Privacy Policy

Account data: your mobile number, application or business name, contact email, and the application logo you upload during onboarding.

Usage data: verification request logs, meaning the destination, channel, delivery status and time, and the credit ledger. Both are required to operate the service and bill correctly.

End-user data: the phone numbers you send verification codes to on behalf of your application. We process them only to deliver the code and never use them for anything else.

We use your data to run the service: sending and checking codes, metering credits, reviewing new accounts to prevent fraud and impersonation, and improving delivery quality.

We do not sell your data or your customers' data to any third party, and we never use end-user phone numbers or emails for marketing.

We rely on trusted providers to operate the platform: a licensed Saudi SMS provider to deliver text messages, Meta Platforms Ireland Limited to deliver messages over the WhatsApp Business Platform, an email provider for platform emails such as receipts and account notices, and a certified payment gateway to process payments. We never store your card details on our servers. Amazon Web Services hosts the platform and its database in the Frankfurt region.

When you send over WhatsApp, the recipient's phone number and the verification code are passed to Meta so it can deliver the message, and Meta processes that data under its own terms and privacy policy.

Each provider receives only the minimum data needed to do its job.

Verification codes are stored hashed, so they cannot be read back, and expire within minutes. We keep verification logs and financial records for as long as needed for billing and regulatory compliance.

Recipient phone numbers are masked in our operational logs: we record a short prefix and the last four digits only, so a full number is never written to a log line.

Our security controls include encrypted connections, API keys stored hashed and shown only once, and restricted internal access to data.

The ISO badges displayed in the website footer refer to certifications held by our hosting provider, Amazon Web Services, for services within their scope: ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and ISO 9001:2015.

These certifications belong to the hosting provider, not to Tawked or its platform. Using those hosting services does not transfer the provider’s certification to Tawked.

When the account owner or a member connects an AI assistant, such as Claude or ChatGPT over MCP, or approves a connected app, it receives only what its key's permissions allow, such as the account's details, WhatsApp templates, message details, usage and contacts. Customers' phone numbers reach it masked, unless the person who connected it sees them in full in the console. It acts only within those permissions.

Sending a WhatsApp message or a test code, deleting a WhatsApp template and the other actions Tawked marks as consequential take a confirmation step first: a preview the assistant shows the person, and an approval in the Tawked console when the connection asks for one. Each call the assistant makes is recorded in the account's log, which we keep for 90 days.

The assistant's or the app's provider processes what it receives under its own terms and privacy policy.

You can end a connection or revoke a key at any time in the console: Integrations › AI assistants for an assistant, the connected app's page under Integrations for an app, and Settings › Account API for an access token.

You may request access to, correction of, or deletion of your personal data, as guaranteed by the Saudi Personal Data Protection Law. Email support@tawked.com and we will respond within a reasonable time.

Step-by-step instructions for deleting an account, or for a message recipient to have their number removed, are on our data deletion page.

For any question about this policy or your data, email support@tawked.com, or reach us through the contact page or WhatsApp.