Privacy Policy

1.Who we are

The Cast platform is operated by WAYVZ Group, comprising three legal entities registered in their respective jurisdictions. In this Privacy Policy, we refer to the group collectively as "WAYVZ" or "we".

• WAYVZ S.A.L — Qubic Square BC, Sin El Fil, Beirut, Lebanon. Primary controller.
• WAYVZ Connect Technologies LLC — Saqr Tower, Sheikh Zayed Road, Dubai, United Arab Emirates.
• WAYVZ (Pty) Ltd — West Towers, Nelson Mandela Square, Sandton, Johannesburg, South Africa.

For data-protection purposes, the principal controller of customer data is WAYVZ (Lebanon entity, identified above) unless your contract with us specifies a different entity. Inquiries about your data can be sent to cast@wayvzgroup.com.

2.What this covers

This Privacy Policy applies to:

• The Cast website at cast.wayvzgroup.com and the WAYVZ Group marketing site at wayvzgroup.com.
• The Cast web application, dashboard, APIs, and short-link service (slnk.ai).
• Sales and support communications between you and us.

Where you click a link in a message sent through Cast, you are taken to a destination chosen by the sender (our customer). We are not responsible for the privacy practices of those destinations.

3.Data we collect about customers

When you sign up for Cast or contact us, we collect:

4.Data we process when our customers send messages

When you, as our customer, use Cast to send messages, we process the following categories of data on your behalf as your processor:

You, our customer, are the data controller for this category of data. You are responsible for having a lawful basis to process it and for honoring recipients' rights. We process this data only on your documented instructions, except where we are required to act for fraud prevention, AUP enforcement, or legal compliance.

5.How we use personal data

We use the data described above for the following purposes:

• Provide the Service — authenticate your account, route and deliver messages, render dashboards, charge fees, generate invoices.
• Onboarding and KYC — verify your identity and business, register sender IDs, submit WABA verification.
• Customer support — respond to your questions, troubleshoot issues, investigate disputes.
• Service improvement — analyze usage patterns to improve performance, detect bugs, and plan features. We use aggregated and de-identified data wherever practical.
• Fraud and abuse prevention — detect spam, fraud, and AUP violations through automated screening of traffic patterns and content fingerprints.
• Legal compliance — meet our obligations to carriers, Meta, regulators, and law enforcement, including responding to lawful requests for data.
• Marketing — send you product updates and relevant offers, only where permitted by applicable law and where you have not opted out.

6.Legal bases (GDPR, POPIA, UAE PDPL)

Where the EU General Data Protection Regulation, the South African Protection of Personal Information Act (POPIA), or the UAE Personal Data Protection Law applies to our processing, we rely on the following lawful bases:

• Performance of a contract — to provide the Service you have signed up for.
• Legal obligation — to comply with carrier rules, Meta requirements, tax law, and lawful authority requests.
• Legitimate interests — to keep the platform secure, prevent fraud and abuse, and grow our business. We balance these interests against your privacy rights.
• Consent — for direct marketing where required by law, and for any optional cookies or tracking. You can withdraw consent at any time.

For messaging data we process on behalf of our customers (Section 4), the lawful basis must be established by the customer with their recipients before they send.

7.Who we share data with

We share personal data only with the parties listed below, and only to the extent necessary for the purpose. Approximate operating region is shown for each.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

8.International transfers

WAYVZ Group operates from Lebanon, the UAE, and South Africa. Our application and database infrastructure runs on a single dedicated server hosted by Hetzner in Germany (EU); other regions are not available yet. Message delivery requires data to flow to mobile network operators in the country of the recipient, which may be anywhere in the world.

Where we transfer personal data from a region with stricter data-protection law (such as the European Economic Area or South Africa) to one with weaker protections, we rely on appropriate safeguards including, where applicable, standard contractual clauses, adequacy decisions, or specific consent where required.

9.How long we keep data

We retain personal data only as long as needed for the purpose, plus any period required by law or by carrier and aggregator obligations.

When a contact reaches a business by tapping a click-to-WhatsApp ad, Meta sends a click identifier with the message. We delete that identifier after 90 days, and in no case later than 180 days, whether or not the account has switched on the retention windows below. It is never written to our webhook logs. At the same time we delete our record of that tap, which holds the phone number and the ad, and add it to a daily count per ad that names no one. The ad's ID and headline stay on the contact's record and in their event history until those are removed under the windows below or by an erasure request.

Retention windows are configurable per account; defaults are 400 days for message content, 400 days for delivery, engagement and click events, and 730 days for the account activity audit trail. Raw inbound webhook payloads follow the same configurable schedule, with a default of 30 days. This configurable retention engine is rolling out and is off until enabled for an account; until it is enabled, those categories are kept without an enforced deletion window. Operational system logs, including the log of incoming WhatsApp webhooks, are retained for 30 days, and login audit records for 365 days, on an enforced schedule already in place.

10.Security

We protect personal data using a combination of technical and organizational measures appropriate to the risk, including:

• Encryption in transit (HTTPS for all web traffic, TLS for SMTP and API endpoints).
• Hashed and salted password storage; provider credentials encrypted with AES-256 and API keys stored hashed.
• Role-based access control on internal systems; principle of least privilege for staff.
• Audit logging of administrative access.
• Regular patching of operating systems and dependencies.
• Incident-response procedures.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law. Our incident-response procedure for handling and reporting a breach is documented internally.

11.Your rights

Depending on the law that applies to you, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to our legal retention requirements.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where we rely on consent.
• Lodge a complaint — with your local data-protection authority. South African residents may complain to the Information Regulator. UAE residents may contact the UAE Data Office.

To exercise any of these rights, email cast@wayvzgroup.com. We respond within 30 days. We may need to verify your identity before acting on a request.

Recipients of messages sent by our customers: if you received a message via Cast and want to exercise rights over that data, the controller is the customer who sent the message (their identity is in the message). We will assist them in responding, but we cannot generally act on the recipient's request directly.

12.Cookies and tracking

Our marketing site and dashboard use a small set of cookies:

• Essential cookies — for authentication, session, and CSRF protection. These cannot be disabled if you wish to use the dashboard.
• Preference cookies — to remember settings such as language and time zone.
• Analytics cookies — to understand site usage in aggregate. We use first-party analytics where possible.

We do not use third-party advertising cookies. Short links generated through Cast (slnk.ai) record click events but do not place cookies on the recipient's device.

13.Children

Cast is a B2B service intended for use by businesses and adult professionals. It is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child's data has been provided to us in error, please contact us so we can remove it.

14.Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version at this URL with a new effective date. For changes that materially affect how we use your personal data, we will notify active customers by email at least 14 days before the change takes effect.

15.Contact us

For privacy questions, data-subject requests, or to exercise any of the rights described above:

• Email: cast@wayvzgroup.com
• Mail: WAYVZ, Qubic Square BC, Sin El Fil, Beirut, Lebanon

If you are a recipient of a message sent through Cast and want to opt out of further messages, reply STOP to an SMS or use the WhatsApp opt-out option. Your opt-out is enforced by Cast at the platform level for that sender.