Legal
Last updated: 22 September 2026
Wasl.io ("Wasl", "we", "us") is operated by Creative Advanced Technologies (creativeadvtech.com), Dubai, United Arab Emirates. Wasl provides a platform that lets businesses ("Customers") send one-time passcodes and verification messages to their users over WhatsApp and other channels through Meta's official WhatsApp Business Platform. This policy explains what data we collect, why, how long we keep it, and how you can have it deleted.
If you received a verification message from a business that uses Wasl, that business is the controller of your data. Wasl processes it on their behalf. Contact that business first; we will help them fulfil your request.
Account data. When a Customer signs up we store their name, email address, password hash, organisation name, and the roles of the people they invite.
WhatsApp Business Account data. When a Customer connects WhatsApp through Meta's Embedded Signup, we receive and store their WhatsApp Business Account ID, Business ID, the phone numbers registered on that account, the message templates on that account, and an access token issued by Meta. The access token is stored encrypted at rest and is used only to send messages and read message status on the Customer's behalf.
Message data. For each verification message sent we store the recipient's phone number, the channel used, delivery status, timestamps, Meta's message ID, any error returned by Meta, and the request ID supplied by the Customer. The one-time code itself is stored so the Customer can verify it, is hidden from all interfaces, and is discarded once the message record is purged.
API and billing data. API keys created by Customers (stored hashed), usage counts, message charges, credit transactions, and subscription plan information.
Technical data. IP address, browser type, and server logs needed to run and secure the service.
We do not sell data. We do not use message content or recipient phone numbers for advertising, profiling, or any purpose other than delivering the Customer's message and reporting on it.
Wasl uses Facebook Login for Business and the WhatsApp Business Platform. Data we receive from Meta (business IDs, WhatsApp Business Account IDs, phone number IDs, templates, access tokens, and message status webhooks) is used solely to operate the WhatsApp integration for the Customer who granted access. We handle this data in line with the Meta Platform Terms and Developer Policies. Access tokens are never shared with third parties.
All traffic is encrypted in transit with TLS. Access tokens are encrypted at rest. Passwords and API keys are stored as one-way hashes. Access to production systems is restricted to authorised staff and is logged.
You can ask us to access, correct, export, or delete your personal data at any time.
Customers can disconnect their WhatsApp Business Account from the dashboard at any time, which deletes the stored access token immediately. To delete an entire account and all associated data, email us from the account's email address.
Message recipients should contact the business that sent the message. You may also email us directly and we will identify and delete your records.
Send deletion requests to info@creativeadvtech.com with the subject "Data deletion request". We confirm completion within 30 days.
If you connected Wasl through Facebook Login and remove the app from your Facebook or Meta Business settings, Meta notifies us and we delete the related access token and connection data.
Wasl is a business service and is not directed at children under 16. We do not knowingly collect data from them.
We will post any changes to this policy on this page and update the date at the top. Material changes are also emailed to Customers.
Wasl.io, powered by Creative Advanced Technologies
Dubai, United Arab Emirates
Website: creativeadvtech.com
Email: info@creativeadvtech.com