Privacy Policy

1. Who we are

Messo is operated by Lifecycle Innovations Limited, a company incorporated in Hong Kong (Business Registration #76545088, registered office at 144-151 Connaught Road West, Unit 4005, 40/F, Hong Kong). We comply with applicable data-protection laws, including Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, the “PDPO”) and, for personal data relating to individuals in the EEA and the UK, the EU General Data Protection Regulation and the UK GDPR (together, “GDPR”).

For all privacy matters, contact [email protected].

2. Our roles: controller and processor

For message data — the content of messages you send through the API and the phone numbers of their recipients — you are the data controller (under the PDPO, the “data user”) and Messo is the data processor. You decide what is sent and to whom; we process that data only on your documented instructions (your API calls) and only to provide the service. Our Data Processing Agreement sets this out in detail and applies automatically when you use the service.

For account data — your own name, email, company details, and billing information — Messo is the controller (data user). This policy explains how we handle it.

3. What we process

• Account data: name, email, company name, billing details (payment data is held by Stripe; we do not see full card numbers), and support correspondence.
• API credentials: API keys (stored hashed — we cannot read them back) and webhook signing secrets.
• Session data: encrypted WhatsApp auth state for numbers you link (encrypted with pgcrypto; pairing metadata such as timestamps).
• Message content: bodies of messages you send via the API (text and media), and inbound message bodies delivered to your webhooks. This is delivery payload, not analytics: we do not mine, profile, or train models on message content.
• Message metadata: sender and recipient phone numbers, timestamps, delivery receipts, and error logs — used for delivery, billing, and abuse investigation.
• Operational logs: API request logs, pairing and session events, ban and repair events. Logs are scrubbed of message bodies and full phone numbers.

4. Purposes and legal bases

• Providing the service (transmitting and delivering your messages, operating queues, webhooks, and the console) — performance of our contract with you.
• Billing (metering usage, invoicing, tax records) — contract performance and legal obligation.
• Security and abuse prevention (detecting spam, fraud, and limit circumvention; protecting the service) — our legitimate interests, balanced against yours.
• Support and product improvement — legitimate interests; we use aggregated, de-identified data where possible.
• Legal compliance — obligations under Hong Kong law and other applicable laws.

Under the PDPO, we collect personal data only for lawful purposes directly related to our functions, and only what is adequate and not excessive for those purposes.

5. Sub-processors

We use the following sub-processors to provide the service. Each is bound by a written data-processing agreement:

• Render (Frankfurt, EU) — infrastructure hosting.
• Cloudflare — DNS, CDN, and edge caching.
• Clerk — authentication and account identity.
• Stripe — billing and payment processing (account and payment data only).
• Sentry — error monitoring, configured to scrub message bodies and phone numbers from error payloads.
• Transactional email provider — service emails such as receipts and alerts.

We notify you at least 30 days before adding or replacing a sub-processor that handles personal data. You may object in writing; if the change is essential to the service and you maintain your objection, you may cancel before it takes effect.

6. Where data lives and transfers

Customer data — including message content, metadata, and session state — is stored in the European Union (Render Frankfurt, eu-central-1). We do not move customer data to other regions for storage.

Our company operates from Hong Kong. For support, account management, and troubleshooting, our team may access account data and (where needed to resolve an issue) customer data from Hong Kong. These transfers rely on the European Commission's Standard Contractual Clauses (2021/914, Module 1 for account data and Module 2 for customer data), incorporated into our DPA, plus access controls and data-minimization measures.

Note that messages sent through Messo necessarily transit WhatsApp's infrastructure (operated by Meta) to reach recipients — see section 13.

7. Retention

• Message bodies: kept only for delivery, retries, and a short dispute window — 30 days — then deleted.
• Message metadata (timestamps, receipts): 12 months, for billing and abuse investigation.
• Session auth state: deleted when you unpair a number or delete your account.
• Operational logs: 90 days, scrubbed of message bodies and full phone numbers.
• Account data: for the life of your account, plus what the law requires afterwards — e.g. invoicing records, which Hong Kong tax law requires us to keep for 7 years.

On account deletion we delete your data within 30 days, except where law requires longer retention. Backups honor deletion requests within the same window. Under the PDPO, we do not keep personal data longer than necessary for the purpose it was collected for.

8. Your rights

Depending on where you are, you have rights over your personal data, including: access, correction/rectification, erasure, restriction of processing, data portability, objection to processing, and the right to lodge a complaint with your supervisory authority (in Hong Kong, the Privacy Commissioner for Personal Data; in the EEA, your national data-protection authority).

• You can export your messages and metadata, and delete projects and their data, directly from the console.
• For anything else, email [email protected]. We respond within 30 days (within statutory time limits in all cases).
• If you are in the EEA or UK and our processing relies on your consent, you may withdraw it at any time.

9. Message recipients

If you received a WhatsApp message sent through Messo, the sender — our customer — is the controller of your data, not us. To exercise your rights (for example, to ask for deletion or to object to further messages), contact the sender directly. If you contact us instead at [email protected], we will forward verified requests to the relevant customer and act on the copies we hold ourselves.

10. Security

• Encryption in transit (TLS) and at rest (including pgcrypto for session auth state).
• API keys stored hashed and never logged; per-endpoint webhook signing secrets.
• Tenant isolation: one customer's sessions, messages, and keys are never visible to another.
• Role-based access controls and MFA-protected admin access.
• Log scrubbing: no message bodies or full phone numbers in application logs or error reports.
• Encrypted backups with defined retention.

Under the PDPO we take all practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss, or use.

11. Breach notification

If we confirm a personal-data breach affecting customer data, we notify the affected customer without undue delay and within 72 hours, with the information reasonably needed for their own notification duties. Where the breach is likely to result in a real risk of harm, we also notify Hong Kong's Privacy Commissioner and affected individuals, in line with the Commissioner's guidance.

12. Cookies and tracking

The developer console uses only cookies strictly necessary for sign-in and security. We do not run advertising trackers or sell browsing data.

13. WhatsApp note

Messo links your WhatsApp number via the multi-device protocol (see our Terms of Service for the ban-risk disclosure). WhatsApp is operated by WhatsApp Ireland Limited; we are not affiliated with WhatsApp or Meta. Messages you send transit WhatsApp's systems and are subject to WhatsApp's own terms and privacy policy.

14. Changes

We may update this policy with at least 30 days' notice via email or console banner. Material changes give you the right to cancel before they take effect.

15. Contact

Lifecycle Innovations Limited
144-151 Connaught Road West, Unit 4005, 40/F, Hong Kong
BR# 76545088
[email protected]