This Privacy Policy explains what personal data WAYVZ Group collects when you use the Cast platform, why we collect it, how we use it, who we share it with, and how you can exercise your rights. Two distinct relationships exist: when we collect data about you as our customer we are a "data controller"; when our customers send messages through Cast to their recipients, those customers are the controller and we are a "data processor" acting on their instructions. Both are addressed below.
1.Who we are
The Cast platform is operated by WAYVZ Group, comprising three legal entities registered in their respective jurisdictions. In this Privacy Policy, we refer to the group collectively as "WAYVZ" or "we".
- WAYVZ S.A.L — Qubic Square BC, Sin El Fil, Beirut, Lebanon. Primary controller.
- WAYVZ Connect Technologies LLC — Saqr Tower, Sheikh Zayed Road, Dubai, United Arab Emirates.
- WAYVZ (Pty) Ltd — West Towers, Nelson Mandela Square, Sandton, Johannesburg, South Africa.
For data-protection purposes, the principal controller of customer data is WAYVZ (Lebanon entity, identified above) unless your contract with us specifies a different entity. Inquiries about your data can be sent to cast@wayvzgroup.com.
2.What this covers
This Privacy Policy applies to:
- The Cast website at cast.wayvzgroup.com and the WAYVZ Group marketing site at wayvzgroup.com.
- The Cast web application, dashboard, APIs, and short-link service (slnk.ai).
- Sales and support communications between you and us.
Where you click a link in a message sent through Cast, you are taken to a destination chosen by the sender (our customer). We are not responsible for the privacy practices of those destinations.
3.Data we collect about customers
When you sign up for Cast or contact us, we collect:
| Category | Examples |
|---|---|
| Identity | Name, company name, business registration number where required. |
| Contact | Email address, phone number, billing and office address. |
| Account | Username, password (hashed and salted), API keys, two-factor secrets. |
| Billing | Wallet balance, top-up amounts, invoices, tax identifiers. We do not store full card numbers; payment processors handle card data directly. |
| Onboarding | Industry, intended use case, sample message content, and (where required by carriers or Meta) trade-license documents and beneficial-owner identification. |
| Usage | Login timestamps, IP addresses, browser and device identifiers, pages visited within the dashboard, API call logs. |
| Support | Communications you send us via email, chat, or our forms. |
4.Data we process when our customers send messages
When you, as our customer, use Cast to send messages, we process the following categories of data on your behalf as your processor:
| Category | Examples |
|---|---|
| Recipients | Phone numbers, optional names, optional custom variables you upload (e.g., order number, language preference). |
| Message content | The text or template parameters of each message you submit. |
| Delivery telemetry | Delivery status, timestamps, carrier responses, error codes returned by the network operator or Meta. |
| Engagement data | For tracked short links: click timestamp, recipient phone number, IP address of click, user-agent string, country/region from IP. |
| Landing-page data | Where customers use the landing-page builder, any data submitted by visitors via custom forms (lead-capture). |
You, our customer, are the data controller for this category of data. You are responsible for having a lawful basis to process it and for honoring recipients' rights. We process this data only on your documented instructions, except where we are required to act for fraud prevention, AUP enforcement, or legal compliance.
5.How we use personal data
We use the data described above for the following purposes:
- Provide the Service — authenticate your account, route and deliver messages, render dashboards, charge fees, generate invoices.
- Onboarding and KYC — verify your identity and business, register sender IDs, submit WABA verification.
- Customer support — respond to your questions, troubleshoot issues, investigate disputes.
- Service improvement — analyze usage patterns to improve performance, detect bugs, and plan features. We use aggregated and de-identified data wherever practical.
- Fraud and abuse prevention — detect spam, fraud, and AUP violations through automated screening of traffic patterns and content fingerprints.
- Legal compliance — meet our obligations to carriers, Meta, regulators, and law enforcement, including responding to lawful requests for data.
- Marketing — send you product updates and relevant offers, only where permitted by applicable law and where you have not opted out.
6.Legal bases (GDPR, POPIA, UAE PDPL)
Where the EU General Data Protection Regulation, the South African Protection of Personal Information Act (POPIA), or the UAE Personal Data Protection Law applies to our processing, we rely on the following lawful bases:
- Performance of a contract — to provide the Service you have signed up for.
- Legal obligation — to comply with carrier rules, Meta requirements, tax law, and lawful authority requests.
- Legitimate interests — to keep the platform secure, prevent fraud and abuse, and grow our business. We balance these interests against your privacy rights.
- Consent — for direct marketing where required by law, and for any optional cookies or tracking. You can withdraw consent at any time.
For messaging data we process on behalf of our customers (Section 4), the lawful basis must be established by the customer with their recipients before they send.
7.Who we share data with
We share personal data only with the parties listed below, and only to the extent necessary for the purpose:
| Recipient | Purpose |
|---|---|
| Mobile network operators and SMS aggregators | Routing and delivering SMS messages, sender ID registration. Includes Cellfind (South Africa) and licensed local operators in MENA markets. |
| Meta Platforms, Inc. | Routing and delivering WhatsApp messages via the WhatsApp Cloud API, template approval, business verification. |
| Cloud and hosting providers | Microsoft Azure (App Services, SQL, storage) for application hosting and database storage. |
| Payment processors | Wallet top-ups; processors handle card data under their own privacy terms. |
| Email and communications providers | Transactional notifications (account, billing, support). |
| Professional advisors | Lawyers, auditors, and accountants under confidentiality. |
| Authorities | Where compelled by law, court order, or where necessary to protect against fraud or safety threats. |
| Successors in interest | If we sell, merge, or restructure, data may be transferred to a successor entity, subject to confidentiality and continuation of these privacy commitments. |
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
8.International transfers
WAYVZ Group operates from Lebanon, the UAE, and South Africa. Our hosting infrastructure runs primarily in Microsoft Azure regions in the Middle East and Europe. Message delivery requires data to flow to mobile network operators in the country of the recipient, which may be anywhere in the world.
Where we transfer personal data from a region with stricter data-protection law (such as the European Economic Area or South Africa) to one with weaker protections, we rely on appropriate safeguards including standard contractual clauses, adequacy decisions, or specific consent where required.
9.How long we keep data
We retain personal data only as long as needed for the purpose, plus any period required by law or by carrier and aggregator obligations:
| Data type | Retention |
|---|---|
| Customer account data | Duration of the account, plus 7 years after closure for tax and legal records. |
| Billing records and invoices | 7 years from the date of issue (Lebanese / UAE / SA tax-record minimums). |
| Message content and recipient logs | By default, 90 days. May be shortened by the customer in their dashboard. May be retained longer where compelled by law or required for fraud / dispute investigation. |
| Delivery telemetry | 13 months (rolling) for analytics; aggregated indefinitely for reporting. |
| Short-link click data | 13 months from click. |
| Support communications | 3 years from last interaction. |
| Security and audit logs | 1 year, longer for incident-related logs. |
10.Security
We protect personal data using a combination of technical and organizational measures appropriate to the risk, including:
- Encryption in transit (HTTPS for all web traffic, TLS for SMTP and API endpoints).
- Hashed and salted password storage; secrets stored in platform key vaults.
- Role-based access control on internal systems; principle of least privilege for staff.
- Audit logging of administrative access.
- Regular patching of operating systems and dependencies.
- Incident-response procedures and vendor risk reviews.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law.
11.Your rights
Depending on the law that applies to you, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, subject to our legal retention requirements.
- Restriction — ask us to limit processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, including direct marketing.
- Withdraw consent — where we rely on consent.
- Lodge a complaint — with your local data-protection authority. South African residents may complain to the Information Regulator. UAE residents may contact the UAE Data Office.
To exercise any of these rights, email cast@wayvzgroup.com. We respond within 30 days. We may need to verify your identity before acting on a request.
Recipients of messages sent by our customers: if you received a message via Cast and want to exercise rights over that data, the controller is the customer who sent the message (their identity is in the message). We will assist them in responding, but we cannot generally act on the recipient's request directly.
12.Cookies and tracking
Our marketing site and dashboard use a small set of cookies:
- Essential cookies — for authentication, session, and CSRF protection. These cannot be disabled if you wish to use the dashboard.
- Preference cookies — to remember settings such as language and time zone.
- Analytics cookies — to understand site usage in aggregate. We use first-party analytics where possible.
We do not use third-party advertising cookies. Short links generated through Cast (slnk.ai) record click events but do not place cookies on the recipient's device.
13.Children
Cast is a B2B service intended for use by businesses and adult professionals. It is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child's data has been provided to us in error, please contact us so we can remove it.
14.Changes to this policy
We may update this Privacy Policy from time to time. We will publish the updated version at this URL with a new effective date. For changes that materially affect how we use your personal data, we will notify active customers by email at least 14 days before the change takes effect.
15.Contact us
For privacy questions, data-subject requests, or to exercise any of the rights described above:
- Email: cast@wayvzgroup.com
- Mail: WAYVZ, Qubic Square BC, Sin El Fil, Beirut, Lebanon
If you are a recipient of a message sent through Cast and want to opt out of further messages, reply STOP to an SMS or use the WhatsApp opt-out option. Your opt-out is enforced by Cast at the platform level for that sender.
See also the Terms of Service and the Acceptable Use Policy.