Privacy Policy

Last updated: 20 August 2026

This Privacy Policy explains how Craft Technology ("we", the company operating Business App Numbers) collects, uses, and protects personal data when you use Business App Numbers (the "Service") at crafttech.net. We process data in accordance with applicable law, including the Turkish KVKK and, where applicable, the EU GDPR.

1. Who we are

The Service is operated by Craft Teknoloji Yatırımları Ticaret Limited Şirketi (Türkiye), registered at Halkalı Merkez Mah. Halkalı Cad. Tekno Park İdare Binası No: 281/23 İç Kapı No: 5, Küçükçekmece / İstanbul, Türkiye, trade registry no. 2150710178. Data controller contact: info@crafttech.net.

2. Data we receive

Account & workspace data

Name, email address, and workspace details you provide (company name, country, website, contact email), plus team membership and roles.

WhatsApp / Meta data

• WhatsApp identifiers — WhatsApp Business Account (WABA) id, phone number id, display phone number, and business portfolio id for the numbers you connect.
• Message data — the content and metadata of WhatsApp messages sent to and from your connected numbers, including messages your team sends from the WhatsApp Business App where Meta's Coexistence webhooks provide them.
• Contact data — the WhatsApp id (phone number) and profile name of people who message your business.
• Webhook events — delivery/read/failure status events and account/template updates delivered by Meta.
• Access tokens — the business access token issued during Embedded Signup, stored encrypted at rest and used only to call Meta on your behalf.

Billing data

Subscription and billing status. Payments are processed by Stripe; we never receive or store full card details.

Technical data

IP address, device/browser information, and application logs generated when you use the Service.

3. Why we process data

• To provide the Service — connecting your WhatsApp number and sending/receiving messages via Meta's official WhatsApp Business Platform.
• To operate your workspace, team, templates, and conversation history.
• To manage subscriptions and billing.
• To secure the Service, prevent abuse, and keep audit records.
• To comply with legal obligations.

4. Subprocessors

We share data only as needed with these processors:

• Meta Platforms — WhatsApp Business Platform messaging.
• Supabase — database, authentication and storage.
• Vercel — application hosting.
• Stripe — subscription billing and payments.
• Cloudflare — DNS and email routing.

We do not sell personal data.

5. International transfers

Our processors may store data outside your country. Where required, transfers rely on appropriate safeguards.

6. Retention

We retain data for as long as your workspace is active and as required to provide the Service or meet legal obligations. You can request deletion at any time (see below).

7. Your rights

Subject to applicable law, you may access, correct, delete, restrict, or object to the processing of your personal data, and request portability. Contact info@crafttech.net. See our Data Deletion page for the deletion process.

8. Security

We apply Row Level Security for tenant isolation, encrypt Meta access tokens at rest, verify webhook signatures, restrict secrets to the server, and keep audit logs. No system is perfectly secure, but we work to protect your data.

9. Changes

We may update this policy; the current version is always published here with its date.