Privacy Policy

Last updated: August 20, 2026

1. Introduction

layan.je ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp Team Inbox service.

2. Information We Collect

2.1 Account Information

When an account is created or provisioned for you, we collect your name, email address, authentication identifiers, profile photo, and workspace role. Authentication is processed through WorkOS AuthKit. Workspace owners and administrators also provide organization, workspace, and billing details.

2.2 Meta Embedded Signup Data

When you connect your WhatsApp Business account through Meta's Embedded Signup flow, we receive access tokens, your WhatsApp Business Account ID, phone number ID, and associated business profile information from Meta Platforms. This data is used solely to configure and operate the WhatsApp Cloud API integration on your behalf.

2.3 WhatsApp Message Data

To provide the Service, we receive and store WhatsApp messages sent to and from your connected WhatsApp Business number. This includes message content, sender information, timestamps, message status (sent, delivered, read), and media attachments.

2.4 Customer Data

We store customer phone numbers and display names as provided by WhatsApp. Your team may add notes, tags, and other metadata to customer records within the Service.

2.5 Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number. We receive and store your Stripe customer ID, subscription status, and billing-related metadata.

2.6 Usage Data

We collect information about how you use the Service, including login times, features accessed, device and app information, push-notification tokens and preferences, and performance metrics such as response times and message volumes. When mobile diagnostics are enabled, crash, performance, device, and app technical data may be sent to Sentry. The mobile app is configured not to attach account, workspace, customer, request, or message identifiers to those diagnostic events.

2.7 AI Assistant Data

When a staff member chooses to use the AI Assistant, we process their prompt and the relevant conversation context needed to generate a useful suggestion. This may include customer messages, names, phone numbers, profile details, notes, workspace guidance, product information, and workflow context. The Service identifies the effective external AI provider and asks the staff member for explicit permission before sending this data. AI suggestions remain drafts until a staff member reviews and applies them.

3. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To process your subscription payments and manage your account.
  • To facilitate WhatsApp message delivery and conversation management.
  • To generate AI-assisted drafts and workflow suggestions when an authorized staff member explicitly enables and uses that feature.
  • To generate analytics and performance metrics for your workspace.
  • To send you service-related communications (e.g., billing confirmations and security alerts) and operational push notifications you configure.
  • To respond to your support requests and inquiries.
  • To detect, prevent, and address technical issues or abuse.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

  • Meta Platforms (WhatsApp Cloud API): Message data is transmitted through Meta's WhatsApp Cloud API as required to deliver messages.
  • Stripe: Payment and billing information is shared with Stripe for payment processing.
  • WorkOS: Authentication data is processed through WorkOS AuthKit.
  • Convex: Application data is stored and processed using Convex's real-time database infrastructure.
  • Cloud and media infrastructure: Cloudflare services, including object storage and media-processing infrastructure, may process files, profile images, message attachments, and voice-note media needed to operate the Service.
  • Push-notification providers: Apple Push Notification service, Firebase Cloud Messaging, and Expo notification infrastructure process device tokens and notification delivery data when notifications are enabled.
  • AI providers: Depending on the model configured for the Service, relevant AI Assistant data may be processed by OpenAI, OpenRouter, Anthropic, Google, Z.AI, Baseten, or another provider identified in the consent disclosure. The effective provider is shown before data is sent, and staff permission can be withdrawn from the Assistant.
  • Sentry: When production diagnostics are enabled, Sentry may process crash, performance, device, and app technical data so we can diagnose reliability issues. The mobile app does not intentionally attach account, workspace, customer, request, or message identifiers to diagnostic events.
  • Google Analytics: Our public website may use Google Analytics to measure visits and interactions. We do not use this information for third-party advertising.
  • Professional advisers and business transfers:We may share limited information with advisers, auditors, or a successor as reasonably necessary, subject to appropriate confidentiality and data-protection obligations.
  • Legal requirements: We may disclose information if required by law, regulation, or legal process.

We require service providers that process personal data on our behalf to use it only for agreed purposes and to maintain data protections consistent with this Policy and applicable law.

5. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication through WorkOS, and access controls within the application. However, no method of transmission over the Internet is 100% secure.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service, meet our contractual and legal obligations, resolve disputes, prevent abuse, and maintain security. A subscription cancellation does not itself delete workspace data. Following a verified deletion request, we aim to remove applicable data from active systems within 30 days. Encrypted backups and records that must be retained for legal, fraud-prevention, accounting, or security purposes may remain for up to 90 days or for the period required by law, with access restricted to those purposes.

7. Account Deletion and Data Removal

You may request deletion of your staff account and associated personal data by emailing privacy@layan.je with the subject "Account Deletion Request". We may ask you to verify your identity and authority before completing the request.

A staff-account deletion removes the person's login, profile, device registrations, and other personal data we are not required to retain. Messages, notes, assignments, and audit records created for an organization may remain under that organization's control where needed to preserve its shared business records or meet legal obligations.

An authorized workspace owner or administrator may request deletion of an entire workspace. After verification, we will:

  • Remove workspace data, including conversation history, customer records, notes, and stored media, subject to the retention limits above.
  • Revoke all Meta and WhatsApp API access tokens associated with your account.
  • Remove any data obtained through Meta's Embedded Signup flow.
  • Cancel any active subscription and stop all future billing.

Deletion is irreversible once completed. Request any export you require before asking us to delete an account or workspace.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Export your data in a portable format.
  • Object to or restrict certain processing of your data.
  • Withdraw AI-processing permission for future Assistant requests without affecting processing that already occurred.

To exercise these rights, contact us at privacy@layan.je.

9. Cookies and Tracking

The web Service uses essential cookies and local storage for authentication, session management, preferences, and security. Our public website may use Google Analytics to understand page visits and interactions. We do not use third-party advertising trackers or sell browsing activity. The mobile app does not use browser cookies for ordinary app functionality.

10. International Processing

Our service providers may process information in Malaysia, the United States, and other countries where they operate. Where required, we use contractual and organizational safeguards intended to protect information transferred across borders.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when this policy was last revised.

13. Contact

For privacy-related questions or requests, contact us at privacy@layan.je. For general product support, visit our Support and Contact page.