Privacy policy

1. Who we are

Live Analytics operates the application “Live Analytics” (Meta App ID 2334190797356886, registered under Meta Business ID 1778843559287741). For the data described in this policy we are the data controller within the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679.

Questions about this policy, and any request to exercise the rights described in section 11, should go to the email address above.

2. What this policy covers

Live Analytics is an internal reporting tool. It connects to the WhatsApp Business accounts that our own company owns and operates, and turns the conversations our team has with customers into statistics: how quickly we reply, when the queue is busiest, and which conversations were left unanswered.

This policy explains what happens to the personal data involved. It covers two groups of people:

• Customers and other people who message us on WhatsApp. If you have written to one of our WhatsApp Business numbers, this policy tells you what we do with that conversation.
• Members of our team whose replies are measured by the tool.

It also covers visitors to this website, in section 13.

3. The data we process

The table below lists everything the application handles, with the retention period for each category. Section 6 explains how those periods are enforced.

We do not process special categories of data under Article 9 GDPR on purpose. If someone volunteers such information in a message to us, it is covered by the 90-day retention period for message content like any other text.

4. Where the data comes from

All conversation data reaches us through the official WhatsApp Business Platform API operated by Meta Platforms Ireland Limited. We receive it in two ways: webhooks that Meta sends to our server when a message arrives or changes status, and scheduled requests our server makes to Meta’s API for the accounts we are authorised to read.

We do not scrape WhatsApp, use unofficial clients, or obtain conversation data from any other source. We do not buy personal data from data brokers or combine your messages with data from third-party sources.

5. Why we process it, and on what legal basis

Each purpose below is tied to the legal basis we rely on under Article 6(1) GDPR.

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited to what a person writing to a company’s support line would reasonably expect: we measure timing, not the substance of what you say. You can object to this processing at any time — see section 11.

Team members are told in advance that reply times are measured. The tool reports on response speed and workload. It does not score the quality or tone of what an individual writes, and no decision about a person is taken by automated means within the meaning of Article 22 GDPR.

We do not use your messages to train machine learning models, and we do not use them for advertising, profiling for marketing, or any form of targeting.

6. How long we keep it

The retention periods in section 3 are enforced by a scheduled job that runs daily on our servers and permanently deletes records that have passed their period. Deletion covers our live database, our search indexes and our backups; backups are rotated so that a deleted record is gone from every copy within a further 35 days.

When message content and customer identifiers are deleted at 90 days, the timing statistics derived from them survive in a form that no longer identifies anyone: a reply time with no phone number, no name and no text attached to it.

If you ask us to delete your data sooner, section 12 and the data deletion page explain how.

7. Who else can access it

Inside our company, access is limited to the team members who answer messages and to the two administrators who maintain the application. Access is controlled by individual accounts and is logged.

Outside our company, personal data is disclosed only to the following processors, each under a written contract meeting Article 28 GDPR:

We may disclose data to public authorities, courts or our legal advisers where we are legally obliged to do so or where it is necessary to establish or defend legal claims. If we ever receive such a request we check that it is lawful and disclose no more than is required.

We do not sell personal data. We do not rent, licence or otherwise transfer it to data brokers, advertising networks or any other third party for their own purposes.

8. Transfers outside the European Economic Area

The application and its database run on servers located in the European Union, and we select processors that store data in the European Union.

Meta may process some data outside the EEA as part of operating the WhatsApp Business Platform. Those transfers are covered by the European Commission’s Standard Contractual Clauses and the additional safeguards described in Meta’s own data transfer terms. Where any other transfer outside the EEA becomes necessary, we will rely on an adequacy decision under Article 45 GDPR or on Standard Contractual Clauses under Article 46 GDPR, and you may request a copy of the safeguards in place by writing to us.

9. How we protect it

Data in transit between Meta, our servers and our administrators is encrypted with TLS. The server database and its backups are encrypted at rest. API credentials and access tokens are held in an encrypted store, are never written to application logs, and are rotated when a person with access to them leaves.

Access requires an individual account with multi-factor authentication; there are no shared logins. Administrative access to the server is restricted by key-based authentication. We review who has access on a regular basis and remove accounts promptly when they are no longer needed.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours as required by Article 33 GDPR, and we will inform affected individuals directly where Article 34 requires it.

10. Data we receive from Meta

Information that reaches us through the WhatsApp Business Platform is Platform Data under the Meta Platform Terms. We handle it in line with those terms, the WhatsApp Business Terms of Service and Meta’s Developer Policies. In particular:

• We request only the permissions the application actually needs to produce the reports described in section 2, and we use the data only for those purposes.
• We do not transfer Platform Data to data brokers, advertising or monetisation platforms, or anyone building profiles for targeting.
• We do not attempt to re-identify, de-anonymise or enrich Platform Data using outside sources.
• We delete Platform Data when it is no longer needed for the purposes above, when you ask us to, or when our access to the platform ends, in each case within 30 days of the triggering event.
• We keep the security measures in section 9 in place for as long as we hold Platform Data, and we submit to Meta’s data use checks and audits where required.

WhatsApp and Meta are trademarks of Meta Platforms, Inc. We are an independent business and are not endorsed by, affiliated with, or acting on behalf of Meta.

11. Your rights

Under the GDPR you have the following rights in relation to your personal data. They are free to exercise, and we answer within one month, extendable by two further months for complex requests, in which case we will tell you before the first month is out.

• Access (Article 15) — a copy of the personal data we hold about you and an explanation of how we use it.
• Rectification (Article 16) — correction of data that is inaccurate or incomplete.
• Erasure (Article 17) — deletion of your data where one of the grounds in that article applies. See section 12.
• Restriction (Article 18) — a freeze on our use of your data while a dispute about it is resolved.
• Portability (Article 20) — the data you gave us, in a structured, commonly used, machine-readable format.
• Objection (Article 21) — you may object at any time to processing based on our legitimate interests. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or that we need the data for legal claims.
• Instructions after death — under French law you may give directions about what happens to your personal data after you die, either generally or to us specifically.

Write to privacy@dinshaer.cloud to exercise any of these. We may ask for information to confirm the request comes from you — usually confirmation from the WhatsApp number involved — and we use that information only to verify the request.

If you are not satisfied with our answer, you can complain to the French supervisory authority:

You may also complain to the supervisory authority in the EU country where you live or work.

12. Deleting your data

You can ask us to delete the conversation data we hold about you at any time, and we act on it within 30 days. The data deletion page sets out exactly what to send, what gets deleted, and what we are required to keep.

In short: email privacy@dinshaer.cloud with the subject line Data deletion request and the WhatsApp number you messaged us from.

13. This website and cookies

This website is a set of static pages. It sets no cookies, runs no analytics or tracking scripts, embeds no advertising, social media or third-party widgets, and builds no profile of you.

The one thing it loads from outside is the two typefaces used on these pages, which are requested from Google Fonts; your browser’s IP address is visible to that service when the fonts are fetched. Our web server records requests in its ordinary access log, which holds the IP address, the page requested and the time. Those logs are kept for 30 days and are used only to keep the site running and secure.

14. Children

Live Analytics is a tool for our internal business use and this website is addressed to businesses. We do not knowingly process the personal data of children. Under French law, where consent is the basis for an information society service, it is valid from the age of 15. If you believe a child has sent us personal data, write to us and we will delete it.

15. Changes to this policy

If we change how the application works, we will update this policy and change the date below. Where a change materially affects your rights, we will say so prominently on this page for at least 30 days. Earlier versions are available on request.

This version is effective from 17 October 2026.

16. How to reach us

For anything in this policy, including requests about your rights:

We have not appointed a Data Protection Officer, as we do not meet the criteria in Article 37(1) GDPR. Requests sent to the address above are handled by the person responsible for data protection in our company.