Privacy Policy

Who we are

This website and Eccos are operated by a sole trader (empresario individual) registered in Spain:

Name

Santiago García Monsalve

Tax ID (NIF)

21105416H

Address

Passeig del Riu, 54, planta 1º, puerta 2ª — 08241 Manresa (Barcelona), Spain

Phone

+34 697 98 18 79

Email

hello@imsanti.dev

The full legal notice required by Spanish law (LSSI-CE) is at /aviso-legal (in Spanish).

Two modes, two very different roles

Self-hosted. The Eccos software is open source (MIT) and businesses can deploy it entirely on their own Cloudflare account. In that case we process no personal data at all: the deployment talks to Meta directly, nothing is ever sent to us, and we have no access to it. This policy simply does not apply to data handled by a self-hosted deployment — the business operating it is responsible for its own deployment.

Eccos Cloud. The hosted version, which we operate (currently in early access, not yet generally available). Here Santiago García Monsalve acts as a data processor within the meaning of Article 28 GDPR, on behalf of each client business, which remains the data controller for its own conversations. A data processing agreement is put in place with each Eccos Cloud client.

This website. For data you send to the site itself — for example when you email us — Santiago García Monsalve is the data controller.

Data processed in Eccos Cloud

The gateway stores four kinds of records for each connected WhatsApp Business Account:

• Configuration — the client’s gateway settings: account identifiers and the endpoint events are forwarded to.
• Inbound events — incoming messages and status events received from the WhatsApp Cloud API, including message content and the sender’s phone number.
• Outbound messages — messages the client asks the gateway to send, with their delivery status.
• Delivery queue — pending forwards to the client’s endpoint; each entry also contains the full message payload until it is redacted (see retention below).

This data is processed for one purpose only: delivering each business its own messages and events. It is never combined or cross-referenced across businesses, never sold, rented, or shared with data brokers, and never used for advertising or to train models.

Purpose and legal basis

• Eccos Cloud: we process data only on the documented instructions of the client, under the data processing agreement (Article 28 GDPR). The client, as controller, is responsible for its own legal basis towards the people it messages.
• Email to this site: we process your address and the content of your message to respond to you — steps taken at your request prior to a contract (Article 6(1)(b) GDPR) and our legitimate interest in handling correspondence (Article 6(1)(f)).
• Website analytics: this site uses Umami, a privacy-focused analytics tool that works without cookies and measures visits in aggregate. No advertising trackers are used.

Retention

• Message content — inbound events, outbound messages, and the payload stored in the delivery queue — is kept for 30 days by default. Each client can configure this between 7 and 90 days.
• Delivery records are then redacted: the message payload is removed and only delivery metadata (such as timestamps and delivery outcome) remains, for up to 90 days.
• Point-in-time recovery. The Cloudflare Durable Objects underlying the service keep a 30-day restorable history of their storage. The effective worst-case retention is therefore the configured retention plus up to 30 days. This is a backup mechanism operated by our infrastructure subprocessor; we prefer to declare it rather than round it away.
• Correspondence with this website is kept as ordinary business correspondence, for as long as the matter it concerns and any legal obligations require.

A gateway, not a system of record

Eccos is a pass-through gateway. The authoritative copy of every conversation lives in the systems behind the endpoint each business connects — not in the gateway. Retention inside Eccos Cloud exists only so messages can be delivered reliably, retried when an endpoint is down, and recent problems diagnosed. If your business needs an archive of its WhatsApp conversations — for example for clinical or customer records — you must keep it in your own systems; the gateway will not keep one for you.

Special categories of data

Message content is whatever end users choose to type. Businesses in fields such as healthcare may therefore receive special-category data (Article 9 GDPR) through their conversations — a patient describing symptoms to a clinic, for instance. Eccos Cloud treats all message content as opaque: it is forwarded and briefly stored for delivery, not inspected or classified. It remains the client’s responsibility, as controller, to have a lawful basis for processing such data and to judge whether WhatsApp is an appropriate channel for it.

To be explicit about what we do not offer: Eccos Cloud currently holds no security certifications such as ISO 27001, and no HIPAA Business Associate Agreement is available.

Where the data lives; international transfers

Eccos Cloud runs on Cloudflare Workers and Durable Objects. The Durable Objects that store gateway data are pinned to Cloudflare’s European Union jurisdiction, so message content at rest is confined to the EU. We deliberately do not call this “total data residency”, because it is not: Workers execute globally at Cloudflare’s edge, and the Durable Object identifier is registered outside the jurisdiction for billing purposes.

Separately, the WhatsApp Cloud API itself processes messages in Meta’s data centers — by default in the United States — unless the business enables Meta’s Local Storage feature, which confines message content to a chosen region. Pinning the gateway to the EU does not confine what passes through Meta.

Where data leaves the European Economic Area, the transfers rely on the safeguards in each provider’s data processing terms: the EU Standard Contractual Clauses and, where the provider holds a current certification, the EU–U.S. Data Privacy Framework.

Subprocessors

• Cloudflare, Inc. — hosting infrastructure (Workers, Durable Objects, storage). Privacy policy.
• Meta Platforms — the WhatsApp Cloud API through which all messages necessarily flow. Privacy policy.

Eccos Cloud uses no other subprocessors.

Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. To exercise them, email hello@imsanti.dev with enough information to identify you and your request.

If you are an end user of a business that uses Eccos Cloud — for example, a customer or patient who messaged that business on WhatsApp — that business is the controller of your data, and your request should go to it. See /data-deletion for how deletion works in practice. As processor, we assist each controller in responding to such requests, as Article 28 requires.

You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

Related pages

Terms of Service · Data Deletion · Aviso legal · About Eccos