Privacy Policy

Effective 19 September 2026 · Last updated 19 September 2026

This policy explains what personal data BotConfirm handles, why, and what rights you have. BotConfirm is operated by BMH DIGITAL LTD ("we", "us"), a company registered in England and Wales under number 16338088, with its registered office at 24-26 Arcadia Avenue, FIN0000, London, N3 2JU, United Kingdom.

1. Who this policy covers

Two groups of people interact with BotConfirm:

• Merchants — businesses that create a BotConfirm account to confirm their orders. For merchant account data, we are the data controller.
• Customers — people who placed an order with a merchant and receive a WhatsApp message from that merchant through BotConfirm. For customer data, the merchant is the data controller and we act as their data processor, handling the data only to provide the service to the merchant.

2. Data we process

Customer data received from the merchant's store:

• Name and phone number of the person who placed the order
• Order details: products, quantity, amount, currency, order number, order date
• Order status (pending, confirmed, cancelled, shipped, delivered)

Messaging data:

• The content of confirmation messages sent to the customer
• The customer's reply (button tapped or text typed) and when it was received
• Delivery status of messages (sent, delivered, read) as reported by WhatsApp

Merchant account data:

• Business name, contact name, email address and phone number
• The WhatsApp Business number connected to BotConfirm
• Store connection details (for example a WooCommerce webhook secret) and the automation rules the merchant configures

We do not process payment card data. We do not use advertising or tracking cookies on the BotConfirm dashboard.

3. Why we process it

• To send order confirmation and follow-up messages to customers on the merchant's behalf, and to record the customer's answer against the right order
• To show merchants their orders, confirmation rates and message history
• To operate, secure and troubleshoot the service
• To communicate with merchants about their account

Our legal basis for processing merchant data is the performance of our contract with the merchant and our legitimate interest in running the service. Customers' data is processed on the merchant's instructions; the merchant is responsible for having a lawful basis to contact its customers about their orders.

4. WhatsApp and the providers we rely on

Messages are sent and received exclusively through the WhatsApp Business Platform. To do this we share the customer's phone number and the message content with:

• 360dialog GmbH (Germany), an authorised WhatsApp Business Solution Provider, which relays messages between BotConfirm and WhatsApp
• Meta Platforms, which operates WhatsApp. Meta's handling of messages is governed by the WhatsApp Business Terms.

The service is hosted by Hostinger. We do not sell personal data and we do not share it with anyone else, except where the law requires it.

5. International transfers

BotConfirm serves merchants in Morocco and other countries. Data may be processed in the United Kingdom, the European Union and, through WhatsApp, in the countries where Meta operates. Where data leaves the UK or EU we rely on the safeguards provided by our providers, including standard contractual clauses.

6. How long we keep data

• Order and message records are kept while the merchant's account is active, so the merchant can consult its history
• When a merchant closes its account, its data — including customer records — is deleted within 30 days, unless we must keep it to comply with the law
• A merchant can ask us to delete specific customer records at any time

7. Security

Data is transmitted over encrypted connections (HTTPS). Access to the systems that store data is restricted to the people who need it to run the service. Merchant credentials and API keys are stored separately from application code and are never shared.

8. Your rights

Under UK and EU data protection law you can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive a copy of it. If you are a customer of a merchant, the quickest route is to contact that merchant; you can also contact us and we will assist. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

If you no longer want to receive WhatsApp messages from a merchant, reply to that merchant's message asking to stop, or block the number in WhatsApp.

9. Children

BotConfirm is a business service and is not directed at anyone under 18. We do not knowingly process children's data.

10. Changes to this policy

We may update this policy as the service evolves. The date at the top shows the latest version. Significant changes are communicated to merchants by email.