WhatsApp & Messaging Policy
Last updated: November 1, 2026
WhatsApp appointment notifications, authentication and international processing.
Scope and roles
Barber, Coiffeur and Bellezza include WhatsApp integration. SMS and WhatsApp-free packages are not offered. The salon is controller for appointment/customer data; CBBDigital processes them on documented instructions. CBBDigital separately controls merchant accounts, billing, support and security. Meta/WhatsApp roles follow their applicable service and data-processing terms. Due to demand, new installations start 14 days after order acceptance; actual channel activation also requires completed technical and legal prerequisites. The documented 13 stop commands below match the webhook.
Opt-in, OTP and withdrawal
Before business-initiated messages, recipients provide their number and valid opt-in naming the salon. A requested authentication OTP verifies current channel access only, not identity, exclusive ownership or general consent. Notification choice is separate from appointment service terms and can be withdrawn without cancelling the appointment. Public booking does not collect marketing consent. Only the relevant approved authentication/utility templates and valid messaging windows are used. STOP, İPTAL, IPTAL, DURDUR, RET, UNSUBSCRIBE, ABMELDEN, STOPZETTEN, AFMELDEN, ARRET, ARRÊT, DESABONNER, DÉSABONNER are the documented exact, case/space-normalised stop words; suppression disables notifications without an automatic confirmation-message promise.
Data and security
Outgoing template variables, queued text, message identifiers and delivery states may be processed. Incoming text is checked transiently in memory for stop words, not stored in webhook logs; sender, identifier, event and timestamp can be retained. Do not send health data, identity documents or card details. The platform does not claim a fully staffed inbox or absolute end-to-end encryption for every Cloud API processing step. Sender registration, Meta approval, access permissions, quotas and recipient preferences remain necessary; subscription purchase does not bypass them. wa_id identifies the channel sender, not legal identity or general consent.
Fees and providers
The displayed subscription price includes integration access.. Meta messaging/usage charges are not included and remain the business’s responsibility under the agreed provider/billing arrangement. No universally free messaging or guaranteed Meta approval is promised. See https://www.whatsapp.com/legal/business-policy and https://www.whatsapp.com/legal/business-data-processing-terms .
Protection, transfers and rights
Applicable EU GDPR, UK GDPR, UK Data Protection Act 2018, UK Addendum and Swiss FADP are addressed by actual roles and processing. The UK supervisory authority is the Information Commissioner’s Office (ICO). The privacy, provider and deletion notices explain hosting in Helsinki, global processing, valid transfer instruments, retention and rights. Contact info@cbbdigital.us or the relevant salon. Regulator/representative obligations are assessed separately, not waived by this policy.
WhatsApp infrastructure and provider roles
Hosting is through Hetzner Online GmbH on the selected Helsinki, Finland server; Cloudflare, Inc. provides CDN/network security; Google LLC Workspace provides business email. Applicable provider data-processing terms have been accepted through the relevant account processes and retained in a restricted archive. Public provider/DPA links, purposes and roles appear in the provider directory. Stripe has processor and independent-controller roles depending on payment, fraud prevention and statutory functions. Meta/WhatsApp and optional Calendar connections follow their own applicable terms.
WhatsApp record retention
Access controls, protected secrets, TLS and audit trails support proportionate security. Contract IP/User-Agent metadata has a separate 90-day expiry/cleanup process. Completed operational message, webhook, provider-call and Calendar logs follow the configured operational retention policy (default 90 days); this does not automatically delete appointment, staff, consent, billing or contract evidence. Records are retained for their actual purposes and applicable statutory periods, then reviewed for deletion or return. Restricted backups are treated separately; no immediate per-record backup erasure or fixed expiry schedule is promised. Operational log retention is configurable within 7–3650 days; the default is 90 days.
Credit Usage Table & Extra Credit Terms
1. Fixed Package Tiers & Universal Credit Pool: CBBDigital subscription tiers (Standard 500 Email + 500 WhatsApp Credits, Plus 2,000 + 2,000, Premium 5,000 + 5,000, Elite 10,000 + 10,000) are offered at fixed USD starting prices regardless of the merchant's country. On 3, 6, and 12-month billing cycles, full term credits are provisioned upfront as a pooled balance.
2. Recipient Calling-Code Deduction & Non-Marketing Rule: Marketing/promotional messaging is strictly prohibited on the platform; only approved Authentication (OTP) and Appointment Utility templates are permitted. Central WhatsApp credit deduction depends solely on the recipient's international phone calling code per the 47-region table and applies strictly to delivered messages; undelivered messages consume 0 credits. Transactional emails consume 1 Email Credit worldwide. Merchants connecting their own Meta WhatsApp Business account (BYON) consume 0 CBBDigital credits.
3. Cumulative Monthly Volume Tiers & Extra Credit Rates: When purchasing extra credits, the customer's active package monthly base credits plus any prior extra credits bought during the current calendar month are combined with the newly added credits to determine the unit rate tier (e.g. an active 5,000-credit package adding 5,000 extra credits reaches 10,000 cumulative volume and unlocks the 10,000+ rate for those 5,000 credits). Minimum order per transaction is $3.00 USD:
| Cumulative Monthly Credit Volume | 1 Email Credit Rate | 1 WhatsApp Credit Rate |
|---|---|---|
| 1 – 4,999 Credits | $0.0006 USD | $0.0030 USD |
| 5,000 – 9,999 Credits | $0.0005 USD | $0.0025 USD |
| 10,000+ Credits | $0.0004 USD | $0.0023 USD |
Open Full Interactive Credit Table & Calculator Page (/en/credits/) ↗
Show Official 47-Market WhatsApp Credit Schedule (47 Rows)
| Recipient Market & All Included Permitted Countries | Calling Code | Credits per Delivered Message | Standard (500) Msgs | Elite (10,000) Msgs |
|---|---|---|---|---|
| Türkiye (Republic of Türkiye and +90 Northern Cyprus numbers) | +90 | 1 Credit | 500 | 10,000 |
| Colombia | +57 | 1 Credit | 500 | 10,000 |
| India | +91 | 2 Credits | 250 | 5,000 |
| Sri Lanka | +94 | 2 Credits | 250 | 5,000 |
| North America (United States +1 and Canada +1) | +1 | 4 Credits | 125 | 2,500 |
| Nepal | +977 | 4 Credits | 125 | 2,500 |
| Egypt | +20 | 4 Credits | 125 | 2,500 |
| Bangladesh | +880 | 4 Credits | 125 | 2,500 |
| Rest of Africa (Algeria +213, Angola +244, Benin +229, Botswana +267, Burkina Faso +226, Burundi +257, Cameroon +237, Chad +235, Republic of the Congo +242, Eritrea +291, Eswatini +268, Ethiopia +251, Gabon +241, Gambia +220, Ghana +233, Guinea-Bissau +245, Ivory Coast +225, Kenya +254, Lesotho +266, Liberia +231, Libya +218, Madagascar +261, Malawi +265, Mali +223, Mauritania +222, Mozambique +258, Namibia +264, Niger +227, Rwanda +250, Senegal +221, Sierra Leone +232, Somalia +252, South Sudan +211, Sudan +249, Tanzania +255, Togo +228, Tunisia +216, Uganda +256, Zambia +260, Zimbabwe +263) | +211, +213, +216, +218, +220, +221, +222, +223, +225, +226, +227, +228, +229, +231, +232, +233, +235, +237, +241, +242, +244, +245, +249, +250, +251, +252, +254, +255, +256, +257, +258, +260, +261, +263, +264, +265, +266, +267, +268, +291 | 4 Credits | 125 | 2,500 |
| Israel | +972 | 6 Credits | 83 | 1,666 |
| Nigeria | +234 | 7 Credits | 71 | 1,428 |
| Brazil | +55 | 7 Credits | 71 | 1,428 |
| Iraq | +964 | 8 Credits | 62 | 1,250 |
| Other Markets — All Remaining WhatsApp-Permitted Countries & Territories (American Samoa +1-684, Anguilla +1-264, Antigua and Barbuda +1-268, Aruba +297, Ascension Island +247, Bahamas +1-242, Barbados +1-246, Belize +501, Bermuda +1-441, Bhutan +975, British Indian Ocean Territory +246, British Virgin Islands +1-284, Brunei +673, Cape Verde +238, Cayman Islands +1-345, Central African Republic +236, Comoros +269, Cook Islands +682, Curaçao and Caribbean Netherlands +599, Democratic Republic of the Congo +243, Djibouti +253, Dominica +1-767, Equatorial Guinea +240, Falkland Islands +500, Faroe Islands +298, French Guiana +594, French Polynesia +689, Greenland +299, Grenada +1-473, Guadeloupe / Saint Barthélemy / Saint Martin +590, Guam +1-671, Guinea +224, Guyana +592, Kiribati +686, Kyrgyzstan +996, Macau +853, Maldives +960, Marshall Islands +692, Martinique +596, Mauritius +230, Micronesia +691, Montserrat +1-664, Myanmar +95, Nauru +674, New Caledonia +687, Niue +683, Northern Mariana Islands +1-670, Palau +680, Palestine +970, Réunion and Mayotte +262, Saint Helena +290, Saint Kitts and Nevis +1-869, Saint Lucia +1-758, Saint Pierre and Miquelon +508, Saint Vincent and the Grenadines +1-784, Samoa +685, São Tomé and Príncipe +239, Seychelles +248, Sint Maarten +1-721, Solomon Islands +677, South Korea +82, Suriname +597, Timor-Leste +670, Tokelau +690, Tonga +676, Trinidad and Tobago +1-868, Turks and Caicos Islands +1-649, Tuvalu +688, U.S. Virgin Islands +1-340, Vanuatu +678, Wallis and Futuna +681) | +82, +95, +224, +230, +236, +238, +239, +240, +243, +246, +247, +248, +253, +262, +269, +290, +297, +298, +299, +500, +501, +508, +590, +592, +594, +596, +597, +599, +670, +673, +674, +676, +677, +678, +680, +681, +682, +683, +685, +686, +687, +688, +689, +690, +691, +692, +853, +960, +970, +975, +996, +1-242, +1-246, +1-264, +1-268, +1-284, +1-340, +1-345, +1-441, +1-473, +1-649, +1-664, +1-670, +1-671, +1-684, +1-721, +1-758, +1-767, +1-784, +1-868, +1-869 | 8 Credits | 62 | 1,250 |
| Mexico | +52 | 9 Credits | 55 | 1,111 |
| Rest of Middle East (Bahrain +973, Jordan +962, Lebanon +961, Yemen +967) | +961, +962, +967, +973 | 10 Credits | 50 | 1,000 |
| South Africa | +27 | 10 Credits | 50 | 1,000 |
| Saudi Arabia | +966 | 11 Credits | 45 | 909 |
| Rest of Asia-Pacific (Afghanistan +93, Australia +61, Cambodia +855, China +86, Fiji +679, Japan +81, Laos +856, Mongolia +976, New Zealand +64, Papua New Guinea +675, Philippines +63, Taiwan +886, Tajikistan +992, Thailand +66, Turkmenistan +993, Uzbekistan +998, Vietnam +84) | +61, +63, +64, +66, +81, +84, +86, +93, +675, +679, +855, +856, +886, +976, +992, +993, +998 | 12 Credits | 41 | 833 |
| Rest of Latin America (Bolivia +591, Costa Rica +506, Dominican Republic +1-809 / +1-829 / +1-849, Ecuador +593, El Salvador +503, Guatemala +502, Haiti +509, Honduras +504, Jamaica +1-658 / +1-876, Nicaragua +505, Panama +507, Paraguay +595, Puerto Rico +1-787 / +1-939, Uruguay +598, Venezuela +58) | +58, +502, +503, +504, +505, +506, +507, +509, +591, +593, +595, +598, +1-658, +1-787, +1-809, +1-829, +1-849, +1-876, +1-939 | 12 Credits | 41 | 833 |
| Qatar | +974 | 12 Credits | 41 | 833 |
| Poland | +48 | 13 Credits | 38 | 769 |
| Malaysia | +60 | 14 Credits | 35 | 714 |
| Pakistan | +92 | 15 Credits | 33 | 666 |
| United Arab Emirates (Abu Dhabi, Dubai, and all UAE emirates +971) | +971 | 16 Credits | 31 | 625 |
| Singapore | +65 | 16 Credits | 31 | 625 |
| Rest of Western Europe (Andorra +376, Austria +43, Belgium +32, Republic of Cyprus +357, Denmark +45, Finland +358, Gibraltar +350, Iceland +354, Ireland +353, Liechtenstein +423, Luxembourg +352, Malta +356, Monaco +377, Norway +47, Portugal +351, San Marino +378, Sweden +46, Switzerland +41) | +32, +41, +43, +45, +46, +47, +350, +351, +352, +353, +354, +356, +357, +358, +376, +377, +378, +423 | 18 Credits | 27 | 555 |
| Kazakhstan | +76, +77 | 18 Credits | 27 | 555 |
| Spain | +34 | 20 Credits | 25 | 500 |
| Chile | +56 | 20 Credits | 25 | 500 |
| United Kingdom (England, Scotland, Wales, and Northern Ireland +44) | +44 | 22 Credits | 22 | 454 |
| Rest of Central & Eastern Europe (Albania +355, Armenia +374, Azerbaijan +994, Belarus +375, Bosnia and Herzegovina +387, Bulgaria +359, Croatia +385, Czechia +420, Estonia +372, Georgia +995, Greece +30, Kosovo +383, Latvia +371, Lithuania +370, Moldova +373, Montenegro +382, North Macedonia +389, Serbia +381, Slovakia +421, Slovenia +386) | +30, +355, +359, +370, +371, +372, +373, +374, +375, +381, +382, +383, +385, +386, +387, +389, +420, +421, +994, +995 | 22 Credits | 22 | 454 |
| Morocco | +212 | 23 Credits | 21 | 434 |
| Oman | +968 | 25 Credits | 20 | 400 |
| Indonesia | +62 | 25 Credits | 20 | 400 |
| Argentina | +54 | 26 Credits | 19 | 384 |
| Hong Kong | +852 | 26 Credits | 19 | 384 |
| Romania | +40 | 29 Credits | 17 | 344 |
| Ukraine (+380 — excluding embargoed Crimea, Donetsk, and Luhansk regions under Meta sanctions policy) | +380 | 30 Credits | 16 | 333 |
| France | +33 | 30 Credits | 16 | 333 |
| Italy (Italy and Vatican City +39) | +39 | 30 Credits | 16 | 333 |
| Peru | +51 | 30 Credits | 16 | 333 |
| Hungary | +36 | 35 Credits | 14 | 285 |
| Russia (+7 — excluding +76 and +77 Kazakhstan calling codes) | +7 | 40 Credits | 12 | 250 |
| Kuwait | +965 | 44 Credits | 11 | 227 |
| Netherlands | +31 | 50 Credits | 10 | 200 |
| Germany | +49 | 55 Credits | 9 | 181 |
Sanctions & Service Scope Note: Pursuant to Meta WhatsApp Business Platform trade compliance rules, messaging to or from North Korea (+850), Iran (+98), Cuba (+53), Syria (+963), and the Crimea, Donetsk, and Luhansk regions is prohibited and excluded from all destination rows above.
Optional Meta business connection and Platform Data requests
The salon owner may connect authorized WhatsApp Business assets through Facebook Login for Business. Selecting “Prepare connection” loads Meta's JavaScript SDK; Meta then receives network/browser information under its own terms. The SDK is not loaded merely by opening the connection page. Connection requests process a short-lived authorization code, app-scoped or business-system-user identifiers supplied/validated by Meta, WABA and phone-number IDs, granted permissions and an encrypted access token. App secrets and access tokens are protected server-side and are never displayed to salon customers. Authorizing a connection does not enable payments, notifications, OTP or marketing automatically. Meta account/phone registration, templates and the platform's entitlement/quota checks remain separate.
Local disconnection clears our usable integration credentials and disables WhatsApp and OTP. It does not itself remove your authorization in Meta Business settings; you can also revoke the app there. Signed Meta deauthorization and deletion callbacks are authenticated before processing. A matching integration is disabled; an identifier that cannot be reliably matched is placed in the administrator review queue, not guessed or falsely marked deleted. Data-deletion callbacks return an unguessable confirmation code and status link showing only the request status and public response. The CBBDigital administration receives an email notification.
Remaining Meta-derived data, processor instructions, lawful retention and account-link mapping are reviewed before completion. Removing a WhatsApp integration does not automatically erase unrelated salon appointments, subscriptions or records subject to mandatory retention. Applicable statutory deadlines in this policy continue to apply; the internal 28-day target does not authorize an extension. OAuth state is session-bound, expires after ten minutes, and expired state rows are opportunistically pruned after one day when new flows start. Encrypted integration credentials remain only while the connection is retained; minimal pseudonymous request, review and audit evidence is retained under the disclosed rights/security and legal-claims schedule, not an automatic promise to erase every backup instantly.