MyZapz

Privacy policy

Last updated 27 October 2026

1. Introduction

This Privacy Policy explains how MyZapz ("MyZapz", "we", "us") collects, uses, processes and protects data when a business uses the MyZapz connector (the "Service") to connect its software to the WhatsApp Business Platform provided by Meta Platforms, Inc. ("Meta"). It applies to the businesses that connect to the Service and to the end customers who exchange WhatsApp messages with those businesses.

We process personal data in line with the Personal Data Protection Act 2010 of Malaysia, the Meta Platform Terms, the Meta Developer Policies and the WhatsApp Business Terms of Service.

2. Our role

MyZapz is a technical connector. For messages and contact details exchanged between a business and its customers, the business is the data controller (in PDPA terms, the data user) and MyZapz acts only on the business's instructions as a data processor. For the account and connection data we need to run the Service, MyZapz is the controller.

3. Data we access

We access the following data only after a business authorises the Service through Meta's Embedded Signup:

From Meta, about the business

  • Business Portfolio ID, WhatsApp Business Account ID and name
  • Phone number IDs, display phone numbers, verified names and quality ratings
  • Message template names, content and approval status
  • The access token issued by Meta to act on the business's behalf

Message data passing through the connector

  • The end customer's WhatsApp phone number and profile name
  • Message content (text, media links, locations, button replies) sent or received by the business
  • Message metadata: message IDs, timestamps, and sent, delivered, read and failed statuses

Operational data

  • Technical logs (request times, error codes, IP addresses of calling systems) used to keep the Service running and secure

We do not access a business's Facebook Pages, ad accounts, personal Facebook profile, contact list on the phone, or any data outside the WhatsApp Business Account the business connected.

4. How we use data

Data is used only to:

  • Deliver messages sent by the business to its customers through the WhatsApp Cloud API
  • Forward incoming messages and status events from Meta to the business's software
  • Submit and track message templates on the business's request
  • Detect and prevent abuse, spam and security incidents
  • Meet our legal obligations

Data is never used for advertising, profiling, resale, or analytics beyond operating the Service. We do not read the content of messages except where needed to investigate a technical fault reported by the business or a suspected breach of Meta's policies.

5. Data sharing

We do not sell, rent or trade personal data. We share data only:

  • With Meta, to send and receive WhatsApp messages
  • With the partner software the business chose to connect through, so the business can see and reply to its conversations
  • With infrastructure providers (hosting, databases, encrypted storage) bound by confidentiality and data processing terms
  • With authorities when required by law, after checking the request is lawful

6. Meta Platform data

  • We use data received from Meta only as permitted by the Meta Platform Terms and Developer Policies, and only for the purposes in section 4.
  • We do not use Meta Platform data to build user profiles, to target advertising, or to train generalised AI or machine learning models.
  • We do not transfer Meta Platform data to data brokers or any party outside those listed in section 5.
  • We delete Meta Platform data when it is no longer needed, when the business disconnects, or when Meta or the business asks us to.

7. Storage and security

Data is encrypted in transit (TLS) and at rest. Access tokens are stored encrypted and are never shown in our logs. Staff access is limited to people who need it to run the Service. We verify the signature on every webhook Meta sends us. We store only the minimum data required for the Service to work.

Our servers may be located outside Malaysia. Where data is transferred abroad, we make sure it receives a level of protection comparable to that required under Malaysian law.

8. Data retention

  • Message content is held only as long as needed to deliver it to the business's software, and no longer than 30 days.
  • Message metadata and technical logs are kept for up to 90 days for troubleshooting and security.
  • Account and connection data is kept while the business remains connected.
  • When a business disconnects or its account ends, its data is deleted or anonymised within 30 days, unless the law requires us to keep it longer.

9. Your rights

You have the right to:

  • Ask what personal data we hold about you and ask for a copy
  • Ask us to correct inaccurate data
  • Ask us to delete your data (see Data deletion)
  • Revoke the Service's access to your WhatsApp Business Account at any time in Meta Business Settings
  • Withdraw consent and stop receiving messages from a business by replying STOP or blocking it in WhatsApp

If you are an end customer of a business, we may pass your request to that business, since it controls your conversation data. We respond to all requests within 21 days.

10. Children

The Service is for businesses and is not directed at children under 13. We do not knowingly collect data from children.

11. Disclaimer

MyZapz is a connector only. Each business is responsible for the data it sends through the Service, for getting its customers' opt-in before messaging them, and for its own compliance with privacy laws and Meta's policies.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. Continued use of the Service after a change means you accept the updated policy.

13. Contact

Questions about privacy or your data: support@myzapz.com.

By using MyZapz, you acknowledge that you have read and understood this Privacy Policy and the Terms of service.