Data controller
The controller of the data collected through the UnlimitedMessaging site is the company operating this service.
Data collected
Through our forms (demo and waitlist) and app usage, we collect the following data:
| Data | Description | Required |
|---|---|---|
| Phone number | Country code + local number, stored on our servers to send your WhatsApp demo message | Yes (demo) |
| Email address | Collected via the waitlist form - used to keep you informed about the service | Yes (waitlist) |
| IP address | Collected automatically for security and abuse prevention purposes | Automatic |
| User-Agent | Browser and OS information, for technical purposes | Automatic |
| Timestamp | Date and time of submission | Automatic |
| Message content | Text of WhatsApp messages sent and received through our service, stored in our database to display your messaging history | Yes (app) |
| Interlocutor phone number | Phone number or WhatsApp identifier of the message recipient or sender | Yes (app) |
| WhatsApp session data | Session credentials used to maintain your SIM's connection to the WhatsApp network, stored encrypted | Yes (app) |
| Mailbox credentials | Email address, IMAP/SMTP servers, username and password or app password that you provide to connect your own mailbox. The password is stored encrypted (AES-256-GCM) in a separate service and is never displayed again nor sent back to the browser or the API | Yes (email channel) |
| Email content and metadata | For each email sent or received: recipient or sender address, subject, text and HTML body, attachments and threading headers (Message-ID, In-Reply-To, References), stored in the same way as WhatsApp messages | Yes (email channel) |
| Bounce history | Addresses that permanently failed (hard bounce) for a connected mailbox, used to pause sending to them | Automatic (email channel) |
Processing purposes
Your data is collected for the following reasons:
- Provide the WhatsApp messaging service: sending and receiving messages through SIMs connected to your account
- Provide the email channel: sending emails from your own mailbox, copying them into its Sent folder (Gmail files them itself), receiving and displaying emails in your dashboard, and delivering them to your webhook
- Handle bounces: pausing addresses that permanently fail, to protect your sender reputation
- Keep you informed about UnlimitedMessaging offers and updates (our own service only - never third parties)
- Abuse and spam prevention (IP-based rate limiting)
- Service improvement and anonymised statistical analysis
- Compliance with legal obligations
The legal basis of the processing is your explicit consent, expressed when submitting the form (Article 6.1.a of the GDPR).
Your personal data is never sold, rented, or shared with third parties. It may be used to contact you at launch and keep you informed of our own offers and services. You can withdraw your consent at any time by writing to [email protected].
Retention period
Your data is kept for a limited period proportionate to the purpose of the processing:
- Phone number: 12 months maximum from collection
- IP address and technical data: 6 months for security purposes
- Mailbox credentials: deleted when you disconnect the mailbox or delete your account
- Bounce pause: an address that permanently fails is paused for 30 days for that mailbox; the bounce history is kept
- Email content and metadata: kept under the same conditions as your WhatsApp messages
After this period, your data is automatically deleted from our systems or irreversibly anonymized.
Data sharing
Your personal data is never sold nor shared with third parties for commercial purposes.
It may only be shared in the following cases:
- To our technical service providers strictly necessary for the service (hosting, notifications), bound by GDPR-compliant data processing agreements
- To your own SMTP server: the emails you send are handed, on your instruction, to your email provider's server and leave from your own address, with your bare address in the From header (no display name added)
- Upon judicial request or legal obligation
- To UnlimitedMessaging administrators, for messages received on shared (system) SIMs: when you send a message via a system SIM, any replies from your contact are visible to the UM team - not to you. This behaviour is inherent to how shared SIMs work and you are informed of it at the time of sending.
Your rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:
- Right of access - obtain a copy of the data concerning you
- Right to rectification - correct inaccurate or incomplete data
- Right to erasure - request deletion of your data
- Right to object - object to certain processing
- Right to restriction - temporarily restrict processing
- Right to portability - receive your data in a readable format
- Right to withdraw consent - at any time, without justification
To exercise these rights, contact us at [email protected]. We will respond within a maximum of 30 days.
You also have the right to lodge a complaint with your national data protection authority (e.g. CNIL in France): www.cnil.fr.
Data security
We implement appropriate technical and organizational measures to protect your data:
- Encrypted connections via HTTPS (TLS)
- Restricted and authenticated database access
- Protection against SQL injection via prepared statements (PDO)
- Rate limiting per IP and session
- CSRF tokens to secure forms
- Mailbox passwords encrypted with AES-256-GCM in a separate service, never displayed again nor sent back to the browser or the API
- Mandatory TLS or STARTTLS for connections to mail servers: plain-text connections are refused
- Read-only access to your inbox: we never delete, move or modify your emails
- Received emails displayed in an isolated viewer, with remote images blocked by default
In the event of a data breach likely to cause a risk to your rights and freedoms, we commit to informing you within the timeframes set by the GDPR.
Need help?
Our team is here to answer your questions.
Go to contact page
Response within 1 business day