Privacy policy
ReturnLift is software a business uses to stay in touch with its own customers on WhatsApp. The business that connects its WhatsApp number and uploads its customer list is the controller of that data; ReturnLift processes it on the business’s instructions. This page says what we store, why, where, for how long, and how to have it removed.
What we store
| Data | Where it comes from | Why |
|---|---|---|
| Business account: email address, brand name, team members and their roles | Sign-up and invitations | Sign-in and access control |
| WhatsApp Business Account id, phone number id, display name and the access token Meta issues | Connecting the number (Embedded Signup or manual entry) | Receiving the business’s messages and sending its replies through Meta’s WhatsApp Cloud API |
| Customer records the business uploads: name, phone number, visit or order history, consent evidence | Files or links the business imports | Working out which customers to contact and when, as the business configures |
| Messages between the business and its customers on the connected number, including the type of message and media identifiers | Meta’s webhooks and the business’s own sends | Showing the conversation to the business, preparing replies from the business’s approved answers, keeping the record |
| The business’s approved answers, voice and guidelines | Entered by the business | The only material replies are drafted from |
| Delivery receipts and failure codes from Meta | Meta’s webhooks | Reporting to the business what was delivered |
| An audit trail of who did what in the account | Use of the product | Accountability |
What we do not do
- We do not sell data, and we do not use one business’s customers or messages for any other business.
- We do not use customer messages to train models.
- We do not read media files; we store Meta’s media identifier so the business can open the file in its own tools.
- Replies are drafted only from the business’s approved answers. A reply the system is unsure about is handed to a person at the business.
Automated replies
When a business switches on automatic replies, a customer who writes to the business’s WhatsApp number may receive an answer prepared by software from the business’s approved answers, inside the 24-hour window Meta allows for such replies. If a customer asks whether they are talking to a person, the reply says it is automated and that a person reads every conversation. A customer can ask for a person at any time, and the business is told.
Where the data is
| Provider | Role |
|---|---|
| Meta Platforms (WhatsApp Business Platform) | Carries the messages between the business and its customers under Meta’s own terms |
| Cloudflare | Runs the application |
| Supabase | Hosts the database and sign-in |
| A model provider chosen by the business (for example OpenAI), using the business’s own key | Drafts replies from the business’s approved answers and the conversation; requests are sent without storage on the provider’s side where the provider offers it |
| Slack, when the business connects it | Receives a notice when a conversation is handed to a person |
Access tokens and integration credentials are encrypted at rest. Access to a business’s data is limited to that business’s own team and, where the business asks for it, to operators it assigns. Each business’s data is separated from every other business’s at the database level.
How long we keep it
For as long as the business keeps its account. When a business disconnects its WhatsApp number, the token is deleted at once. When a business closes its account, its customers, messages and configuration are deleted within 30 days; the audit trail is kept without personal data for accounting. A customer who replies STOP or asks not to be contacted is marked opted out permanently and is never messaged again by the business through ReturnLift.
Your rights
If you are a customer of a business that uses ReturnLift, your relationship is with that business: ask them to see, correct or delete what they hold about you, and they can do so in ReturnLift. If you prefer, email hello@getreturnlift.com and we will pass the request to the business and confirm what was done. If you are a business using ReturnLift, you can export and delete your data from your account or by asking us. See the data deletion page for the steps.
Changes and contact
We will post changes to this page with a new date. Questions: email hello@getreturnlift.com.