Privacy Policy

Last updated: March 2026

Message Content

DCBridge does not read, analyze, or use the content of your WhatsApp messages for any purpose beyond delivering them to you. Messages are forwarded to your configured webhook endpoint in real-time and are not retained as a message store.

They are, however, briefly retained where delivery requires it, and we would rather state that plainly than claim otherwise: a copy of the forwarded payload is kept in delivery logs so failed deliveries can be diagnosed and replayed, in the pull-delivery queue until you fetch it or it expires, and in the dead-letter record when delivery has failed outright. Retention periods for each are listed below, and all of it is deleted when you delete your account.

Data We Collect

• Account data: Name, email, hashed password
• Device data: Phone number, connection state, WhatsApp name
• Contact data: Phone numbers and names from WhatsApp contact sync (auto-populated)
• Webhook logs: Delivery status, HTTP status codes, response times (retained 90 days)
• Audit logs: Login events, configuration changes, IP addresses (retained 1 year)
• Signal credentials: Encrypted authentication state for session restoration

Data Retention

• Connection logs: 90 days
• Webhook delivery logs (including the forwarded payload): 90 days
• Pull-delivery queue (including the forwarded payload): 24 hours, or until fetched
• Dead-lettered events (including the forwarded payload): 90 days
• Audit logs: 1 year
• Account data: Until account deletion

Your Rights

You can export all your data via the dashboard or API. You can delete your account and all associated data at any time. Contact support@dcbridge.app for data requests.

Security

All data is encrypted in transit (TLS). Signal protocol credentials are encrypted at rest (AES-256-GCM). Passwords are hashed with bcrypt (cost factor 12). We follow SOC 2 Trust Service Criteria for security controls.