Privacy policy

Who we are

Courtney Evans Holdings Limited(“CEH”, “we”, “us”, “our”) is a company registered in England and Wales (Company no. 07384166). We operate a software platform and related services, and we act as an independent Tech Provider on the WhatsApp Business Platform. This policy explains what personal data we collect in connection with our services, how we use it, who we share it with, and your rights under UK GDPR and the Data Protection Act 2018.

Contact: contact@cehltd.uk

Data we collect

Account data: name, email address, phone number, business name, role.

Usage data: pages visited, features used, session duration, IP address, browser type.

Customer data processed on behalf of our business customers: when business customers use our platform to manage their own customers, we process personal data about those individuals (such as names, phone numbers, and booking history) as a data processor on the business customer's behalf.

Messaging data: when business customers integrate our platform with WhatsApp Business, we process message content, contact details, and message metadata necessary to provide the service.

Why we process your data

• To provide the services you signed up for
• To communicate with you about your account
• To improve our services based on usage patterns
• To comply with legal obligations
• To prevent fraud and abuse

Legal basis

We rely on the following legal bases under UK GDPR:

Contract: to deliver the services you signed up for.

Legitimate interests: to improve our services and prevent abuse.

Legal obligation: where required by law.

Consent: for optional features such as marketing emails, where applicable.

How we share data

We share data only with the following categories of recipient. Sub-processors that host or process data on our behalf:

• Supabase (Frankfurt, EU): primary database and authentication
• Vercel (EU): web application hosting
• Hetzner (Falkenstein, EU): workflow automation
• Anthropic (US): AI assistant for message replies, no training on customer data
• Meta Platforms Inc. (global): WhatsApp Business Platform infrastructure

We also disclose data to authorities where legally required.

We do not sell personal data. We do not use customer message content for any purpose other than delivering the service, including not for marketing or AI model training.

WhatsApp Business and our role as a Tech Provider

We integrate with the WhatsApp Business Platform as an independent Tech Provider registered with Meta Platforms Inc. When a business customer connects its WhatsApp Business number to our platform:

• The business customer is the data controller of all message content sent to or from that number
• CEH acts as the data processorunder UK GDPR Article 28, processing data on the business customer's documented instructions
• Meta provides the underlying WhatsApp Business Platform infrastructure; its terms and privacy policy apply to all WhatsApp message delivery
• We onboard the business customer's WhatsApp Business Account through Meta's Embedded Signup, manage message templates, send and receive messages, and subscribe to relevant webhooks on the business customer's behalf

Business customers remain responsible for ensuring they have a lawful basis to message their own customers via WhatsApp and for complying with Meta's WhatsApp Business Messaging Policy.

International transfers

Some providers (such as Anthropic) are based outside the UK/EEA. These transfers are protected by Standard Contractual Clauses and the UK International Data Transfer Addendum.

How long we keep data

• Account data: while your account is active, plus 12 months after closure
• Usage logs: 12 months
• Billing records: 7 years (UK tax law)
• Customer data processed for business customers: per the business customer's instructions

Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data (“right to erasure”)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent where processing relies on consent
• Complain to the UK Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email contact@cehltd.uk.

Cookies

Our platform uses essential cookies for authentication and session management. We use basic analytics to understand usage. We do not use marketing or tracking cookies without consent.

Data deletion

To request deletion of your personal data, email contact@cehltd.ukwith the subject line “Data deletion request”. Include the email address associated with your account. Full details are on our Data deletion page.

We will action verified requests within 30 days and confirm completion by email. Some records are retained where law requires, in particular billing and tax records for 7 years under UK tax law. Audit logs are retained for 12 months for fraud and security review.

If you are an end customer of a business that uses our platform and you want your message data deleted, please contact that business directly. They are the data controller and the deletion instruction must come from them.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to account holders.

Contact

For any privacy questions, contact contact@cehltd.uk.