are admin and agent |
| Web protections | Requests from other sites are turned away. Security headers and a Content Security Policy are in place. Customers’ files are served only to signed-in people, with content sniffing turned off and a sandboxing policy |
| Meta’s deliveries | Accepted only with Meta’s valid signature (HMAC-SHA256 with the app secret, compared in constant time) |
| Logs | The business’s activity log records every settings change and what admins do, including each contacts export, with ids and field names, never a customer’s name or words. The application log leaves out customers’ names, numbers, message ids and message text, passwords and tokens, and is kept for at most 11 months (1 GB at most). The database log leaves out row contents |
| Browser | The desk keeps no customer content in the browser’s storage. Message drafts and the page cache are held in memory and cleared at sign-out |
| Calls | Not recorded. The desk never asks Meta for a recording or a transcript |
| Pictures | Text in a customer’s picture is read on the agent’s own computer. The picture is not sent anywhere |
| Backups | Nightly backups of the database and stored files, with SHA-256 checksums. Each backup checks itself before it is kept. Backups are kept for at most 30 days, on the same server; there is no off-site copy. A failed backup sends an alert email. The restore procedure is written down and has been rehearsed on test copies. Erasures and opt-outs are applied again after any restore |
| AKASOFT staff access | The owner Console is on a separate host. Staff sign in with a password and a six-digit code by email every time; sessions last 12 hours and end after an hour unused. Staff see counts, not message content. Access to the server itself is limited to the staff who run it, and uses SSH keys |
| Personnel | Staff who can reach personal data are bound to keep it confidential, by contract or by law, and have access only as far as their work needs |
| Breaches | Handled under section 8 |
| Deletion | Under 7.3 and section 12, with written confirmation (12.6) |