Privacy Policy

1. Introduction

RealConnect CRM ("we," "our," or "us") is developed and operated by Realtrack Technologies LLC ("RealTrack"), a company registered in Dubai, United Arab Emirates. RealConnect CRM is a WhatsApp Business CRM platform that enables businesses ("Clients") to manage customer communications, campaigns, contacts, and leads through the official Meta WhatsApp Business Platform (Cloud API).

Our platform supports WhatsApp Coexistence (simultaneous use of the WhatsApp Business App and Cloud API on the same number), Embedded Signup (Meta's official onboarding flow), Facebook/Instagram Lead Ads integration, and Meta Ads management.

This Privacy Policy describes how we collect, use, process, store, share, and protect personal data of our Clients, their end-users (consumers communicating via WhatsApp), and website visitors.

2. Definitions

• "Client" — A business or organization using RealConnect CRM.
• "End-User" — A WhatsApp consumer who communicates with a Client through the WhatsApp Business Platform.
• "WABA" — WhatsApp Business Account, managed within Meta Business Manager.
• "Coexistence" — Meta's feature enabling simultaneous use of the WhatsApp Business App and Cloud API on the same phone number.
• "Embedded Signup" — Meta's official onboarding flow for connecting a WABA to RealConnect CRM.
• "Message Echoes" — Webhook-based mirroring of messages between the WhatsApp Business App and Cloud API under Coexistence.

3. Information We Collect

3.1 Client Account Information

During registration: name, email address, phone number, company/business name, business address, and billing/payment details.

3.2 Data Collected via Meta Permissions

RealConnect CRM requests specific Meta permissions to deliver its features. Below is a complete list of each permission, the data it accesses, how that data is used, and its current Meta App Review status:

Permission	Data Accessed & Purpose	Status
public_profile	Accesses the Client's basic Facebook profile (name, profile picture) to identify the user during Embedded Signup and display their identity within RealConnect CRM. No profile data is shared with third parties or used for advertising.	Approved
whatsapp_business_messaging	Enables RealConnect CRM to send and receive WhatsApp messages on behalf of Clients via the Cloud API. This includes text, media (images, videos, documents), location, and contact messages. Used for real-time inbox, broadcast campaigns, template messages, and automated replies.	Approved
whatsapp_business_management	Enables management of the Client's WhatsApp Business Account (WABA), including: managing phone numbers, creating/editing/deleting message templates, subscribing to webhooks, reading WABA quality rating and messaging limits, and managing business profile settings.	Approved
whatsapp_business_manage_events	Enables subscription to WhatsApp Business webhook events, including: message received/sent/delivered/read status updates, Coexistence message echoes (smb_message_echoes), contact sync events (smb_app_state_sync), account quality updates, and template status changes. This is required for Coexistence synchronization. Pending approval — Coexistence sync is currently unavailable.	Pending Approval
business_management	Enables management of the Client's Meta Business Portfolio (Business Manager) assets. Used to: list and verify business assets (WABAs, ad accounts, Pages) during Embedded Signup, manage system user access tokens, and verify business ownership for WABA connections.	Approved
pages_show_list	Retrieves a list of Facebook Pages the Client manages. Used during setup to let Clients select which Page to connect for Lead Ads integration and Click-to-WhatsApp (CTWA) ad campaigns. No Page content is read, modified, or published.	Approved
pages_read_engagement	Reads Page engagement metadata (Page name, category, ID) required to associate a Facebook Page with Lead Ad forms and CTWA campaigns. Used to display Page details in the CRM dashboard. No posts, comments, or visitor data is accessed.	Approved
pages_manage_ads	Enables management of ads linked to Facebook Pages. Used to: create and manage Click-to-WhatsApp (CTWA) ad campaigns that direct users to start a WhatsApp conversation, and connect Lead Ad forms to Pages for lead capture.	Approved
leads_retrieval	Enables real-time retrieval of leads submitted through Facebook/Instagram Lead Ad forms via webhooks. Lead data (name, email, phone number, and custom form fields) is captured and stored in RealConnect CRM for the Client to follow up via WhatsApp. Lead data is only used for the Client's own CRM operations and is never sold or shared.	Approved
ads_read	Reads ad campaign data (campaign name, status, performance metrics, ad set configuration) from the Client's connected Ad Account. Intended to display ad performance analytics in the CRM dashboard alongside WhatsApp engagement data. Pending approval — ad performance analytics are currently unavailable; campaign creation/management via ads_management is unaffected.	Pending Approval
ads_management	Enables creating, editing, and managing ad campaigns in the Client's Ad Account. Used specifically for: creating Click-to-WhatsApp (CTWA) campaigns, managing Lead Ad campaigns, and pausing/resuming campaigns from within the CRM. RealConnect CRM only manages campaigns the Client explicitly creates through our platform.	Approved
Marketing API Access (Standard Tier)	Provides elevated access to Meta's Marketing API for advanced, higher-volume ad campaign operations. Requested in conjunction with ads_management and pages_manage_ads. Pending approval — RealConnect CRM currently operates on Meta's Basic Marketing API access tier.	Pending Approval

3.3 Coexistence-Specific Data

• Message Echo Data (smb_message_echoes): Messages sent via the WhatsApp Business App are echoed to RealConnect CRM via Meta webhooks. This includes message content, sender/recipient phone numbers, timestamps, and media attachments.
• Contact Sync Data (smb_app_state_sync): Contact information from the WhatsApp Business App (phone numbers, contact names) is synced to the CRM.
• Coexistence Status: Connection state, onboarding status, and phone number registration mode.

We do not access or import historical chat data from the WhatsApp Business App. Synchronization begins only from the moment Coexistence is enabled.

3.4 Embedded Signup Data

When Clients onboard via Meta's Embedded Signup flow, we receive:

• An authorization code (exchanged for a system user access token).
• The Client's Meta Business Portfolio ID and WABA ID.
• Phone number details selected during signup.
• Business verification status.

The Client explicitly grants these permissions during the Embedded Signup flow. No data is accessed without the Client's authorization.

3.5 Usage & Technical Data

IP addresses, browser type, device information, pages visited, features used, session duration, error logs, and performance metrics.

4. How We Use Information

• Service Delivery: Send/receive WhatsApp messages, manage templates, run campaigns, capture leads, enable Coexistence sync, and display ad analytics — all on behalf of the Client.
• Contact & Lead Management: Manage Client contact databases, conversation inboxes, tags, lead tracking, and role-based team access.
• Analytics: Provide delivery reports, conversation metrics, campaign performance, and ad ROI dashboards.
• Platform Operations: Monitor performance, security, and reliability.
• Support: Respond to Client inquiries and troubleshoot issues.
• Compliance: Comply with applicable laws, regulations, and Meta policies.

5. Lawful Basis for Processing

• Contractual Necessity: Processing required to deliver our services.
• Legitimate Interest: Platform security, fraud prevention, analytics.
• Consent: Where explicitly provided during Embedded Signup and Coexistence activation.
• Legal Obligation: Where required by law.

6. Consent & Opt-In for WhatsApp Messaging

• Clients are solely responsible for obtaining, recording, and managing opt-in consent from end-users before sending any business-initiated WhatsApp messages.
• Pre-checked boxes, purchased contact lists, or implied consent from other channels (SMS, email) are not valid WhatsApp opt-in.
• End-users must be informed about the type and frequency of messages they will receive.
• End-users must have a clear mechanism to opt out at any time. RealConnect CRM supports opt-out keyword handling (e.g., "STOP").
• Clients must maintain auditable records of all opt-in consents.

7. Data Sharing & Third Parties

We do not sell, rent, or trade personal data. We share data only as follows:

• Meta Platforms, Inc. / WhatsApp: As required to operate via the WhatsApp Cloud API and Meta Marketing API. Subject to: WhatsApp Business Policy, Meta Terms for WhatsApp Business, WhatsApp Commerce Policy, Meta Platform Terms.
• Cloud Infrastructure: Industry-standard hosting (e.g., AWS, DigitalOcean) under data processing agreements.
• Payment Processors: PCI-DSS compliant processors for billing.
• Legal Authorities: When required by law, court order, or to protect rights and safety.

8. Data We Do NOT Collect or Use

• Sell, license, or monetize user data, message content, or Meta platform data to any third party.
• Use Meta data for purposes unrelated to providing the CRM service to the Client.
• Access historical WhatsApp Business App chats (pre-Coexistence activation).
• Store or access Facebook user passwords or authentication credentials (Embedded Signup uses OAuth 2.0 tokens).
• Use leads_retrieval data for any purpose other than delivering leads to the Client who owns the Lead Ad form.
• Publish to, post on, or modify any content on the Client's Facebook Pages.
• Access or store end-user Facebook profiles, friend lists, or social graph data.
• Use data to build user profiles for advertising, profiling, or selling to data brokers.

9. Data Storage, Security & Encryption

• All data in transit encrypted via TLS 1.2+ (HTTPS).
• Data at rest encrypted using AES-256.
• Access restricted via role-based access controls (RBAC) and multi-factor authentication (MFA).
• Webhook endpoints receiving Meta data are secured and validated.
• Meta access tokens are stored encrypted and never exposed in client-side code or logs.
• Regular security assessments and vulnerability scanning.
• Database backups encrypted and stored in geographically separate locations.

10. Data Retention & Deletion

• Account Data: Retained while active, plus 90 days post-termination.
• Messages & Conversations: Retained while account is active; Clients can delete at any time.
• Coexistence Echo Data: Same retention as standard messages.
• Lead Data: Retained as part of Client's CRM data; deleted on account termination.
• Ad Campaign Data: Cached for dashboard display; source of truth remains in Meta's systems.
• Technical Logs: Retained up to 12 months, then purged.
• Post-Termination: All data permanently deleted within 30 days from primary systems, 90 days from backups.

Clients or end-users may also request data deletion by contacting privacy@realconnect.realtrack.ae.

11. Data Subject Rights

Under applicable laws (GDPR, CCPA, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data), individuals may:

• Access — Request a copy of personal data we hold.
• Rectification — Correct inaccurate data.
• Erasure — Request deletion ("right to be forgotten").
• Restrict Processing — Limit processing of data.
• Data Portability — Receive data in a structured, machine-readable format.
• Object — Object to processing based on legitimate interest.
• Withdraw Consent — Withdraw consent at any time.

Contact: privacy@realconnect.realtrack.ae (response within 30 days).

End-Users: If you communicated with a Client via WhatsApp, please contact that Client directly. RealConnect CRM processes end-user data as a Data Processor on behalf of the Client (Data Controller).

12. Data Processor Role

For end-user data processed via the WhatsApp Business Platform and Meta Lead Ads, RealConnect CRM acts as a Data Processor. We process data only as instructed by Clients and per our service agreement. Clients are responsible for their own lawful basis for collecting and processing end-user data.

13. International Data Transfers

Data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards including standard contractual clauses and data processing agreements.

14. Cookies & Tracking

• Essential Cookies: Session management and authentication.
• Analytics Cookies: Usage patterns and platform improvement.

Manage via browser settings. Disabling essential cookies may impair functionality.

15. Children's Privacy

RealConnect CRM is a B2B platform not intended for use by individuals under 18. We do not knowingly collect data from minors.

16. Meta Platform Compliance

RealConnect CRM operates in full compliance with:

• WhatsApp Business Policy
• WhatsApp Commerce Policy
• Meta Terms for WhatsApp Business
• Meta Business Messaging Technology Provider Terms
• Meta Platform Terms
• Meta Developer Policies

17. Data Deletion Callback URL

In compliance with Meta's platform requirements, RealConnect CRM provides a data deletion callback endpoint. When a user removes RealConnect CRM from their Facebook account, Meta sends a deletion request to our callback URL. Upon receiving this request, we initiate deletion of all data associated with that user within 30 days and provide a confirmation URL and tracking code to the user.

18. Changes to This Policy

We may update this policy to reflect changes in practices, technology, legal requirements, or Meta policies. Material changes will be notified via email or in-platform notice at least 15 days before taking effect.

19. Contact Us

Realtrack Technologies LLC — RealConnect CRM
Address: 1606, Binary Tower, Business Bay, Marassi Drive, Dubai, United Arab Emirates
Phone: +971 4 330 2205
Email: privacy@realconnect.realtrack.ae
Website: https://realconnect-web.realtrack.ae