Privacy Policy
Last updated 21 August 2026
DSS WhatsApp is operated by Dynamic Software Solution, Karachi, Pakistan (“we”). This policy explains what we collect, why, how long we keep it, and how to have it deleted. Questions go to faisal@dynamicsoft.biz.
We act in two different roles
We are the controller of your account data — what you give us to open and run an account.
We are a processor for the data you bring with you: your contacts, and the messages you exchange with them. That data is yours. We process it only to operate the service on your instructions. We do not sell it, we do not message your contacts on our own behalf, and we do not use it to train models.
What we collect
| Data | Why we hold it |
|---|---|
| Name, email address, password hash | To create your account and sign you in. Passwords are hashed and never stored in readable form. |
| Organization name, country, timezone | To keep your workspace separate from every other customer’s, and to schedule sends in your local time. |
| WhatsApp Business Account ID, phone number ID, access token | To send and receive messages for you. Access tokens are encrypted at rest with AES-256-GCM, are never shown again after connection, and are never written to logs. |
| Your contacts: phone number, name, email, and any custom fields you add | Uploaded by you, used to address and personalise your messages. |
| Message content, delivery status, and attached media | To show your inbox, retry failed sends, and report on delivery. |
| Audit records: who did what, when, from which IP address and browser | Security and dispute resolution. Covers sign-ins, token changes, member removals, billing changes, and any administrative access to your account. |
| Billing records: plan, invoices, payment status | To charge you correctly. Card details go straight to our payment provider — we never receive or store them. |
How long we keep it
- Raw webhook events — 90 days, then deleted. Held only so that messages lost to a processing fault can be replayed.
- Outbound webhook delivery logs — 30 days, then deleted.
- Messages and contacts — kept until you delete them or close your account. We do not automatically delete your business records.
- Audit records — retained while your account is open. Their value is precisely that they cannot be quietly removed.
- Backups — encrypted and kept on a rolling schedule. Deleted data disappears from backups as those age out.
Who else processes your data
We use a small number of providers to run the service. Each receives only what it needs.
- Meta Platforms — delivers every WhatsApp message. Their handling is governed by WhatsApp’s own terms and privacy policy.
- Our hosting provider in Karachi, Pakistan — runs the servers and database.
- Cloudflare — DNS and traffic protection.
- Object storage — stores message media.
- Backblaze B2 — encrypted off-site backups.
- Resend — sends account email such as verification and invitations.
- Our payment provider — handles checkout, cards and invoices.
- Error and product analytics tooling — helps us find faults and understand how the product is used.
Your data is stored primarily in Pakistan. Several providers above operate internationally, so some processing happens outside Pakistan.
Your rights
You can access, correct, export or delete your data at any time. Contacts and messages can be exported from within the app. Account deletion is described on our data deletion page. Where GDPR or a similar law applies to you, you also have the right to object to processing, to restrict it, and to complain to your supervisory authority.
If a business messaged you through this platform
The business controls your data, not us — ask them directly to remove it. If they do not respond, contact us and we will pass the request on and act on it ourselves where the law requires.
Security
Traffic is encrypted in transit and WhatsApp access tokens are encrypted at rest. Access to production data is limited to those who need it, and administrative access to a customer account is recorded in the audit log. No system is perfectly secure; if a breach affects you we will tell you promptly.
Changes to this policy
Any change is posted here with the date above updated. Material changes are emailed to account owners.