How Relay handles WhatsApp data

This page describes, in plain language, how Relay receives, transmits, stores, restricts access to, retains and deletes data obtained through the WhatsApp Business Platform (Cloud API). It is intended for Meta App Review and for anyone who wants to understand how WhatsApp/Meta data flows through the Service.

When a customer connects their WhatsApp Business number, Relay receives, via Meta’s Cloud API webhooks, the following data:

• Inbound messages sent to the business (text, media and interactive replies).
• The sender’s phone number and WhatsApp profile name.
• Delivery and read status of outbound messages.
• Message template review/status updates.

We request only the permissions needed to operate a WhatsApp business inbox and CRM (e.g. whatsapp_business_messaging and whatsapp_business_management) and use the data solely to provide the Service to the connecting business.

All communication with the Meta Cloud API occurs server-side over HTTPS/TLS. Inbound webhooks are delivered to a single endpoint that verifies Meta’s HMAC-SHA256 signature (using our app secret) before any payload is processed, so unsigned or tampered requests are rejected. Access tokens used to call the Cloud API are never exposed to the browser.

Data is stored in a managed Supabase Postgres database. Every table enforces row-level security (RLS) so that records are strictly scoped to the owning account and cannot be read across tenants. WhatsApp access tokens are encrypted at rest using AES-256-GCM before being written to the database; the encryption key is held only in server-side configuration.

Only members of the account that owns the WhatsApp connection can access its messages and contacts, and only according to their role (owner, admin, agent or viewer). Access is enforced at the database layer by RLS, not merely in the UI. Relay personnel do not access customer message content except where strictly necessary for support or security and where permitted by our agreements.

Data is retained for as long as the account is active and needs it to operate the inbox and CRM. Account members can export their data and delete contacts, conversations or the entire account from within the product; deletion removes the associated records from the primary database within a commercially reasonable period, subject to limited legal retention requirements.

The third parties that may process this data on our behalf are:

• Supabase — Managed Postgres database, authentication and file storage — the primary system of record. (United States / EU).
• Meta Platforms (WhatsApp Business Cloud API) — Sending and receiving WhatsApp messages on your behalf via the official WhatsApp Business Platform. (United States / global).
• Stripe — Subscription billing and payment processing. (United States).
• Email delivery provider — Transactional email (invitations, notifications, password resets). (United States / EU).
• AI model providers (bring-your-own — e.g. OpenAI, Anthropic) — Generating reply drafts and running the optional AI assistant, using an API key you supply. Only engaged when you enable AI features. (United States).