Privacy

Doim helps participating businesses manage customer conversations. The business operating a connected account controls its customer records; Doim processes those records to deliver the service.

Information processed

Connected professional-account, WhatsApp Business phone-number, and mailbox identifiers; message or email content; delivery metadata; authorized business configuration; and service security logs may be processed. Provider access and refresh tokens are encrypted and remain server-side; they are never returned to the browser.

Purpose and controls

Data is used to receive and answer direct messages, support human takeover, maintain customer records requested by the business, prevent abuse, and diagnose delivery failures. Tenant isolation, role-based access, audit records, and channel-specific automation switches protect access.

EU and Netherlands pilots

For an approved Netherlands launch, Doim requires an EEA data-residency deployment profile, a reviewed processor inventory, a data-protection impact assessment where required, and a release record containing the applicable evidence. The business remains responsible for its lawful basis, customer notice, and channel-specific marketing permissions.

AI transparency and human help

Businesses can identify automated assistance in their channel notices and call disclosure. Doim records whether a timeline message was authored by AI, a human, or the customer, and a human operator can take control of an active conversation. AI automation is blocked while a human has control.

Retention and requests

Data is retained only for the business purpose and the approved retention schedule. A person can ask the business they contacted to access, correct, export, restrict, object to, or delete applicable personal data. The business can invoke Doim's tenant-scoped anonymization flow; it also cancels pending follow-ups and redacts derived customer data.

Deletion

Customers may ask the business they contacted to delete or anonymize their data. Meta-signed deletion requests receive an opaque confirmation code and are processed through Doim’s deletion workflow. See the public Data deletion page for status instructions.

Contact

Privacy questions should be sent to the administrator of the business account you contacted. Pilot operators must publish an approved privacy contact, data-processing terms, and their current subprocessor information before enabling a live account.