Modari

Use of Meta permissions

This page documents exactly which permissions we request from Meta and how Modari uses them to deliver the service. It is the official reference for Meta App Review audits.

WhatsApp Business Messaging

whatsapp_business_messaging

Send and receive text, media (images, audio, video, documents) and approved template messages on behalf of the user. This powers the unified inbox in Modari and lets the AI chatbot reply automatically.

Datos accedidos

  • •Message content (text, media)
  • •wa_id and wamid identifiers
  • •Status (sent, delivered, read, failed)

Retención

Messages are stored in the workspace database while the account is active, or until the user deletes them.

WhatsApp Business Management

whatsapp_business_management

Sync approved templates from Meta, create new templates, manage phone numbers associated with the WhatsApp Business Account (WABA), subscribe the webhook to the user WABA.

Datos accedidos

  • •Template list with status and components
  • •Phone Number ID and display number
  • •WABA ID and webhook configuration

Retención

Only WABA ID and phone_number_id are stored permanently. Templates are cached to reduce API calls and re-synced on demand.

Business Manager Administration

business_management

Read the user Business Portfolio info to display the business name and verification status in the Modari UI (connection panel).

Datos accedidos

  • •Business Portfolio ID and name
  • •Business verification status

Retención

Business ID is saved as a reference. No access to other Business Manager assets (Pages, Ad Accounts, Catalogs, etc).

How we handle data

Token encryption. The Meta access_token is stored encrypted with AES-256-GCM (dedicated META_TOKEN_ENCRYPTION_KEY). Only the server decrypts it when calling Graph API.

Webhook verification. Each incoming Meta webhook is validated with HMAC-SHA256 against x-hub-signature-256 using META_APP_SECRET. Payloads without valid signature are discarded.

Workspace isolation. Each Modari client operates their own WABA. Tokens, messages and conversations from one workspace are never accessible from another workspace. Isolation enforced with Row-Level Security in PostgreSQL.

Opt-out (STOP / unsubscribe). We detect opt-out commands in incoming messages and automatically block future sends to the contact. The user can also archive any conversation manually.

No data sale to third parties. Modari does not sell, monetize or share message, contact or conversation data with third parties. All processing (including LLM for AI chatbot) occurs solely to deliver the service to the workspace that owns the data.

Data deletion

When a user disconnects their WhatsApp Business from Modari, we automatically:

  • Unsubscribe the webhook from their WABA
  • Delete the encrypted access_token from the database
  • Archive the connection (conversations remain visible read-only)

For complete data deletion (including message history), the user can request account deletion by writing to soporte@modari.app.

Contact

Questions about permission or data handling: soporte@modari.app

Last updated: September 14, 2026