Privacy Policy

Last updated: 30 august 2026
This Privacy Policy explains how IP SLYAMOV YELDAR KANATULY ("we", "us", "our") collects, uses, stores and protects personal data in connection with the OnBir Flow platform available at [https://yourdomain.com] (the "Service").

Company details

IP SLYAMOV YELDAR KANATULY Business identification number (BIN): 900811300816 Registered address: Astana, Nurmagambetova, 14 Contact email: projects@onbir.agency

1. What the Service doesThe Service allows businesses ("Customers") to connect their WhatsApp Business account to the WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc., and to route WhatsApp conversations into their own customer relationship management (CRM) systems. We also provide conversion measurement features that report advertising outcomes back to advertising platforms on the Customer's behalf.

2. Our role: two different situations

Our responsibilities differ depending on whose data is involved.
a) Data of our Customers. When a business registers for the Service, we act as the controller of that business's account data. We decide how it is used to provide and bill for the Service.
b) Data of the Customer's end users. When a person messages our Customer on WhatsApp, we process that conversation strictly as a data processor acting on the Customer's documented instructions. The Customer is the controller of that data. We do not use end-user message content for our own purposes, do not sell it, and do not use it to train machine learning models.

3. Data we collect

Account data (from Customers)
  • Name, business name, email address, phone number
  • Business account identifiers issued by Meta (WhatsApp Business Account ID, phone number ID)
  • Authentication tokens issued by Meta that allow us to act on the Customer's behalf
  • Billing and subscription records
Messaging data (from end users, on behalf of Customers)
  • Phone number and WhatsApp profile name of the person messaging the Customer
  • Message content, including text, and where sent, images, documents, audio and other media
  • Message metadata: timestamps, delivery and read status, message identifiers
  • Where a Customer enables conversation history sync, previously exchanged messages retrieved from the Customer's WhatsApp Business account
Advertising attribution data
  • Click identifiers passed by advertising platforms when a person starts a conversation from an advertisement
  • Conversion events recorded in the Customer's CRM, such as a submitted lead or a completed purchase
Technical data
  • IP address, browser type, device type and access timestamps, collected when a Customer uses our web interface
  • Application logs recording system errors and API activity
We do not intentionally collect special categories of personal data. Customers are responsible for not directing such data through the Service.

4. Why we process this data
  • To connect and maintain the Customer's WhatsApp Business account
  • To deliver messages between the Customer and their end users
  • To synchronise conversations with the Customer's CRM system
  • To measure advertising performance and report conversion events to advertising platforms on the Customer's instruction
  • To provide technical support and investigate faults
  • To bill for the Service and comply with accounting obligations
  • To protect the Service against fraud, abuse and security incidents
Our legal bases are the performance of our contract with the Customer, our legitimate interest in operating and securing the Service, compliance with legal obligations, and, where required, consent.

5. Who we share data with

  • Meta Platforms, Inc. — messages are transmitted through the WhatsApp Business Platform. Meta's handling of this data is governed by its own terms and privacy policy.
  • The Customer's CRM provider — conversations are delivered to the CRM system the Customer has chosen and connected.
  • Advertising platforms — where the Customer enables conversion measurement, we transmit conversion events. Personal identifiers included in these events are hashed before transmission.
  • Infrastructure providers — cloud hosting and database services used to operate the Service.
  • Authorities — where disclosure is required by applicable law.
We do not sell personal data and we do not share it with advertisers for their own independent purposes.

6. International transfers

Our infrastructure providers and Meta operate servers outside the Republic of Kazakhstan. Personal data may therefore be transferred to and processed in other countries. Where such transfers occur, we rely on contractual safeguards with our providers and, where required by applicable law, on the consent of the data subject.

7. How long we keep data

Account data: for the duration of the contract and for 5 years afterwards where required by accounting and tax law
  • Message content and metadata: for as long as the Customer's account is active, unless the Customer sets a shorter retention period
  • Technical logs: 30 days
  • Conversion event records: 12 months
When a Customer terminates the Service, we delete or irreversibly anonymise their data within [X] days, except where retention is legally required.
8. How data is protected

Data is encrypted in transit using TLS. Access tokens and credentials are stored encrypted at rest. Access to production systems is restricted to authorised personnel and protected by multi-factor authentication. We maintain access logging and review it periodically.
9. Your rights

Depending on your jurisdiction, you may have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, and withdrawal of consent.
If you are an end user who messaged one of our Customers and you wish to exercise these rights, please contact that business directly, as they control your data. If you contact us instead, we will forward your request to the relevant Customer.
Requests may be sent to projects@onbir.agency. We respond within 30 days.
10. Deleting your data

Instructions for requesting deletion of your data are available at onbir.agency/policy

11. Children

The Service is intended for business use only and is not directed at children under 16. We do not knowingly collect data from children.
12. Cookies

Our website uses cookies that are strictly necessary to keep you signed in and to maintain session security.

13. Changes to this policy

We may update this Policy. The date at the top indicates the most recent revision. Where changes are material, we will notify Customers by email at least 14 days before they take effect.
14. Contact

Questions about this Policy may be directed to: IP SLYAMOV YELDAR KANATULY Business identification number (BIN): 900811300816 Registered address: Astana, Nurmagambetova, 14 Contact email: projects@onbir.agency
Made on
Tilda