Notifly

Privacy Policy

Last updated: 20 September 2026.

Who we are

Notifly is a WhatsApp Tech Provider operated by CSY SimplifAI Solution (“we”, “us”), SSM 202403215759 (SA0619658-W), to send order notifications and one-time passwords on behalf of Malaysian SME ecommerce clients. Registered address: Kuala Lumpur, Malaysia. Contact: csyeducat@gmail.com.

Meta permissions this service uses

When a client connects their WhatsApp Business Account through Embedded Signup, our Meta app requests Advanced Access to:

  • whatsapp_business_management — to identify the client’s WhatsApp Business Account (WABA), subscribe our app to that WABA, read the connected business phone number, and keep the connection healthy (including reconnect when a token is revoked).
  • whatsapp_business_messaging — to send template messages (order updates and OTPs) from the client’s phone number and to receive inbound replies and delivery status callbacks on that number.

Data we collect through those permissions

We collect only what is required to operate the connection:

  • WABA ID and business phone number ID returned by Embedded Signup.
  • Display phone number fetched from the Cloud API.
  • A customer-scoped business access token. The raw token is stored in Google Secret Manager, never in Firestore, never in logs, and never returned to a browser.
  • Inbound WhatsApp message content and metadata delivered to our webhook (for example text body, media type, and WhatsApp message ID).
  • Delivery statuses (sent, delivered, read, failed) and their timestamps.
  • The client name and slug we create in our admin console so we can attribute the WABA to the correct ecommerce deployment.

We do not collect Facebook profile data, friends lists, or data from WhatsApp accounts that have not completed Embedded Signup with us. We do not sell this data.

How the data is stored

Account records, inbound messages, and delivery statuses are stored in Google Cloud Firestore in project instavibe-6b42b, in the asia-southeast1 region. Firestore security rules deny all client-SDK access; only our servers (Firebase Admin SDK) can read or write these collections.

WhatsApp business tokens are stored as versioned secrets in Google Secret Manager in the same project. Firestore holds only the secret resource name, not the token.

Platform admin sign-in uses Firebase Authentication email/password, limited to an allowlist of operator accounts. Client staff may receive separate logins that reach only their own client portal, not the admin console for other clients.

Why we process this data

We process the data to send ecommerce notifications (order confirmation, fulfilment, and OTP) on the client’s WhatsApp Business number, to attribute inbound replies and delivery receipts to the correct client, and to reconnect an account when Meta revokes a token. Legal basis: performance of the service contract with the client, and our legitimate interest in operating a reliable messaging integration.

Retention

  • Connected-account records (WABA ID, phone number ID, display phone, secret name, status) are kept while the account is connected. Disconnecting in Notifly deletes that record immediately, destroys the stored token, and unsubscribes our app from the WABA.
  • Inbound message payloads and delivery statuses are kept for 90 days, then deleted. Disconnecting an account also deletes that WABA's stored messages and statuses.
  • Secret Manager token versions are destroyed when you disconnect or when a client requests deletion.

Sharing and subprocessors

We share WhatsApp data with Meta as required to send and receive Cloud API messages. Hosting and storage run on Google Cloud (Firebase App Hosting, Firestore, Secret Manager, Authentication). We do not share message content with other customers. We do not use this data for advertising.

How to request deletion

A client (or an end user whose WhatsApp messages were stored) can request deletion by emailing csyeducat@gmail.com from a mailbox we can match to the client, stating the WABA ID or business phone number. We will delete the Firestore account, message, and status documents and destroy the Secret Manager token within 30 days, and unsubscribe our app from the WABA where Meta still allows it.

You may disconnect the account in Notifly admin. That unsubscribes our app from the WABA, destroys the stored token, deletes the connected-account record, and we stop sending. You may also remove the app from Meta Business Settings.

Children

This service is for business customers. It is not directed at children under 18, and we do not knowingly collect WhatsApp data from children.

Changes

We will update this page when our data practices change and keep the “Last updated” date current. Material changes will also be emailed to connected clients.