← Broadcast Hub

Privacy Policy

Last updated: July 2, 2026

1. Introduction

NazzilVideo ("we", "us", "our") operates Broadcast Hub (the "Service"), a WhatsApp messaging platform built on Meta's WhatsApp Cloud API. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the rights you have over it. It applies to businesses that use the Service to message their customers ("Customers") and to the individuals those messages reach ("Recipients").

2. Information We Collect

Information Customers provide

  • Account details: business name, email address, and login credentials (passwords are stored only as salted hashes).
  • WhatsApp Business Account credentials: phone number ID, WhatsApp Business Account (WABA) ID, Meta app ID, access token, and app secret, entered in Settings to connect the Service to Meta.
  • Contact lists: names, phone numbers, and optional attributes of Recipients that Customers upload or add, along with the Customer's confirmation that those Recipients opted in.

Messaging data

  • Message metadata received from Meta via webhook: message IDs, timestamps, delivery/read status, and recipient phone numbers.
  • Message content sent and received through the Service, stored to power the two-way inbox and campaign history.
  • Opt-out requests (e.g. a Recipient replying STOP), which we record and honor automatically.

Technical data

  • IP addresses and usage logs, including an audit trail of account actions.
  • Local preferences such as language and theme, stored in your browser via localStorage.
  • Details submitted through our public lead form (name, WhatsApp number, business name).

3. How We Use Information

  • To operate the Service: authenticate users, send WhatsApp template and session messages Customers initiate, and track delivery.
  • To receive and display inbound messages and delivery events from Meta.
  • To honor Recipient opt-outs across all future sends.
  • To maintain security, prevent abuse, and keep an audit trail of account actions.
  • To respond to inquiries submitted through the lead form.
  • To comply with legal obligations and Meta platform requirements.

4. Legal Bases (GDPR)

Where the GDPR or similar laws apply, we process personal data on these legal bases: (a) performance of our contract with the Customer; (b) consent, where required — Customers are responsible for collecting Recipient opt-in before messaging them; (c) our legitimate interests in operating and securing the Service; and (d) compliance with legal obligations.

5. How We Share Information

We do not sell personal data. We share information only with:

  • Meta / WhatsApp — as required to send messages and operate the WhatsApp Cloud API integration, under Meta's own terms.
  • Infrastructure providers — hosting, database, and queue vendors (currently Railway) that process data under our instructions.
  • Legal authorities — when required by law or to protect rights and safety.
  • Successors — in a merger, acquisition, or asset sale, with notice.

The Service is multi-tenant: each Customer's workspace is isolated, and one Customer's contacts, messages, and credentials are never visible to another.

6. Data Security

Transport is protected by TLS. Passwords are hashed with bcrypt. WhatsApp credentials are write-only in the interface once saved, and webhook deliveries are verified with HMAC signatures. Access to production systems is limited and role-based, and consequential account actions are recorded in an audit log. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

  • WhatsApp credentials are retained while the Customer's integration is active and deleted when the workspace is removed.
  • Contacts, messages, and campaign history are retained until the Customer deletes them or their workspace is removed.
  • Opt-out records are retained so that opted-out Recipients are never messaged again.
  • Audit logs are retained for accountability while the workspace exists.
  • Account records may be retained after closure where required for tax and legal compliance.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion of your data (see our Data Deletion Instructions).
  • Object to or restrict processing, and withdraw consent.
  • Lodge a complaint with your local data protection authority.

Recipients can stop receiving messages at any time by replying STOP; the opt-out is applied automatically. To exercise any other right, email abd.rabo.940@gmail.com.

9. International Transfers

Your data may be processed in countries other than the one in which you reside. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children's Privacy

The Service is not directed to children under 18 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated through the Service or by email.

12. Contact

Privacy inquiries: abd.rabo.940@gmail.com