Privacy policy
Last updated 29 July 2026
This policy explains what personal data Audun Inc. ("we", "us") processes in connection with Audun, our account servicing platform, how we process it, why, how long we keep it, and how it can be deleted.
1. Our two roles
We process personal data in two distinct roles, and your rights differ depending on which applies.
As data processor
When a business customer ("Client") uses Audun to communicate with its own customers, the Client is the data controller and we are the data processor. We process that data only on the Client's documented instructions, under a data processing agreement. If you are an individual who received a message sent through Audun, the Client is the controller of your data and you should direct requests to them in the first instance — though we will always help, see section 8.
As data controller
We are the controller for data about our own business relationships: prospective and current Client contacts, website visitors, and people who contact us directly.
2. Data we process as processor
| Category | Examples |
|---|---|
| Contact identifiers | Name, phone number, email address, postal address of the Client's customers |
| Account data | Account or invoice reference, balance, due dates, payment status, payment plan terms |
| Message content | The content of outbound and inbound messages, including attachments and media |
| Delivery metadata | Timestamps, delivery and read status, failure reasons, channel used, provider message identifiers |
| Consent and preferences | Opt-in and opt-out records, preferred channel, preferred language, contact restrictions |
| Decision records | The automated and human decisions taken about a message, and the rules that applied |
3. Data processed through the WhatsApp Business Platform
Where a Client connects its own WhatsApp Business Account to Audun, we process the following additional data through Meta's WhatsApp Business Platform, strictly to deliver the messaging service the Client has asked us to operate on its behalf:
- End-customer phone numbers — the WhatsApp number a message is sent to or received from.
- Message content and media — the body of messages exchanged between the Client and its customer, including images, documents and other attachments.
- Message and conversation metadata — message identifiers, timestamps, delivery and read receipts, error and failure codes, and conversation session state.
- WhatsApp Business Account identifiers — the Client's WhatsApp Business Account ID, business phone number ID, display name and business profile information.
- Message template metadata — template names, categories, languages, content, approval status and quality ratings.
- Consent and opt-out records — evidence that a customer agreed to be contacted on WhatsApp, and any subsequent opt-out.
We use this data only to send and receive the Client's messages, to report delivery status back to the Client, to manage the Client's message templates, and to enforce consent, opt-out and contact rules. We do not use it to build or augment profiles of individuals, we do not sell it, and we do not use it to train general-purpose AI models.
Meta Platforms Ireland Limited and Meta Platforms, Inc. process this data as the operator of the WhatsApp Business Platform, under their own terms and privacy policy. Data sent through WhatsApp is also subject to Meta's handling. Message content and media held by Meta's Cloud API are stored in the EU where the Client's account is configured for EU data storage.
4. Purposes and legal bases
- Delivering the service — performance of our contract with the Client; for the Client, the legal basis for messaging its customers is the Client's own (typically contract or legitimate interests, with consent where required for the channel).
- Security, fraud prevention and abuse detection — our and our Clients' legitimate interests.
- Meeting legal obligations — including record-keeping and responding to lawful requests.
- Service improvement and support — legitimate interests, using aggregated or minimised data wherever possible.
5. Sharing and sub-processors
We share personal data only with sub-processors engaged to deliver the service, each under a written contract with equivalent data protection obligations. These include communications providers (including Meta Platforms for WhatsApp, and our email, SMS, voice and print providers), cloud hosting and infrastructure providers, and AI model providers used for drafting and triage under contractual terms that prohibit training on the data. A current list is available to Clients on request and is maintained in the data processing agreement. We also disclose data where legally required.
We do not sell personal data, and we do not share it for advertising.
6. International transfers
Personal data is stored and processed on infrastructure located in the EU/EEA. Audun Inc. is established in the United States, so where our personnel access personal data from outside the EEA, that access is governed by the data processing agreement with the Client, which sets out the transfer mechanism relied on. Where a sub-processor processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses together with supplementary measures, and we document that in the data processing agreement.
7. Retention
As processor, we retain data for as long as the Client instructs, and no longer than needed for the purposes above. Default retention periods are set out in the Client's agreement and are configurable by the Client. We delete or return personal data:
- on the Client's instruction;
- when it is no longer needed for the purpose it was collected for;
- on termination or expiry of the Client's agreement;
- on a valid request from the individual, subject to the Client's instructions and our legal obligations;
- where required by law, or on request from a platform provider such as Meta in respect of data obtained through its platform.
Backups are deleted on their normal rotation. Where we must retain records to meet a legal obligation, we retain the minimum necessary and restrict access to it.
8. Your rights, and how to request deletion
Subject to the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. You also have the right to complain to the data protection authority in your country of residence.
To request deletion or modification of your data, see our data deletion page, or email privacy@getaudun.com. If we hold your data as a processor on behalf of a Client, we will forward your request to that Client without undue delay and support them in answering it. We respond within one month.
9. Security
We apply role-based access control on a least-privilege basis, encryption in transit and at rest, audit logging of access to personal data, segregation of Client data, and regular review of access. Personnel are bound by confidentiality obligations.
10. Cookies and this website
This website uses only what is strictly necessary to serve the pages. We do not use advertising cookies or cross-site tracking here.
11. Contact
Audun Inc.
1055 Creston Road
Berkeley, CA 94708, United States
Delaware file no. 10668339
Email privacy@getaudun.com
Phone +1 510 345 9076
Data Protection Officer: privacy@getaudun.com
12. Changes
We will update this policy when our processing changes and will revise the date at the top. Material changes affecting Clients are notified under the Client agreement.
WhatsApp is a trademark of Meta Platforms, Inc., registered in the U.S. and other countries. Audun is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.