Skip to content
BitByteCore ConnectBook a demo
Open the product menu
ProductSolutionsPricingHow it worksFAQCompany

Guide · Privacy · For the owner a customer just asked

Who can read your WhatsApp business messages once a system is connected, and how long Meta keeps them: Meta's own privacy page in plain language

WhatsApp's promise to ordinary users is that nobody in between can read the chat. The moment a business connects its number to a system, an owner is right to ask whether that promise still holds, who can see what, and for how long Meta keeps it. Meta publishes a privacy page for the Cloud API that answers those questions directly. Here is what it says, and what it means for a business in the UAE or Pakistan explaining itself to a customer.

Published 1 October 2026 · Updated 6 October 2026

Who the message passes through

Meta's page describes the path plainly. When a customer messages a business that uses the Cloud API, the message travels encrypted through WhatsApp to the Cloud API, which Meta operates. The Cloud API decrypts it and forwards it to the business's system. When the business replies, the reverse happens: the Cloud API encrypts the reply with the Signal protocol, the same scheme personal WhatsApp uses, and sends it to the customer through WhatsApp. In Meta's words, the Cloud API acts on behalf of the business, and the business has designated it to do so.

So the honest answer to a customer is this: the chat is encrypted between their phone and Meta, and between Meta and your system, and Meta holds the keys on your behalf. It is not a case of a random third party reading along, but it is also not the phone-to-phone arrangement a personal chat has. Meta's page says the Cloud API uses the messages it handles only on the business's instruction, and that it does not automatically use WhatsApp messages to decide which ads a person sees.

Your own system is the other party

Meta's page covers Meta's side. Whatever system the business connects, ours or anyone else's, receives the decrypted messages and stores them under its own terms. An owner choosing a provider should ask the same questions of the provider that Meta answers here: where is it stored, who can see it, how long is it kept. Our own answers are in our privacy policy.

What Meta keeps, and for how long

Business data
Meta and Meta Business Suite keep information about the business itself, such as its business phone numbers and address, under Meta's terms of service. This is the profile and account information, not the chats.
Message data: 30 days at most
Meta's page says messages are retained for a maximum of 30 days, and only to provide the basic service, giving retransmission as the example. Messages at rest are encrypted.
Account data after you leave: up to 90 days
WhatsApp's terms for the Platform say that when the agreement ends, it keeps data associated with the business's account for up to 90 days, and copies may stay in disaster-recovery backups for a limited time after that.
Customer identifiers: 30 days after the last status
The Cloud API uses identifiers to route messages. Meta says it deletes them within 30 days of the last status update on a message, that is the last sent, delivered or read notice, unless the business directs otherwise.

For the chats themselves, thirty days is the figure to remember. The long-term record of a customer conversation lives in the business's own system, not at Meta, which is also why the conversation history is listed among the things the business owns in the account split guide.

Where the servers are, and the paperwork behind them

Meta's page says the Cloud API processes messages in Meta's own data centres. A business that chooses the Cloud API Local Storage option has its message data stored in a data centre in a designated country instead; the setup choice is covered in the registration and local storage guide. On compliance, Meta states that it has obtained SOC 2 Type II and ISO 27001 reports, that it complies with applicable data-protection law, and that where the law uses the terms, it acts as a data processor or service provider for the business. It adds, pointedly, that Cloud API customers must meet their own obligations under laws such as the European GDPR, and that transfers from the EU or UK to the US rely on GDPR-compliant mechanisms set out in its hosting terms.

For a business in the Gulf or Pakistan the practical reading is the same: Meta documents its side and leaves the business responsible for its own. A short line in your own privacy notice saying that WhatsApp conversations are handled through Meta's Cloud API and stored in your customer system is more honest than silence, and easy to write from this page.

WhatsApp's own terms for the Platform, which every business accepts, turn that into a duty. They say it is the business's sole responsibility to work out its legal obligations, that it must give customers all the data notices it needs to, such as a privacy policy and marking marketing messages as marketing, and that it must honour every request to stop some or all of its messages. They also say the information WhatsApp holds about the business's own account, such as registration, usage and support details, may be shared with Meta and transferred to the United States and other countries.

Two shorter WhatsApp documents set out its side. Its Data Processing Terms, last updated on 22 August 2025, apply where its business terms say WhatsApp handles customers' personal information as the business's processor. In them WhatsApp says it handles that information only on the business's instructions, binds the people who handle it to confidentiality, tells the business without undue delay when it discovers a breach, helps where it can with customers' requests about their data, may pass work to other Meta companies and third parties, possibly in other countries, under written terms no less strict, and deletes the information when the business terms end, unless the law requires it to be kept. Its Data Security Terms, dated 29 October 2020, list the minimum it maintains: logged and watched access to its data centres, security training, confidentiality and, where the law allows, background checks for staff who can reach the data, regular security testing, multi-factor sign-in for remote access, protection for data crossing public networks, and a plan for handling security incidents.

Questions

A customer asked if our WhatsApp is still end-to-end encrypted. What do we say?

Say that messages are encrypted between their phone and Meta, and between Meta and your system, using the same Signal protocol as personal WhatsApp, and that Meta manages the keys on the business's behalf. Meta's page describes exactly that arrangement. It is not the phone-to-phone model of a personal chat, and it is better to say so than to claim otherwise.

Does Meta read our customer chats to target ads?

Meta's page says the Cloud API will not automatically use WhatsApp messages to inform the ads a person sees, and that it uses messages only on the business's instruction. The same page notes that a business may use the messages it receives for its own marketing, which is a decision for you, not Meta.

If we delete a conversation in our system, is it gone from Meta too?

Meta keeps message data for a maximum of 30 days for retransmission and deletes customer identifiers within 30 days of the last status on a message. After that window, the only copy is whatever your own system kept.

What do Meta's terms require us to tell customers?

WhatsApp's terms for the Platform say the business must give all necessary data notices, such as keeping a privacy policy and labelling marketing messages, must honour every request to stop some or all messages, and alone is responsible for working out which laws apply to it.

What happens if WhatsApp has a breach affecting our customers' data?

WhatsApp's Data Processing Terms say that, where it handles customers' personal information as the business's processor, it will tell the business without undue delay once it discovers a breach and give reasonable help with the business's own obligations.

Can we keep the data inside our country?

Meta's page says the Cloud API Local Storage option stores message data in a data centre in a designated country rather than Meta's default locations. Whether your country is among the designated ones is a question for the setup, not something this page lists.

Sources

More plain-language notes like this one are on the guides page.

Want a straight answer ready when a customer asks who reads the chat?

We set up a business's WhatsApp number on a proper system and tell the owner, in writing, where the conversations are stored, who on the team can see them and how long they are kept, so the business can answer a customer's privacy question the same day. A short call is the easiest way to see whether it fits your business.

Book a demo