Privacy Policy

Who we are

Birsend provides software that lets a business connect its own WhatsApp number and send messages to contacts who have agreed to hear from it. In this document, "we" and "Birsend" mean the company operating birsend.com, and "you" means the business using the service.

For the personal data you upload about your own contacts, you are the data controller and Birsend acts as your processor. For account and billing data, Birsend is the controller.

Data we collect

• Account data: name, work email, company name, password hash, and preferences.
• Billing data: plan, invoices, and the last four digits of your payment method. Full card details are held by our payment provider, never by us.
• Connection data: the phone number you connect, its session credentials, and the device metadata WhatsApp returns during pairing.
• Contact data you upload: names, phone numbers, and any custom fields you add for personalisation.
• Message data: the content you send, delivery and read receipts, and replies routed into your shared inbox.
• Usage data: pages visited in the dashboard, feature usage, IP address, and browser type.

Why we process it

We process data to deliver the service you asked for: pairing your number, queueing and sending your messages, collecting replies, and producing your reports. We also process it to bill you, to provide support, to detect abuse, and to meet legal obligations.

Where we rely on legitimate interests — for example fraud prevention and product analytics — we balance those interests against your rights and keep the processing to what is necessary.

Your responsibility for consent

You must have a lawful basis for messaging every contact you upload. Birsend does not obtain consent on your behalf. Uploading a purchased list, or messaging people who have not opted in, breaches these terms and WhatsApp's own policies, and puts your number at risk.

How long we keep data

• Contact lists and message history: for as long as your account is active, then 30 days after cancellation so you can export.
• Session credentials for a connected number: until you disconnect it, or 30 days after the last successful session.
• Invoices and tax records: as long as applicable law requires, typically ten years.
• Server and security logs: 90 days.

Who we share it with

We share data with the sub-processors needed to run the service: cloud hosting, error monitoring, email delivery, payment processing, and customer support tooling. Each is bound by a data processing agreement. We publish the current list on request.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Where your data lives

Contact lists and message history are stored encrypted at rest on servers within the European Union. Some sub-processors may process limited data outside the EU; where they do, transfers rely on Standard Contractual Clauses.

Your rights

Subject to applicable law, you can request access to your personal data, correction, deletion, a portable export, restriction of processing, or object to processing based on legitimate interests. You can also lodge a complaint with your supervisory authority.

• To exercise any of these, email [email protected]. We respond within 30 days.
• If your request concerns data a Birsend customer uploaded about you, we will forward it to that customer, who is the controller.

Security

We use encryption in transit and at rest, role-based access control, audited administrative access, and least-privilege service accounts. No system is perfectly secure; if a breach affects your data we notify you without undue delay.

Changes to this policy

We update this policy as the product changes. Material changes are announced by email and in the dashboard at least 14 days before they take effect. The date at the top always reflects the current version.