1. What kirim.dev Is, and Why That Shapes This Policy
kirim.dev is an API platform for Meta's WhatsApp Cloud API. You call our API with your own code; we forward your requests to Meta byte for byte and pass Meta's responses back unchanged. We are infrastructure — not an inbox, a broadcast tool, or a CRM. We do not have an app you log in to read your chats.
Because of that design, we hold far less of your data than a typical messaging product. This policy describes exactly what we store, for how long, and what merely passes through us. What happens to your data once it reaches Meta is governed by Meta's / WhatsApp's own policies and is outside kirim.dev's control.
2. Information We Store
2.1 Account information
- Your name, email address, and password (hashed with argon2id, never stored in the clear)
- The WhatsApp numbers, WABA IDs, and phone number IDs you connect
- Your Meta credentials — access token, app secret, and webhook verify token — encrypted at rest with AES-256-GCM and cryptographically bound to their database row. These never appear in your code or in our logs.
- Your kirim.dev API keys, stored only as an HMAC-SHA256 hash — never in the clear. The full key is shown once, at creation.
- Your webhook endpoint URLs and their signing secrets (secrets encrypted at rest)
- Billing information, handled by our third-party payment provider (we do not store card numbers)
2.2 Inbound message content — stored temporarily so we can deliver it
When Meta sends a webhook to us for an event on one of your numbers (an inbound message, or a delivery/read status), we must hold that event until we have successfully delivered it to your webhook endpoint and retried if delivery failed. During that window we store Meta's raw webhook payload — which, for an inbound message, includes the message content, the sender's phone number, and message identifiers.
- These payloads are retained for 7 days by default, then permanently deleted by dropping the day's storage partition. You can lower this to 24 hours in your settings. The maximum is 7 days.
- One copy is stored per webhook endpoint the event fans out to, so retries and dashboard replay can work independently per endpoint.
- We do not read this content. It is stored for delivery, retry, and the delivery-history/replay feature — nothing else.
2.3 Access logs — metadata only, no bodies
For each request you send through the API, we record metadata so you can see what happened: the HTTP method, the route kind (not the raw path, which would carry a phone number ID), the API version, the response status, Meta's upstream status and any upstream error code, how long the call took, how long Meta took, and the caller's IP address. Request and response bodies are deliberately not stored here. Access logs are retained for7 days (or 24 hours if you lower your retention setting), then deleted.
3. Information We Do NOT Store
- Outbound message content. Messages, media, and template calls you send to Meta through kirim.dev are streamed straight through. Only the metadata in section 2.3 is recorded — never the body.
- Coexistence history and contacts. When you connect a coexistence number, Meta may forward up to 180 days of prior chat history and your contact book to your webhook endpoint. kirim.dev forwards this to your endpoint and keeps none of it — the payload is not written to our storage. If you have no endpoint configured, that data arrives and is discarded.
- Your chats as a readable inbox. There is no conversation store, no search, no message archive.
- Marketing tracking. We do not set advertising or cross-site tracking cookies, and we do not build an attribution profile of how you found us.
4. What We Keep in Redis
We use Redis only for two short-lived, self-expiring things: a cache of your API key's hash (to verify keys without a database round trip on every request) and rate-limit counters. No message content and no webhook payloads are ever stored in Redis.
5. How We Use Information
- To forward your requests to Meta and deliver Meta's webhooks to your endpoints
- To authenticate your API keys and enforce per-number rate limits
- To show you access logs and webhook delivery history
- To send account, billing, and service notifications
- To detect and prevent abuse of the API and of our infrastructure
- To answer your support requests
We do not sell your data, and we do not use your message content to train AI models or for advertising.
6. Sharing with Third Parties
Data is shared only with the parties needed to run the service:
- Meta / WhatsApp — every message you send is forwarded to Meta's Cloud API; once it reaches Meta, its content is also subject to Meta's privacy policy.
- Your own webhook endpoints — inbound events are delivered to the URLs you configure.
- Payment provider — to process your subscription.
- Infrastructure providers — hosting, database, and Redis.
- Email provider — for transactional email (verification, password reset).
6.1 Delivery to Your Endpoints Is Outside Our Control
Once we deliver an inbound event to your webhook endpoint, what your systems do with it — including how long you keep it — is your responsibility, not ours. Our 7-day (or 24-hour) retention applies only to the copy we hold for delivery and replay.
6.2 International Transfers
Some providers above process data across borders. In particular, Meta / WhatsApp (United States) processes message content and phone numbers as a core part of the WhatsApp Cloud API. By using kirim.dev, you understand that personal data may be transferred and processed across borders as necessary to run the service. Where required, such transfers rely on appropriate safeguards (for example, the European Commission's Standard Contractual Clauses).
7. Security
- Meta credentials encrypted at rest with AES-256-GCM, bound to their row
- API keys verified by HMAC-SHA256, never stored in the clear
- Passwords hashed with argon2id
- Every inbound webhook verified against Meta's signature before it is accepted
- Deliveries to your endpoints signed with a Standard Webhooks signature so you can verify them
- Rate limiting, and database access on a least-privilege basis
No system is completely immune; we protect your data with practices reasonable for the industry, but cannot guarantee absolute security.
8. Your Rights
Subject to applicable data-protection law (including, where it applies to you, the EU/UK General Data Protection Regulation), you may access, correct, export, or delete your personal data, object to or restrict certain processing, withdraw consent where processing relies on it, and lodge a complaint with your local data-protection authority. You can update your profile and delete your account from the dashboard. For any other request, contactprivacy@kirim.dev; we will respond within a reasonable time as required by law.
Because we retain so little, most of your data expires on its own within 7 days. Deleting your account removes your account information; stored webhook payloads and access logs age out on their retention schedule.
9. Data on Meta's Side
Every message you send ultimately passes through Meta's infrastructure. How Meta stores and processes that data is governed by Meta's and WhatsApp's policies, not this one. Refer to the WhatsApp Business privacy policy for details.
10. Changes to This Policy
We may update this policy from time to time and will notify you of significant changes by email or in the dashboard.
11. Contact
Privacy questions: privacy@kirim.dev.