MySMS API
Privacy Policy
Last updated : 2026-08-25
This is a courtesy translation. In the event of any discrepancy, the French version prevails. Version française.
This policy describes how BRAKHA INTER SARL ("we") processes personal data in connection with MySMS API, an application programming interface (API) that allows its business customers to send and receive SMS and WhatsApp Business messages.
1. Data controller
| Registered name | BRAKHA INTER |
|---|---|
| Legal form | SARL with share capital of 500 000 FCFA |
| Activity | Innovation & Technologies |
| Trade register (RCCM) | CI-ABJ-03-2021-B13-02808 |
| Unique identifier | CI-2021-0004499 Y |
| Registered office | Abidjan, Cocody, Riviera Golf |
| Country | Côte d'Ivoire |
| Meta Business portfolio | Lucky Man Business (ID 1173815979678216) — a Meta portfolio held by BRAKHA INTER, under which the service is declared and verified. This is a portfolio name: the legal entity acting as data controller remains BRAKHA INTER. |
| Contact | emoloh@brakha-inter.com |
2. Two distinct roles
Our legal position differs according to the category of data concerned, and that distinction governs the whole of this policy.
- We act as data controller for our own customers' data: the people who open an account on MySMS API and use the API.
- We act as data processor for the data of message recipients. When a customer passes us a phone number in order to send a message to it, it is that customer who determines the purpose of the send and who must hold the recipient's consent. We act on their instructions.
3. Data collected
3.1 Account data
- Name and email address of the account holder.
- Password, kept only as a cryptographic hash (bcrypt); it is not technically possible for us to read it.
- Application role and SMS and WhatsApp credit balances.
3.2 Messaging data
For each message sent or received, we record:
- The phone number of the recipient or sender.
- The contact's WhatsApp profile name, where Meta provides it.
- The message content, along with its type (text, image, document, location, template).
- The technical message identifier, its delivery status (sent, delivered, read, failed) and the associated timestamps.
- For WhatsApp, the raw payload transmitted by Meta, kept for diagnostic purposes.
3.3 Technical data
- The IP address originating API calls, in the server logs.
- Timestamp and status of requests, for security and rate-limiting purposes.
What we do not collect. The service sets no advertising cookie, embeds no third-party tracker, performs no profiling and makes no automated decision producing legal effects. Message content is neither used for advertising, nor sold, nor used to train models.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Deliver messages and report their delivery status | Performance of the contract |
| Keep the history of exchanges and allow a conversation to be resumed | Performance of the contract |
| Count credits and bill for the service | Performance of the contract and statutory accounting obligation |
| Prevent fraud, unsolicited messaging and abuse of the API | Legitimate interest |
| Provide technical support and diagnose incidents | Legitimate interest |
5. Recipients and processors
Delivering a message necessarily entails passing it to a carrier. Our recipients are limited to the following:
| Recipient | Role | Data transmitted |
|---|---|---|
| Meta Platforms Ireland Ltd. | Delivery of WhatsApp Business messages (Cloud API) | Recipient number, message content |
| SMS gateway operator | Delivery of SMS | Recipient number, message content, sender |
| Infrastructure host | Hosting of the application servers and the database | All data, at rest |
WhatsApp exchanges are further subject to Meta's terms and privacy policy, available at whatsapp.com/legal/privacy-policy. We disclose no data to third parties for commercial purposes.
6. Transfers outside the country of establishment
Meta processes WhatsApp messages on infrastructure located outside Côte d'Ivoire, notably in the European Union and the United States. These transfers rely on the standard contractual clauses adopted by Meta under its terms applicable to the WhatsApp Business Platform.
7. Retention periods
| Data | Period |
|---|---|
| Message content and delivery metadata | 12 months from sending or receipt |
| Account data | Lifetime of the account, then 30 days after closure |
| Accounting records and supporting documents | The period required by the applicable accounting rules |
| Server logs | 12 months |
8. Security
- Exchanges with the API are encrypted in transit using TLS.
- Authentication relies on JWT tokens with a limited validity period; passwords are hashed with bcrypt.
- Incoming notifications from Meta are authenticated by an HMAC-SHA256 signature of the request body, and rejected otherwise.
- Application-level partitioning ensures that an account holder can reach only their own conversations and messages.
- Administrator access is restricted by role check.
9. Your rights
You have the following rights over your data:
- Access — obtain a copy of the data concerning you.
- Rectification — have inaccurate data corrected.
- Erasure — request deletion of your data, subject to our statutory retention obligations.
- Portability — receive your data in a structured, machine-readable format.
- Objection and restriction — object to processing based on our legitimate interest, or ask for it to be restricted.
These requests are made by email to emoloh@brakha-inter.com. We reply within thirty days at most.
Message recipients. If you have received a message sent through our platform and wish to exercise your rights, write to us at the address above stating the number concerned. We will identify the sending customer and pass your request on to them, keeping you informed. You may block a sender directly from within WhatsApp at any time.
10. Data deletion
The deletion procedure, its deadlines and its scope are set out on the dedicated page: Data deletion.
11. Minors
The service is intended exclusively for business use. We do not knowingly collect data relating to people under 16. Should such data be passed to us, it would be deleted as soon as it is reported to the contact address.
12. Changes
This policy may be revised. Any substantial change is notified to account holders by email at least fifteen days before it takes effect. The date of the last update appears at the top of the page.
13. Contact
For any question about this policy or about the processing of your data: emoloh@brakha-inter.com.