Legal

Privacy Policy

How the CodeStrux Tech App collects, uses, and protects personal data.

Effective date: 2026-06-03

This Privacy Policy explains how CodeStrux Tech (“we”, “us”) handles personal data in connection with the CodeStrux Tech App — a console that businesses use to send and receive messages with their customers over the WhatsApp Business Platform.

We designed the CodeStrux Tech App for businesses that must demonstrate lawful, consent-based customer messaging. This policy describes the data we process, why, the legal bases we rely on, and the rights available to the people whose data we hold.

Who we are and our role

CodeStrux Tech operates the CodeStrux Tech App. For data about the business users (agents and administrators) who sign in to the console, we act as a data controller.

For the personal data of a business’s own customers — phone numbers, message content, and consent records that flow through the platform — the business that operates the workspace is the controller and we act as its data processor, handling that data only on the business’s documented instructions. The WhatsApp Business Platform, provided by Meta, acts as a further processor for message transmission.

Information we collect

We collect the following categories of personal data:

  • Account and agent data — name, email, username, role, and organization, provided through our identity provider (Keycloak / OpenID Connect) when an agent signs in.

  • Customer conversation data — the phone numbers, message text, media, and delivery/read status exchanged between a business and its customers over WhatsApp, plus message metadata (timestamps, direction, template used).

  • Consent and opt-in records — evidence that a customer agreed to be contacted, including the timestamp, source, channel, and legal basis recorded at the point of opt-in.

  • Technical and usage data — IP address, browser and device information, and diagnostic logs needed to operate, secure, and troubleshoot the service.

  • Local browser storage — session tokens and interface preferences stored in your browser to keep you signed in and remember settings; we do not use advertising cookies.

How we use information

We use personal data to:

  • Provide the messaging console — route inbound messages to agents, send outbound messages and templates, and show conversation history.

  • Establish and evidence customer consent before the first template message is sent, as required by the WhatsApp Business Messaging Policy.

  • Authenticate users, enforce roles and access control, and keep the service secure.

  • Maintain quality and delivery — surface WhatsApp quality ratings and messaging limits, and diagnose delivery problems.

  • Comply with legal obligations and respond to lawful requests.

Legal bases for processing

Where we act as controller, we rely on the following legal bases under the Costa Rican Law on the Protection of the Person regarding the Processing of their Personal Data (Ley N.º 8968) and, where applicable to a business’s customers, comparable frameworks such as Brazil’s LGPD and Mexico’s LFPDPPP:

  • Consent — for contacting customers over WhatsApp and for any processing that requires it; consent can be withdrawn at any time.

  • Performance of a contract — to provide the service to the businesses that subscribe to it.

  • Legitimate interests — to secure, maintain, and improve the platform, balanced against the rights of the people affected.

  • Legal obligation — where processing is required by law.

WhatsApp and Meta

The CodeStrux Tech App sends and receives messages through the WhatsApp Business Platform operated by Meta Platforms, Inc. When you message a business through the CodeStrux Tech App, your message is transmitted and processed by WhatsApp/Meta in accordance with their own terms and privacy policy.

The CodeStrux Tech App is the application registered with Meta for this integration; if you wish to stop messages or have your data deleted, see our Data Deletion Instructions.

We do not control Meta’s processing of your data and encourage you to review the WhatsApp and Meta privacy policies. WhatsApp is a trademark of Meta Platforms, Inc.; the CodeStrux Tech App is an independent platform and is not endorsed by or affiliated with Meta beyond its use of the WhatsApp Business Platform.

How we share information

We do not sell personal data. We share data only with the sub-processors needed to run the service:

  • Meta Platforms, Inc. (WhatsApp Business Platform) — to transmit and receive messages.

  • Our identity provider — to authenticate agents and administrators.

  • Hosting and infrastructure providers — to operate the databases and servers that store conversation and account data, under confidentiality and data-protection commitments.

  • Authorities and advisers — where required by law, regulation, or legal process.

International data transfers

The platform and its sub-processors may process data in countries other than your own. Where data is transferred across borders, we rely on appropriate safeguards and on the protections offered by the relevant providers. By using the service you understand that message transmission via WhatsApp/Meta may involve international transfers.

Data retention

We retain conversation and consent data for as long as the operating business needs it for the purposes described above and to meet its legal obligations, after which it is deleted or anonymized. Agent account data is kept for the life of the account. A business may instruct us to delete specific records at any time; see Data Deletion below.

Security

We protect personal data with encryption in transit, authenticated access, role-based authorization, and least-privilege handling of credentials. No method of transmission or storage is completely secure, but we work to protect data against unauthorized access, alteration, and loss.

Your rights

Subject to applicable law, you have the right to access, correct, update, or delete your personal data, to object to or restrict certain processing, to data portability, and to withdraw consent. To exercise these rights, contact us using the details below, or, if you are a customer of a business that uses the CodeStrux Tech App, contact that business directly — it is the controller of your conversation data.

Data deletion

You can request deletion of your data at any time. Our Data Deletion Instructions explain exactly what to send, where, and what happens next:

Children's data

The CodeStrux Tech App is a business tool and is not directed to children. We do not knowingly collect personal data from children. If you believe a child’s data has reached us, contact us and we will delete it.

Changes to this policy

We may update this policy to reflect changes to the service or the law. We will revise the effective date above and, where changes are material, take reasonable steps to notify the businesses that use the platform.

Contact us

For privacy questions or to exercise your rights, contact CodeStrux Tech at privacy@codestrux.tech, or by post at San Nicolás, Cartago 30104, Costa Rica.