Your customers’ conversations are yours.
What happens to a message after it reaches iChatUp, who can see it, where it lives, and how to delete it. Last reviewed 12 Oct 2026.
Workspace isolation
Every conversation, contact, booking, payment and fact is stored against your workspace and can only be read through your workspace’s session. Cross‑workspace access is a tested invariant in our test suite, and a security audit in September 2026 reviewed tenant isolation, secrets handling, payment replay, server‑side request forgery and script injection.
Transport and secrets
- Encrypted in transit. The site and the app are served over HTTPS; WhatsApp traffic to Meta and to your linked device is encrypted by those channels.
- Secrets encrypted at rest. Meta access tokens and payment‑gateway keys are stored encrypted in the database.
- Verified webhooks. Every webhook from Meta is signature‑checked before it is processed; requests from the linked‑device engine carry a shared secret.
- Login hardening. Rate limits on sign‑in and password reset, e‑mail verification, and Google sign‑in as an option.
AI providers
To write a reply, the relevant message text and your business facts are sent to our AI providers — OpenAI and Google — over their APIs. We use API terms that do not use customer data to train their models, we send what is needed to answer and nothing more, and iChatUp itself does not train models on your data. Voice notes are transcribed the same way. Receipts you ask the AI to verify are read by the model and stored in your workspace only.
Where data lives, and backups
Data is held in a PostgreSQL database on servers we operate. Backups are taken daily; the health check that runs every five minutes raises an alert if a backup is late, so a silent failure cannot go unnoticed. Uploaded files (menus, brochures, receipts) are stored per workspace.
Payments
Subscriptions are processed by a PCI‑compliant payment partner (Razorpay on ichatup.com; Curlec by Razorpay on ichatup.my). Card details never touch our servers. Payments your customers make to you go directly to your own payment method; iChatUp only reads and records the confirmation.
Who can see what
- You and your team see your workspace, with seats you control.
- Human replies are labelled with the person’s name; AI replies show the facts they used.
- Our staff access a workspace only to support you, on request, and the super‑admin console shows account and billing state, not your conversations by default.
- Country licensees (for example in Malaysia) see the accounts they sell to, never other customers’ data.
Deleting your data
Clear chat history, delete business memory, disconnect WhatsApp or delete the whole account from the dashboard at any time, or send a request as described on the data deletion page. Deletion is permanent.
Account safety on WhatsApp
On a QR‑linked number iChatUp is reply‑only and rate‑limited; broadcasts run only on the official WhatsApp API with Meta‑approved templates, real opt‑ins and automatic STOP handling. Number health (token validity, quality rating) is checked daily and shown on your dashboard. Read the account‑safety guide.
Reporting a vulnerability
Found something? Write to support@ichatup.com or message us on WhatsApp. Our security.txt carries the same contact. We respond to every report and credit researchers who ask to be credited.
Questions
Is my customers’ data used to train AI models?
No. Conversation text is sent to our AI providers (OpenAI and Google) only to produce your replies, under API terms that do not use that data to train their models. iChatUp does not train models on your data either.
Where is my data stored?
In a PostgreSQL database on servers we operate, with every record scoped to your workspace. Backups are taken daily and monitored; a missed backup raises an alert.
Can I delete everything?
Yes — chats, business memory, contacts and your account can be deleted from the dashboard at any time, or by request to our privacy address. See the data deletion page.
Do you see my card details?
No. Billing is processed by our PCI-compliant payment partner; card details never touch our servers.
Is iChatUp affiliated with Meta?
No. iChatUp is an independent product built on Meta’s official WhatsApp Cloud API and on linked-device connections. We are not affiliated with Meta Platforms, Inc.
Policies: Privacy · Terms · Refunds · Data deletion