Zum Inhalt springen
ASKO.CLOUDDocs

Privacy Policy

Last updated: 26 October 2026

This policy explains how personal data is processed when operating Asko.Cloud Coexistence (the “Service”), a platform that connects existing WhatsApp Business numbers to the systems of our business customers via Meta’s official WhatsApp Business Platform (Cloud API). The German version (Datenschutzerklärung) is legally binding; this translation is provided for convenience.

1. Controller

Kay Probst, Asko.Cloud, Münchner Straße 135C, 85774 Unterföhring, Germany. Email: [email protected]. A data protection officer is not legally required and has not been appointed.

2. Overview

  • Visitors of this website – technical access data (section 3).
  • People connecting a WhatsApp number through Meta’s login dialog (“Facebook Login for Business” / “Embedded Signup”) – section 5.
  • Business customers and their contacts – contract and contact data (section 7).
  • People who message our business customers on WhatsApp – processed solely on behalf of the respective business (section 6).

We do not use analytics, tracking or advertising services and we do not sell data.

3. Website access, server logs and security

When you access the website the server processes technically necessary data: IP address, date and time, requested URL, referrer, browser and operating system. The purposes are delivering the website, stability and abuse prevention (e.g. limiting repeated login attempts); legal basis Art. 6(1)(f) GDPR. Abuse-prevention counters containing an IP address are deleted after 24 hours at the latest; server logs are kept only briefly for troubleshooting and deleted after 30 days at the latest.

The Service runs on server infrastructure operated or rented by us. Where an external hosting provider is used, it acts solely as our processor under Art. 28 GDPR. All connections use TLS; access tokens and secrets are additionally encrypted at rest with AES-256-GCM.

4. Cookies

We only use strictly necessary cookies (§ 25(2) no. 2 TDDDG): a session cookie for our administrators and a session cookie during the number connection flow, which is deleted on completion or when the connect link expires. No consent is required.

5. Connecting a WhatsApp number (Meta Embedded Signup)

Using a personal connect link, a person acting for a business can connect the business’s WhatsApp number. Only after you actively choose to load the Meta login on the connect page, Meta’s JavaScript SDK (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) is loaded and Meta’s dialog opens; your browser then transmits data such as your IP address to Meta. Meta processes the login under its own responsibility, see Meta’s Privacy Policy.

After the dialog we receive and store: a one-time authorization code that we immediately exchange for an access token to the shared WhatsApp Business Account (stored encrypted); the IDs of the WhatsApp Business Account, phone number and business portfolio; the display number, verified name, quality and status information; and the app-scoped user ID of the Facebook account used. We do not receive your name, email address or profile data. Purpose: providing the API connection to the business; legal basis Art. 6(1)(b) and (f) GDPR. The data is kept while the number is connected or the contract with the business exists. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

6. WhatsApp messages and events (processing on behalf of businesses)

For connected numbers, Meta sends events to our server: incoming messages, delivery and read receipts, copies of messages the business sends from the WhatsApp Business App and – once after connecting and only if the business starts it – contacts and up to six months of chat history. We forward these events to the endpoints defined by the business and pass messages the business sends through our API on to Meta. Media is only retrieved from Meta and streamed through on request of the business.

  • Message content is not stored permanently and not analysed by us.
  • Until it has been delivered to the business’s system, an event is held encrypted (AES-256-GCM) and deleted immediately afterwards. If the system is unreachable, encrypted content is deleted after 72 hours at the latest.
  • Delivery metadata without content (time, event type, technical number ID, HTTP status) is kept for 30 days for troubleshooting.

For this processing the respective business is the controller and we act as its processor under Art. 28 GDPR. If you communicate with a business via WhatsApp, please contact that business regarding your rights.

7. Business customers, API access and logs

We process contact and contract data of business customers for performance of the contract (Art. 6(1)(b) GDPR) and statutory retention (Art. 6(1)(c) GDPR). API keys and OAuth tokens are stored as cryptographic hashes only. Security relevant actions are logged with time and IP address for 365 days (Art. 6(1)(f) GDPR).

8. Recipients

Meta Platforms Ireland Limited / WhatsApp Ireland Limited as provider of the WhatsApp Business Platform; the recipient systems defined by our business customers; our hosting provider as processor, if any.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and may withdraw consent at any time. Contact [email protected]. You may lodge a complaint with a supervisory authority; ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

10. Data deletion

How to disconnect and request deletion is described on Data deletion. If you remove our app in your Facebook settings, our system deletes the stored user ID automatically.