Updated: 20 July 2026
1. Controller
2. When this notice applies
This notice applies when a person intentionally communicates with a WhatsApp Business number connected to the Metagon WhatsApp Assistant (the “Assistant”). It supplements Metagon’s general privacy policy.
The Assistant receives only information that Meta delivers to the connected business account and information a person chooses to submit. It does not provide Metagon with silent access to unrelated personal WhatsApp conversations.
Plain-language note: The Assistant processes only conversations sent to the connected Metagon business number. It cannot silently inspect unrelated personal WhatsApp chats.
3. Data we process
• WhatsApp account and contact identifiers, display name and phone number.
• Message text, replies, reactions, timestamps and delivery information.
• Images, documents, links, audio or voice messages intentionally submitted to the business number.
• Transcriptions, short summaries and task or project metadata created from a submitted message.
• Security and technical information required to verify webhooks, prevent duplicate delivery and protect the service.
4. Why we process it
We process this information to respond to requests, provide agreed services, prepare and manage tasks, maintain useful project context, protect the service and comply with legal obligations.
Depending on the relationship and request, the legal basis is performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR), Metagon’s legitimate interests in secure and efficient service delivery (Article 6(1)(f) GDPR), consent where required (Article 6(1)(a) GDPR), or a legal obligation (Article 6(1)(c) GDPR).
5. How the Assistant works
New messages arrive through Meta’s official signed WhatsApp webhook. The Assistant may classify the request, prepare a reply, create a task or ask a clarifying question. Local models are used where practical. Approved OpenAI models may be used for orchestration and response generation. ElevenLabs is used only when a spoken reply is requested or enabled for that conversation.
The Assistant is not authorised to make solely automated decisions that produce legal or similarly significant effects. Sending, publishing, deleting, paying, changing access and other high-impact actions remain subject to Metagon’s human-approval rules.
6. What we retain
Raw message bodies are used during intake but are not persisted in the Metagon Control Plane. The Control Plane stores a protected source reference, a content hash, redacted metadata, classification results and any task or summary needed to perform the requested work.
Hermes conversation history and restricted operational logs may retain parts of a conversation where they are needed for continuity, security or troubleshooting. Submitted media may be downloaded to restricted local storage when transcription or visual processing is required. Conversation content and temporary media are kept only while needed for the active request, project context, security investigation or a legal obligation. Approved project records may be retained for the duration of the business relationship and the applicable documentation period.
A verified deletion request starts a review of the Control Plane, Hermes session history, temporary media and approved project records. Data is then deleted or anonymised unless Metagon must retain it for a legal obligation or legal claim.
7. Providers and transfers
Data may be processed by Meta/WhatsApp and by service providers that operate the approved AI, voice, hosting or security functions described above. We do not sell personal data. Composio is not the authoritative inbound message store for this Assistant.
Where a provider processes data outside the European Economic Area, Metagon uses an applicable transfer mechanism such as an adequacy decision or Standard Contractual Clauses and applies additional safeguards where required.
8. Security
Metagon uses signed webhook verification, sender restrictions, least-privilege connectors, private secret storage, bounded tools and human approval for high-impact actions. No online service can guarantee absolute security.
9. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection and may withdraw consent at any time. You may also complain to a competent data-protection authority.
For the practical deletion process, see:
10. Changes to this notice
We update this notice when the Assistant, its approved providers or the legal requirements change. The current version and its update date remain available on this page.
