WhatsApp integration privacy
Last updated: October 20, 2026
This page explains what happens to WhatsApp data when an organization connects WhatsApp to Flikk, and it adds to our main Privacy Policy.
What we receive from Meta
- An access token for the WhatsApp Business account the organization connects, with the
whatsapp_business_messagingandwhatsapp_business_managementpermissions - The phone number ID the organization sends messages from
- Incoming messages and status updates that Meta delivers to our webhook, which include the sender's phone number, their WhatsApp profile name and the message content
- Answers people give in WhatsApp Flows built from Flikk forms
What we use it for
We use this data only to run the flows the organization builds, such as sending a message, starting a flow when a message arrives, or saving answers from a WhatsApp Flow, and we never sell it, use it for advertising or share it with anyone except the services the organization's own flows send it to, including AI providers.
We handle data about the people who message an organization's account only on that organization's behalf, and we follow the Meta Platform Terms for all data we receive from Meta.
AI agents
An organization can build flows where an AI model reads incoming WhatsApp messages and writes replies, and in that case:
- The message content and the sender's profile name are sent to the AI provider the organization picks, which is OpenAI, Anthropic, Google or OpenRouter, using the organization's own account with that provider
- That provider handles the data under its own terms with the organization, and Flikk has no say over how it stores it
- Flikk itself never uses WhatsApp data to train AI models
- Replies an AI model writes are stored in the flow run like any other step, and they can be deleted the same way
What we store and where
- Access tokens and app secrets are encrypted with AES-GCM before they are stored, in our database and in our flow engine, both run by our hosting providers
- Each flow run keeps the event that started it and what each step returned, which can include phone numbers, profile names and message content
- Answers from WhatsApp Flows are stored as form submissions
- Flows that are paused, for example while waiting for a reply, keep their working data encrypted until they continue
How long we keep it
We keep this data until the organization deletes it, and nothing expires on its own today.
Who can see it
Members of the organization that connected WhatsApp can see its flow runs and form submissions, within the permissions their team gives them, and Flikk staff access it only when needed for support or security.
How to delete it
- Delete a single flow run through the Flikk API, which removes everything that run stored
- Disconnect WhatsApp in Flikk, which deletes the stored token
- Delete the organization, which deletes all of its runs, form submissions, tokens and paused flows
- Remove Flikk from your Meta Business settings, which tells us to delete the tokens connected to your account
- Email privacy@flikk.dev and we will delete your data within 30 days
Every way to delete your data is listed on our data deletion page.
Contact
For questions about this page, email privacy@flikk.dev.