Legal & compliance
This version is maintained in English and requires the recorded approval described below before production acceptance is enabled. This policy explains the service's data roles, data categories, purposes, providers, retention, rights, deletion, and production disclosure requirements.
E2NEXT DEMO (not a production contracting entity) processes account, security, billing, support, and service-operations data for its own service administration purposes. For contact lists, campaign content, consent records, and other data a customer submits about recipients, the customer generally determines the purpose and means of processing and we process that data on the customer's documented instructions, subject to the final DPA and applicable law.
Depending on use of the service, we may process account identity and authentication data; organization membership and roles; connected WhatsApp Business identifiers; contact details; consent and suppression history; templates and campaign configuration; delivery and webhook events; billing and subscription records; support communications; security events; device/session metadata; and operational logs.
We process data to provide and secure the service, authenticate users, operate customer workspaces, execute customer instructions, synchronize provider state, send service communications, bill for paid services, prevent abuse, troubleshoot incidents, comply with law, and improve reliability. The applicable legal basis depends on the data, relationship, and jurisdiction and must be confirmed in the approved policy.
Customers are responsible for providing required notices, obtaining any required consent or other lawful basis, honoring recipient choices, and ensuring that uploaded data and messaging instructions are lawful. We provide suppression and consent-history controls, but those controls do not replace the customer's legal obligations.
We use service providers for infrastructure, object storage, transactional email, monitoring, and other production functions. The maintained subprocessor register is in docs/legal/subprocessors.md and must match the production environment before approval. Meta/WhatsApp receives data necessary to operate the WhatsApp Business Platform under its own terms and policies; counsel must confirm the correct controller/processor characterization for that relationship.
The intended production hosting/data region is Hostinger shared demo VPS - demo traffic only. If data is transferred across jurisdictions, the production service must use any contractual or other transfer safeguards required by applicable law. The deployment evidence and subprocessor register must identify the actual regions used.
Workspace retention controls currently default to 30 days for processed raw webhook rows, 7 days for import files, 24 hours for generated export files, 365 days for workspace audit events, and 365 days for historical campaign-recipient records. Some security, billing, legal, or platform audit records may require separate retention. Workspace and account deletion follow the documented cooling-off, purge, and audit procedures in docs/data-lifecycle.md.
The service uses authentication and session controls, organization-scoped authorization, encrypted credential storage, webhook signature validation, private object storage flows, audit logging for sensitive operations, and other safeguards documented in the repository. Security measures evolve over time; we do not claim certifications or independent attestations that have not actually been obtained.
Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data. Requests concerning a customer's recipient data should normally be directed to that customer first because it controls that data. Requests concerning account/service data can be sent to demo-privacy@e2next.com. We may verify identity and authority before acting.
Authorized workspace users can request supported data exports. Workspace owners can request workspace deletion with confirmation and a cooling-off period; account deletion has separate safeguards. Backup and legally required retention may delay final erasure where permitted by law, and durable lifecycle audit evidence may be retained to prove the request and outcome.
Privacy contact: demo-privacy@e2next.com. Support contact: demo-support@e2next.com. Material versions of this policy are identified by version and effective date; when a new version requires acceptance, the application records the exact accepted version and timestamp.
Terms · Privacy · Acceptable use · Anti-spam