BarqAI

WhatsApp platform privacy policy

Last updated October 6, 2026

The BarqAI WhatsApp platform lets businesses connect their WhatsApp Business number through Meta's WhatsApp Business Platform and answer their customers with bots, AI-written replies and a shared inbox. This policy explains what data the platform handles, why, and for how long. The platform is run by Toubbali OÜ, registry code 17054922, Soo tn 13-7, 10414 Tallinn, Estonia ("BarqAI", "we"). You can reach us at contact@barqai.agency.

BarqAI is an independent technology provider on Meta's WhatsApp Business Platform. We are not owned by, affiliated with or endorsed by Meta or WhatsApp. For visitors to this website and people who email us, the website privacy policy applies instead.

1. Two kinds of data, two roles

Your business account. When your business signs up and connects a WhatsApp number, we decide how that account data is used, so we are its controller.

Your customers' conversations. When people message your WhatsApp number, your business decides why their data is processed, and we handle it on your behalf as your processor, under the data processing terms in the WhatsApp platform terms. If you messaged a business that uses BarqAI, that business is responsible for your data and its own privacy notice applies. Section 7 explains how to reach us anyway.

Meta operates WhatsApp and the WhatsApp Cloud API that carries every message, and processes that data under its own terms and the WhatsApp privacy policy.

2. What we receive

When you connect your WhatsApp number

You connect through Meta's Embedded Signup: you log in with Facebook in a window run by Meta, choose your business portfolio, WhatsApp Business Account and phone number, and approve the permissions our app asks for. Those permissions only allow managing your WhatsApp Business Account and sending and receiving messages on it (whatsapp_business_management and whatsapp_business_messaging). From Meta we then receive:

  • the IDs of your business portfolio, WhatsApp Business Account and phone number;
  • your display phone number, display name and verified business name, and the quality rating and messaging limits Meta assigns to the number;
  • an access token that lets our app act on that WhatsApp Business Account, within the permissions you approved;
  • your message templates and their approval status.

We never see your Facebook password. We do not ask for access to your friends, posts or Pages, and we do not use your personal Facebook profile.

Your account with us

Your name, work email, business name, and the details needed to invoice you, such as billing address and VAT number.

Conversation data

For every person who messages your number, or whom you message, the platform processes:

  • their phone number and WhatsApp profile name;
  • the content of messages in both directions: text, images, voice notes, video, documents, and any locations or contacts they share;
  • timestamps, and the delivery and read statuses Meta reports;
  • labels, notes and handover status your team adds in the inbox.

Bot settings

The instructions, answers, documents, product or service lists and opening hours you add so your bots can reply.

Technical logs

Records of API calls, webhooks, errors and sign-ins to your BarqAI account, including IP addresses. We use them to run, fix and secure the platform.

3. How we use it

  • To connect your number, receive your customers' messages from Meta, and send your replies, templates and bot answers back through Meta.
  • To run the bots you set up, and to show conversations to your team so a person can take over.
  • To write AI replies, when your bot uses AI (section 4).
  • To support you, bill you, keep the platform secure and meet our legal obligations.

We do not sell data, use it for advertising, build profiles of the people who message you, or use one business's data for another business. We do not use conversation data to train AI models. Data we receive from Meta is used only to provide the platform to you, as Meta's Platform Terms require.

Legal basis for the data we control: performing our contract with you (GDPR Article 6(1)(b)), keeping accounting records (Article 6(1)(c)), and our legitimate interest in securing and fixing the platform (Article 6(1)(f)). For conversation data we act on your instructions, and your business needs its own legal basis, including the opt-in WhatsApp requires before you message someone.

4. AI replies

If your bot uses AI, the platform sends the message being answered, the earlier messages in that conversation and your bot settings to an AI model provider, which returns a reply. We use OpenAI and Anthropic, through their business APIs. Their terms for those APIs do not allow them to train their models on this data. They may keep it for a limited period to detect abuse, as their terms describe, and then delete it.

Bots that follow fixed flows without AI do not send anything to an AI provider.

5. Who else processes it

  • Meta (WhatsApp Business Platform): carries all messages between your business and your customers.
  • Hetzner Online GmbH, Germany: the servers where the platform runs and stores data.
  • OpenAI and Anthropic, United States: AI replies, only for bots that use AI.
  • Google (Workspace): our email, when you write to us for support.
  • Our accountant: invoicing records.

Transfers to the United States rely on the EU standard contractual clauses, or on the EU-US Data Privacy Framework where the provider is certified. Before we add or replace a provider that handles conversation data, we update this list and email account holders at least 30 days ahead. We disclose data to authorities only when the law requires it, and we tell you unless the law forbids it.

6. How long we keep it

  • Conversation data and bot settings: while your number is connected to BarqAI, then deleted within 30 days after you close your account or ask us to delete them.
  • Access tokens: deleted as soon as you close your account or ask for deletion. Removing our app's access in Meta also revokes the token.
  • Account data: while your account is open, then deleted within 30 days, except invoices and payment records, which Estonian accounting law requires us to keep for 7 years.
  • Technical logs: 30 days.
  • Backups: copies of deleted data are overwritten within a further 30 days.

7. Your rights and deleting data

Under the GDPR you can ask us to access, correct, delete or export the personal data we hold about you, and to restrict or object to its processing. Email contact@barqai.agency and we will answer within one month. Step-by-step instructions, including how to remove BarqAI's access to your WhatsApp account in Meta, are on the data deletion page.

If you messaged a business that uses BarqAI, send your request to that business. If you write to us instead, we pass it on and help the business answer within the time the law allows.

You also have the right to complain to a supervisory authority; ours is the Estonian Data Protection Inspectorate (aki.ee).

8. Security

All traffic between the platform, Meta, AI providers and your browser is encrypted in transit. Data is stored on servers in the EU, access tokens are stored encrypted, and only people at BarqAI who need it to run or support the platform can reach your data. If a breach affects your data, we tell you without undue delay.

9. Changes

When this policy changes, the date at the top is updated. We email account holders at least 30 days before a material change takes effect.