Privacy Policy
Last updated: June 5, 2026
Badala is an internal communication tool operated by Bricks Marketing LLC (Kuwait). It is not offered as a service to third parties. This page describes what data Badala processes when employees of Bricks-affiliated companies use it to communicate with their own customers over WhatsApp and Instagram, through Meta's official business messaging APIs.
Who we are
Badala is operated by Bricks Marketing LLC. Contact: [email protected]. We connect only Instagram and WhatsApp accounts that we own and operate; we do not manage accounts on behalf of unaffiliated third parties.
What data Badala stores
- Contact records for people who message our WhatsApp numbers or our Instagram accounts — for WhatsApp: phone number and profile name (if shared); for Instagram: the Instagram-scoped user ID (IGSID), username/handle, and public profile name returned by Meta. Plus tags, notes, and a marketing-consent flag.
- Message history exchanged between our agents and contacts on WhatsApp and Instagram Direct — text, media references, timestamps, delivery status.
- Operational logs — webhook event payloads from Meta, an internal audit log of every employee action, and outbound webhook delivery logs (when a Bricks system subscribes to events).
- Employee account data — name, email, hashed password, role, IP address, last activity. Internal users only.
What we do with it
The data is used solely to operate the inbox: routing inbound WhatsApp and Instagram messages to the right teammate, sending agent replies within Meta's allowed messaging windows, and syncing contact records to our own internal systems (CRM, ERP). We use the instagram_business_manage_messages permission only to read Direct Messages sent to our own Instagram professional accounts and to send our agents' replies. We do not sell data, share it for advertising or third-party analytics, or use Instagram/WhatsApp data for any purpose other than responding to the customers who contacted us.
Data sharing
- Meta Platforms (WhatsApp Cloud API & Instagram Messaging API) — every message we send or receive is processed by Meta's infrastructure as the underlying messaging carrier, subject to Meta's own terms and policies.
- AWS (Mumbai region) — message and contact data is stored in AWS-hosted PostgreSQL and S3 in
ap-south-1. AWS acts as a data processor. - Cloudflare — fronts our domains as a CDN/edge proxy.
Marketing consent
Contacts can opt out of marketing messages at any time. Once a contact is flagged marketingConsent=false, Badala excludes them from every broadcast, regardless of audience filter. This is enforced server-side and cannot be overridden by a teammate at send time.
Retention
Message history (WhatsApp and Instagram) is retained while the corresponding contact remains a customer of any Bricks-affiliated company. Contacts can request deletion at any time (see below). Meta retains its own copy of Instagram and WhatsApp messages on its servers per Meta's terms; we have no ability to delete from there.
Your rights & data deletion
Anyone who has messaged our WhatsApp numbers or Instagram accounts can request:
- A copy of the data we hold about them.
- Deletion of that data.
- Correction of inaccurate fields.
- Removal from marketing audiences.
To request deletion, email [email protected] from, or referencing, the Instagram username or WhatsApp number used. We delete the contact record and all associated conversations (including Instagram Direct messages and the stored IGSID) from Badala's database within 30 days and confirm by reply.
Changes to this policy
Material changes will be reflected in the "Last updated" date above. The live version of this document is at docs.badala.app/privacy.