Privacy Policy
Last updated: July 31, 2026
HK Infoway Technologies (“we”, “us”) operates HK Infoway WhatsApp Business Console (the “Service”). This policy explains what we collect, why, and the choices you have. It covers data obtained through Facebook Login and the WhatsApp Business Platform.
1. Information we collect
- Account data — the email address and password hash of the administrator who signs in.
- Facebook profile data (
public_profile) — your name, app-scoped user ID and profile picture URL, used only to identify you inside the console. - WhatsApp Business Account data (
whatsapp_business_management) — business account ID, registered phone numbers, display names, quality ratings and message templates. - Message data (
whatsapp_business_messaging) — the content, sender/recipient phone number, timestamp and delivery status of messages sent or received through your connected number. - Access tokens — issued by Meta so we can call the Graph API on your behalf.
- Technical logs — sign-in events and API activity, used for security and troubleshooting.
2. How we use it
- To authenticate you and keep your account secure.
- To send and receive WhatsApp messages that you or your customers initiate.
- To display your phone numbers, templates and conversation history in the console.
- To diagnose faults, prevent abuse and meet legal obligations.
We do not sell personal data, use it for advertising, or use message content to train models.
3. Legal basis and consent
We process business contact data to perform our contract with you. You are responsible for obtaining opt-in consent from the customers you message on WhatsApp, as required by the WhatsApp Business Messaging Policy.
4. Sharing
We share data only with:
- Meta Platforms, Inc. — necessarily, to deliver and receive WhatsApp messages (see the WhatsApp Business Data Transfer Addendum);
- Our hosting provider — which stores the database on our behalf under a data processing agreement;
- Authorities — where we are legally required to do so.
5. Retention
- Message records: 90 days, then deleted automatically.
- Access tokens: until you disconnect the account or the token expires, whichever is first.
- Account and audit records: for the life of the account plus 12 months.
6. Security
Passwords are stored only as salted hashes. Traffic is served over HTTPS. Webhook deliveries are verified using
the X-Hub-Signature-256 header and our app secret. Access to production data is limited to
personnel who need it.
7. Your rights
You may request access to, correction of, or deletion of your personal data, and you may object to or restrict processing. Write to support@hkinfoway.com and we will respond within 30 days. To delete data obtained through Facebook Login, see our Data Deletion Instructions.
8. Children
The Service is for business use and is not directed to anyone under 18.
9. International transfers
Data may be processed in countries other than your own. Where required, we rely on Standard Contractual Clauses or an equivalent transfer mechanism.
10. Changes and contact
We will post any changes on this page and update the date above. Questions: HK Infoway Technologies, support@hkinfoway.com.