Privacy Policy

1. Who we are

RealTool B.V. ("RealTool," "we," "us," or "our") is a company registered in the Netherlands, with its registered office at Reigersbek 67, 1441SX Purmerend, the Netherlands.

RealTool operates as an Independent Software Vendor (ISV) and Meta Technical Provider. We provide a platform that enables business customers ("Customers," "you") to onboard and operate their own WhatsApp Business senders, using Meta's Embedded Signup flow and Twilio's WhatsApp Business API as the underlying messaging infrastructure.

This Privacy Policy explains what data we collect from and about our Customers when they use RealTool, why we collect it, how we use it, who we share it with, and what rights Customers have over their data.

2. Scope

This policy applies to:

• Customers who sign up for RealTool and connect a WhatsApp Business Account (WABA) via Meta Embedded Signup.
• Authorized users of a Customer's business who access the RealTool platform (e.g., to manage a shared inbox).

It does not directly govern how individual Customers process the personal data of their own end-users (the people who message a Customer's WhatsApp number). Customers act as data controllers for their own end-customers' message content and must have their own privacy policy covering that relationship. RealTool acts as a data processor for that message content on the Customer's behalf.

3. What data we collect

Category	Examples
WhatsApp Business Account (WABA) data	WABA ID, Meta Business Portfolio ID, sender phone number, business profile information (name, category, description, profile photo)
Phone number data	The WhatsApp Business phone number being registered, and its verification status
Message content	Inbound and outbound WhatsApp messages sent or received through a Customer's connected number, including text, media, and message metadata (timestamps, delivery/read status)
Account & identity data	Internal customer ID, business name, authorized user names and email addresses, authentication tokens issued by Meta during Embedded Signup
Usage & analytics data	Platform usage logs, message volume and delivery statistics, feature usage

We do not collect IP addresses, browser, or device information. We do not intentionally collect special categories of personal data (e.g., health, religious belief, biometric data) unless such data appears incidentally within message content sent by a Customer's end-users, in which case it is treated with the same processor-level confidentiality as all other message content.

4. How we use this data

• Facilitate WhatsApp Business Account onboarding via Meta's Embedded Signup and Twilio's Partner Solution program.
• Create and maintain the mapping between a Customer's internal account and their Twilio subaccount / WABA.
• Route, deliver, and display WhatsApp messages through the Customer's chosen shared inbox (e.g., Chatwoot or Missive).
• Provide Customers with analytics and reporting on their messaging activity.
• Maintain platform security, detect fraud or abuse, and debug technical issues.
• Comply with legal obligations, including those imposed by Meta's Platform Terms and Twilio's Acceptable Use Policy.

5. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the RealTool platform and messaging services a Customer has signed up for.
• Legitimate interests (Art. 6(1)(f)) — for platform security, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with law.
• Consent (Art. 6(1)(a)) — where explicitly required, e.g., for certain analytics or communications.

For message content belonging to a Customer's end-users, RealTool acts as a processor; the Customer (as controller) is responsible for establishing the legal basis for processing their end-users' data.

6. Third parties and sub-processors

To deliver the RealTool platform, we share data with the following categories of third parties, each acting under a data processing agreement or equivalent contractual safeguard:

Sub-processor	Role
Meta Platforms, Inc.	Provides the WhatsApp Business Platform, Embedded Signup, and Business Portfolio infrastructure
Twilio Inc.	Messaging backbone; hosts WhatsApp Business API subaccounts and delivers/receives messages
Microsoft Azure	Cloud hosting, application infrastructure, and secrets management (Key Vault), hosted in the West Europe region
MongoDB Atlas	Managed database storage for customer account mappings and platform data
Chatwoot / Missive	Shared inbox tooling used to display and manage incoming/outgoing WhatsApp conversations, as selected by the Customer

We do not sell personal data to third parties, and we do not share data with third parties for their own independent marketing purposes.

7. International data transfers

Our primary infrastructure is hosted in the West Europe (Netherlands) Azure region. Where a sub-processor (such as Meta or Twilio) processes data outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to ensure an adequate level of protection.

8. Data retention

We retain Customer and message data for 90 days following the end of the relevant activity (e.g., after a conversation ends or a Customer account is closed), after which it is deleted or irreversibly anonymized, unless a longer retention period is required by law or necessary to resolve disputes or enforce our agreements.

9. Security

• Encryption of data in transit (TLS) and at rest.
• Secrets and credentials (Meta App secrets, Twilio credentials) stored in Azure Key Vault, never in source code or client-accessible configuration.
• Server-side validation of all customer identifiers against authenticated sessions.
• Role-based access controls limiting internal access to Customer data.
• Regular review of third-party sub-processor security practices.

No system is completely secure, and we cannot guarantee absolute security, but we work to continuously improve our safeguards.

10. Your rights (GDPR)

Where the GDPR applies, Customers and their authorized users have the right to:

• Access the personal data we hold about them.
• Request correction of inaccurate data.
• Request erasure ("right to be forgotten"), subject to legal retention requirements.
• Request restriction of, or object to, processing.
• Request data portability.
• Lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

To exercise any of these rights, contact us at rwc@sboulema.nl.

11. Children's data

RealTool is a business-to-business platform and is not directed at, nor knowingly used by, children. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have inadvertently collected such data, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or Meta/Twilio platform obligations. We will post the updated version with a revised "Last updated" date and, where changes are material, notify Customers directly.

13. Contact us