Privacy Policy

Mesara provides software that helps businesses in Sri Lanka move onto the official WhatsApp Business Platform (Cloud API) and protect their number, sold as a subscription in Sri Lankan rupees.

Mesara is operated by Mesara (Pvt) Ltd, a company registered in Sri Lanka under company number PV00369742, with its registered office at 26/A, Waboda Road, Negombo, Sri Lanka. In this policy, "Mesara", "we", "us" and "our" mean Mesara (Pvt) Ltd, and that company is the data controller responsible for the personal information described here.

For your own account information we act as a data controller. For the WhatsApp message content you send and receive through the service, we act as a data processor on behalf of your business, which remains the controller of that content. Section 5 explains this in more detail.

We use the information above to:

Where the law requires a legal basis, we rely on: performance of our contract with you to deliver the service; our legitimate interests in running, securing and improving the product; your consent where we ask for it; and compliance with legal obligations such as accounting and tax rules.

Your WhatsApp message content belongs to your business and the customers you talk to. We handle it only to run the service you asked for, following your instructions. We do not sell it, and we do not use it to build advertising profiles. Your own handling of your customers' data is governed by your agreements with them and by Meta's policies.

We do not sell your personal information. We share it only with service providers who help us run Mesara, and only as far as they need it:

We may also disclose information if the law requires it, or to protect the rights, safety and property of Mesara, our users and the public.

Some of our providers, including Meta, operate outside Sri Lanka. When information is transferred abroad, we take steps to ensure it stays protected to a standard consistent with this policy and applicable law.

We keep information for as long as your account is active and for as long as we need it to provide the service. After your account closes, we delete your message content, conversation history, contact records, and your account, team, business and WhatsApp Business Account details within 30 days.

A few things outlive that. Billing records, invoices and payment references are kept for six years, because Sri Lankan tax and company law require us to hold accounting records for that long, and that legal obligation overrides a deletion request. Audit and security logs are kept for 12 months so we can investigate abuse and security incidents. Backups are purged on a rolling 35 day cycle, so deleted data can persist in a backup for up to 35 days after deletion.

See our Data Deletion page for how deletion works and the timelines involved.

We use encryption in transit, access controls, and an encrypted vault for sensitive credentials such as WhatsApp access tokens. No system is perfectly secure, but we work to keep your information safe and to respond quickly if something goes wrong.

Under Sri Lanka's Personal Data Protection Act, and under GDPR-style rules where they apply, you can ask to access the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to certain processing, and receive a copy in a portable form. You can also withdraw consent where we relied on it. To exercise any of these rights, contact us using the details below. We may need to verify your identity before we act.

To delete your account and the data we hold for you, follow the steps on our Data Deletion page. It explains what is removed, what we may keep for legal reasons, and how long it takes.

We may update this policy as the product and the law change. When we make a material change, we will update the date at the top and, where appropriate, let you know inside the app.

For any privacy question or request, email us at hello@mesara.lk. Email is the fastest route and we answer from a real inbox, Monday to Friday, 9am to 6pm Sri Lanka time.

The data controller responsible for your information is Mesara (Pvt) Ltd, a company registered in Sri Lanka under company number PV00369742, with its registered office at 26/A, Waboda Road, Negombo, Sri Lanka.