M Makutano Connect

Privacy Policy

Last updated 6 October 2026

1. Two kinds of data

Account data is about you as our customer: your name, email, business details and how you use the portal. We are the controller of that data. Business data is what you hold about your own customers — their contact details, the messages you send them and the messages they send you. You control that; we process it on your behalf and only to run the service for you.

2. What we collect

  • Account: full name, work email, business name, industry, country, business phone and optional website.
  • Security: a hash of your password (never the password itself), session records, and a hash of your IP address for rate limiting and abuse detection.
  • Business data: your contacts' names and contact details, WhatsApp message history and delivery statuses, notes your systems record against a contact, and the message templates you create.
  • Operational: request logs, audit records of significant actions, and usage counters used to apply plan limits.

3. What we do not collect

  • We do not store your password in a readable form.
  • We do not store card numbers. Payments are handled by the payment provider you connect.
  • We do not put access tokens, API secrets or verification tokens into audit logs.
  • We do not sell your data or your customers' data, and we do not use it to train models.

4. Why we process it

  • To provide the service you signed up for (performance of a contract).
  • To keep the service secure and prevent abuse (legitimate interests).
  • To bill you and keep accounting records (legal obligation).
  • To send service messages such as email verification and account notices.

5. Who else is involved

  • Meta Platforms — WhatsApp message delivery, if you connect a number.
  • Our hosting and database providers — to run the service and store your data.
  • Our email provider — to deliver verification and notification emails.
  • Your payment provider — if you enable payments.

We share only what each provider needs, and we do not give any of them the right to use your data for their own purposes.

6. Facebook Login and WhatsApp

We use Facebook Login for one purpose: so that you can connect your own WhatsApp Business account to Makutano Connect. We do not use it to sign you in — your account here has its own email and password — and we never post to Facebook on your behalf.

  • public_profile — the baseline permission Meta requires before a Facebook Login dialog can open at all. We do not read or store your name, profile picture, friends or posts.
  • whatsapp_business_messaging — to send and receive messages on the number you select.
  • whatsapp_business_management — to register that number, subscribe to its webhooks, and manage its message templates.
  • business_management — called once per connection, to read the name of the business that owns the WhatsApp Business Account you selected, so you can confirm you connected the right one.

From that connection we store only: an access token for your WhatsApp Business Account, encrypted with AES-256-GCM and never exposed to a browser; the identifiers of your WhatsApp Business Account and phone number; and, where Meta supplies it, the Facebook user ID of the person who authorised the connection — used solely to match Meta's deauthorisation notice to the right account. You can end this at any time in Settings → WhatsApp → Disconnect, or by removing the app in your Facebook settings; both overwrite the stored token immediately. See Deleting your data.

7. Isolation between customers

Every record in the system carries the account it belongs to, and every query is scoped to the account of the authenticated caller. An API key can only ever read and write its own account's data. This is enforced in the service itself, not by convention.

8. How long we keep it

  • Business data: for as long as your account is open, and then only as long as the law requires.
  • Sessions: 30 days, or until you sign out.
  • Email verification and reset tokens: hours, and they are single-use.
  • Audit logs: retained as a security record.

9. Your rights

You can access, correct, export or delete your account data — email support@makutano.co.tz and we will respond within 30 days. If one of your own customers asks you to delete their data, you can do that yourself in the portal or through the API.

10. Your customers' consent

You are responsible for having permission to message the people you contact through the service, and for telling them how you use their data. The service records opt-outs and enforces them on every send.

11. Changes

We will notify you by email or in the portal before any material change to this policy takes effect.

Questions about this page? Email support@makutano.co.tz.