Who we are
Saabsoft ("we", "our", "us") operates ChatBridge24 (the "Application"), a Bitrix24 Marketplace application that links WhatsApp accounts to a Bitrix24 portal's Open Channels and CRM.
The Bitrix24 portal that installs the Application is the data controller for the personal data processed through it. Saabsoft acts as a data processor, handling that data only on the portal's instructions and for the purposes described below.
How the Application connects to WhatsApp
The Application is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. WhatsApp is a trademark of its respective owner.
Messages are exchanged through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. The WhatsApp Business Account and the business phone number remain the customer's own; during onboarding the customer authorises the Application to send and receive messages on that number, and message content, sender and recipient identifiers and delivery status therefore flow to and from Meta's Cloud API as part of that delivery.
A separate legacy direct-connection method remains available to customers who adopted it before the Cloud API integration. Where a portal uses it, the connection is made to the customer's own WhatsApp account rather than through Meta's Cloud API, and the Application holds the connection credentials described in section 3.
Data we process
When a portal uses the Application we process:
- Portal and user data — the Bitrix24 member ID and domain, and the name, email address, user ID and administrator flag of each user who opens the Application.
- WhatsApp account data — the phone number, display name and connection state of each WhatsApp number connected to the portal; for numbers on the WhatsApp Business Platform, the WhatsApp Business Account and phone number identifiers issued by Meta and the access credentials the customer grants us during onboarding; and, on the legacy direct-connection method only, the connection credentials required to keep that connection alive.
- Message content — the text of messages sent and received on connected numbers, together with sender and recipient identifiers, timestamps and delivery/read status.
- Media — images, video, audio, voice notes, documents and stickers exchanged on connected numbers, where media download is enabled in the Application's settings.
- Contact data — the phone number, WhatsApp profile name, profile picture and business-account flag of people who message a connected number, and the CRM record they are linked to.
- Billing data — subscription status, plan, quantity and payment history. Card details are entered directly with Stripe and are never seen or stored by us.
How we use it
We use this data solely to deliver the Application's function: keeping WhatsApp connections alive, delivering messages into Bitrix24 Open Channels and back out again, attaching conversations to the correct CRM lead, contact or deal, showing the portal's own statistics inside the Application, and administering subscriptions.
We do not use message content or contact data for advertising, profiling, resale, or to train machine-learning models.
Storage and security
Data is stored on servers we operate in the European Union. WhatsApp access and connection credentials are encrypted at rest with AES-256-GCM, and Bitrix24 OAuth tokens are encrypted with the same mechanism. Media files are stored outside the public web root and served only through short-lived signed links.
Access to production systems is limited to Saabsoft personnel who need it to operate or support the service, and every request from the Application is authenticated against the Bitrix24 portal that made it.
Sharing
We do not sell or trade personal data. Data is shared only with:
- Bitrix24 — message content and contact data are written into the portal's own Open Channels and CRM, which is the purpose of the Application.
- Meta Platforms, Inc. — messages sent and received on a number connected through the WhatsApp Business Platform (Cloud API) pass through Meta, which delivers them to the recipient and reports delivery and read status back. Meta processes that data as the provider of the platform, under its own terms with the customer.
- WhatsApp — on the legacy direct-connection method, outbound messages are delivered through the connected WhatsApp account.
- Stripe — billing and payment processing.
- Competent authorities — where we are legally required to do so.
Requests from public authorities
Saabsoft is a processor, not the controller, of the conversation data in a portal. A request from a public authority for that data should be directed to the Bitrix24 portal that holds it, and wherever we lawfully may, we redirect such requests to that portal. Where we are nevertheless compelled to respond ourselves, we apply the following process to every request:
- We review its legality. Before anything is disclosed, the request is checked to confirm it comes from a competent authority, cites a legal basis that binds us, and covers data we actually hold.
- We challenge it where it is unlawful. A request that is overbroad, that lacks a legal basis, or that we consider unlawful is refused or contested, and we take legal advice where the position is unclear.
- We disclose the minimum necessary. We provide only the specific records the request compels us to provide, for the identified accounts and period — never a portal's wider conversation history.
- We document it. Every request, our response, the legal reasoning and the people involved are recorded and retained.
Where the law permits, we notify the affected Bitrix24 portal before disclosing its data.
Retention and deletion
Conversation data is retained while the Application remains installed on the portal.
When the Application is uninstalled, Bitrix24 notifies us and we immediately delete the WhatsApp access and connection credentials for every connected number and the portal's Bitrix24 OAuth tokens. The remaining conversation data — messages, media files and contacts — is deleted as follows:
- If the portal administrator ticks Bitrix24's "delete data" option when uninstalling, it is deleted immediately.
- Otherwise it is retained for 30 days, so that reinstalling the Application within that period does not lose the portal's history, and is then deleted automatically.
Backups are retained for 14 days and are then deleted; data removed from production therefore disappears from backups within that period.
Removing a single WhatsApp number from the Application disconnects it and deletes its stored credentials; conversation history already written into Bitrix24 remains in the portal, where the portal administrator controls it.
A portal administrator can request earlier deletion, a copy of the portal's data, or correction of inaccurate data at any time by writing to privacy@saabsoft.com. We respond within 30 days.
Data subject rights
Where the GDPR or a comparable law applies, individuals have rights of access, rectification, erasure, restriction, portability and objection. Because Saabsoft is a processor, please direct such requests to the Bitrix24 portal that holds the data; we will assist that portal in responding.
Changes
We may update this policy as the Application changes. The "last updated" date above always reflects the current version, and material changes are announced inside the Application.
Contact
Saabsoft — privacy@saabsoft.com — Dubai, United Arab Emirates.