This is the WhatsApp Coexistence policy. RC Studio's other services are governed by their own policy.
1. What this policy covers
This Privacy Policy governs the processing of personal data in the following RC Studio products and services only, referred to together as "WhatsApp Coexistence":
• Coexistence for WhatsApp — module for Odoo Enterprise, versions 17, 18, 19 and 20.
• WhatsApp Coexistence API — module for Odoo Community, versions 17, 18, 19 and 20.
• Tech Provider connection service — the connection between the customer's WhatsApp Business number and Meta, operated by RC Studio with its Meta-approved application.
• Licence portal — https://coexistence.rcstudio.dev: account registration, purchase, issuance, renewal and revocation of licences, and customer self-service.
This policy does not cover other RC Studio services. In particular, it does not apply to RC Studio's own WhatsApp support channel or to its AI-assisted messaging services, which are a separate application, are contracted separately, and are governed by their own policy published at https://rcstudio.dev/privacy.
WhatsApp Coexistence uses no Artificial Intelligence of any kind. No content from our customers' conversations, or from their end customers' conversations, is sent to Artificial Intelligence providers, nor used to train models of any kind.
2. Data controller
Ricardo Colonia — RC Studio
Email: dev@rcstudio.dev
Website: https://rcstudio.dev
Licence portal: https://coexistence.rcstudio.dev
Registered in: Colombia.
This policy is governed by Law 1581 of 2012 and Decree 1377 of 2013 of the Republic of Colombia. Regulation (EU) 2016/679 (GDPR) additionally applies when processing the data of individuals located in the European Economic Area, which may occur because our modules are distributed globally through the Odoo Apps Store.
3. Where the software runs, and what that means
The WhatsApp Coexistence modules run inside the customer's own Odoo instance, on the customer's own server and under the customer's own domain. RC Studio does not host that instance, has no access to its database and cannot query it.
The conversations, contacts, templates and documents the module records live exclusively in the customer's system, under the customer's control and responsibility.
The customer may use the modules with RC Studio's connection service, with their own Meta application, or with a third-party Tech Provider's. The modules do not depend on RC Studio's service to work. When the customer uses their own Meta application, no data transits RC Studio's infrastructure and this policy applies to them only in respect of the module purchase.
4. Our role: when we are a controller and when we are a processor
This distinction determines which rights each person may exercise, and against whom.
RC Studio acts as a CONTROLLER of its own customers' data: the company that contracts the service, the person who creates the account in the portal, the billing data and the technical records generated by use of the service.
RC Studio acts as a PROCESSOR of the personal data of our customer's end customers, that is, the people who write over WhatsApp to the connected number. For that data our customer is the controller: they determine the purposes of processing, and RC Studio processes only what is strictly necessary to provide the connection service, following their instructions and without using that data for any purpose of its own.
If you wrote over WhatsApp to a company that uses our services and wish to exercise your rights over that conversation, you must contact that company, which is the controller. If you write to us, we will help you identify them and forward your request.
5. What data we process
5.1. Account and commercial relationship data
• Full name and, where applicable, company name and tax identification number.
• Email address, and the date and time it was verified.
• Portal password, stored only as a cryptographic hash. No one at RC Studio can read or recover it.
• Contact telephone number.
• Professional or work contact details (role, company, sector).
• The URL of the customer's Odoo instance, required to register delivery of inbound messages and to provide support.
• Profile data obtained from Google when Google Sign-In is used, as described in Section 7.
5.2. Licences
Of the licence key, RC Studio keeps its SHA-256 cryptographic digest, which is what authenticates the customer's Odoo, and an encrypted copy so that the customer can view the key again from the panel whenever they need it. That copy is protected with the same encryption as the tokens, with the encryption key held outside the database, and every time the key is viewed is logged. The customer may revoke the key and issue a new one at any time, which immediately invalidates the previous one. The creation date, last-use date and, where applicable, revocation date are also recorded.
5.3. WhatsApp number connection
When the customer connects a number using RC Studio's Tech Provider service, the following are stored:
• The identifiers of the WhatsApp Business Account (WABA), of the number (phone number id) and of the business portfolio.
• The display number and verified name, as returned by Meta.
• An encrypted copy of the customer's business token, kept solely in order to re-subscribe message delivery if the customer's Odoo URL changes, and to trigger the initial synchronisation that Meta permits only once per connection.
• The message delivery URL of the customer's Odoo and its verify token.
• A signing secret unique to each customer, stored encrypted, with which RC Studio re-signs deliveries so that the customer's Odoo can validate them.
The number and the WABA remain the customer's property and stay in the customer's Meta business portfolio. A Tech Provider acts as a bridge between the customer's WABA and Meta's services; it never takes ownership of the number, the account or the conversations.
5.4. Technical and audit records
For every call RC Studio makes to Meta on the customer's behalf, we record the action performed, the identifier of the affected number or WABA, the response code, the error detail where applicable, the quota usage reported by Meta, and the IP address the request originated from. These records allow us to diagnose incidents and to evidence what happened and when. The web server also keeps standard access logs.
5.5. Purposes
• Provision, performance and invoicing of the contracted service.
• Creating and managing the user account, verifying the email address and preventing fraudulent use.
• Issuing, validating and revoking licences.
• Establishing and maintaining the connection of the number with Meta.
• Customer care and technical support.
• Sending operational and service notifications (billing notices, maintenance, version changes, security incidents).
• Platform security and traceability of operations.
• Compliance with legal, accounting and tax obligations.
6. How WhatsApp messages travel
This section describes precisely what RC Studio's infrastructure does, and does not do, with the content of conversations.
6.1. Messages the customer sends do not pass through RC Studio. The business token lives in the customer's own database, so their Odoo talks straight to Meta. RC Studio's service does not even expose a message-sending endpoint.
6.2. Inbound messages do not pass through RC Studio either. When a number is onboarded, RC Studio's service registers the address of the customer's own Odoo with Meta as the delivery destination. From then on Meta delivers every message directly to that Odoo: RC Studio does not receive it, does not see it and cannot see it. The chain is:
Meta → the customer's Odoo.
6.3. RC Studio takes part only in the onboarding of each number. It exchanges Meta's authorisation for the access token, hands it to the customer's Odoo, registers the delivery address and triggers the initial sync. To do so it keeps an encrypted copy of the token and the number's connection data, as set out in Section 11. Meta's app secret is never handed to the customer; that is why onboarding goes through RC Studio, and only onboarding.
6.4. Compatibility mode and own application. Installations running a module version prior to direct delivery keep, until they update, an intermediated delivery: Meta delivers to RC Studio's service, which validates Meta's signature and forwards the body byte for byte to the customer's Odoo, without inspecting or copying it. No content is stored in that transit; all that is recorded is the timestamp of the last delivery and, when it fails, the error returned by the customer's Odoo, truncated and overwritten on the next one. RC Studio does not enable this mode for new connections. The customer may also use their own Meta application: in that mode RC Studio takes no part, not even in onboarding.
6.5. RC Studio does not read, store, analyse or disclose end customers' conversations, and does not use their content for any purpose of its own. In particular, that content is not used for advertising, marketing, profiling, commercial statistics, or to train or improve Artificial Intelligence models, whether our own or third parties'. This is also required by the Meta Platform Terms.
7. Customer account and Google Sign-In
The licence portal allows an account to be created with an email address and password, or through Google Sign-In.
7.1. Registration with email. A valid email address is required and must be verified through a link sent to that address before licences can be issued. The password is stored only as a cryptographic hash.
7.2. Google Sign-In. If the user chooses it, RC Studio receives from Google only their email address, name, profile picture and the internal identifier Google assigns to the account. No access is requested to the user's email, contacts, calendar or files.
RC Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. That information is used solely to create and authenticate the account; it is not sold, not shared with third parties for advertising purposes, and not used to train Artificial Intelligence models. The user may revoke access at any time from their Google account security settings.
7.3. Account deletion. The data subject may request deletion of their account by writing to dev@rcstudio.dev from the associated address. On deletion, their licences are revoked, their numbers are disconnected and the associated data is erased, except where the law requires retention under Section 11.
8. Payments and billing
Depending on the payment method chosen, RC Studio processes the following information:
• PayPal: the subscription is managed entirely on PayPal's platform. RC Studio receives and stores the subscription identifier and the payment status.
• Mercado Pago: as above, with the corresponding subscription identifier.
• Bank transfer: RC Studio keeps the receipt sent by the customer and the record of the payment.
• Module purchase on the Odoo Apps Store: the transaction is processed by Odoo S.A. under its own terms. RC Studio receives from Odoo the buyer data needed for invoicing and support.
RC Studio does not receive, view or store card numbers, security codes or banking credentials.
9. Providers and third parties we share data with
|
Provider |
Purpose |
Country |
|
Meta Platforms, Inc. |
The WhatsApp Business platform. Without it there is no service |
USA |
|
Google LLC |
Google Sign-In, only if the user chooses it. Google Analytics, only if they accept measurement cookies (Section 18) |
USA |
|
PayPal |
Processing the subscription in US dollars |
USA |
|
Mercado Pago (MercadoLibre) |
Processing the subscription in Colombian pesos |
Colombia |
|
Odoo S.A. |
Sale of the modules through the Odoo Apps Store |
Belgium |
The portal, the connection service and the mail server that sends verification and service notices run on RC Studio's own infrastructure in Colombia: no hosting or email provider outside RC Studio is involved. Each provider in the table processes the data under its own policies and solely for the stated purpose. Beyond those listed in this table there is no other recipient. RC Studio does not sell personal data under any circumstances, and uses no Artificial Intelligence providers in this service.
10. Commercial communications
RC Studio may use the account's contact details — name, email address and company — to inform the customer about new versions, features and RC Studio's own products, and may use them on digital advertising platforms to target campaigns about its own services.
This processing never reaches the content of WhatsApp conversations, nor the data of the customer's end customers, in accordance with Section 6.5.
The data subject may object to this processing at any time by writing to dev@rcstudio.dev, without this affecting the provision of the contracted services or the validity of their licence.
11. Data retention
• Message content: neither received nor retained. In the compatibility mode of Section 6.4 it only transits, without being stored.
• Encrypted business token and number connection data: for as long as the number remains connected. On disconnection, or on deletion of the customer's account, RC Studio's application subscription is removed from the WABA and the whole record is deleted, encrypted token included.
• Account, licences and billing data: for the duration of the relationship and for five (5) years afterwards, under Colombian accounting and tax obligations.
• Connection service audit records: twenty-four (24) months.
• Web server access logs: ninety (90) days.
• Connection assistant sessions: fifteen (15) minutes.
Once the period has elapsed or a deletion request has been honoured, the data is securely erased from both the database and the files on disk.
12. Security
• Encryption in transit (HTTPS / TLS) for all communications.
• Symmetric encryption at rest (AES-128 + HMAC) over stored tokens and secrets, with the encryption key held outside the database.
• Licence keys stored as SHA-256 digests for authentication, plus an encrypted copy for display in the panel; passwords only as hashes.
• Verification of the customer's Odoo delivery endpoint before registering it with Meta. In the compatibility mode of Section 6.4, validation of Meta's HMAC-SHA256 signature on every delivery before forwarding, and re-signing with a secret unique to each customer.
• The Meta app secret is held exclusively in the server configuration: it does not reside in the database, is never returned by any API and is never written to any log.
• Restricted access to the administration panel through credentials and a signed session, with an auditable record of operations.
• Database and internal services isolated on a private network.
• Server hardening, security update management and event monitoring.
No system is infallible. In the event of a personal data breach that poses a risk to data subjects' rights, RC Studio will notify those affected and the competent authority within the legally required deadlines.
13. International data transfers
The providers listed in Section 9 are established outside Colombia. By accepting this policy, the data subject expressly authorises the international transfer of their personal data to those countries, under article 26 of Colombian Law 1581 of 2012.
These transfers are further supported by the necessity of performing the contract requested by the data subject and by the standard contractual clauses and other safeguards those providers incorporate into their terms of service.
RC Studio's connection service runs on RC Studio's own infrastructure in Colombia, and transactional email is sent from RC Studio's own mail server, also in Colombia.
14. Rights of data subjects
Under Colombian Law 1581 of 2012, Decree 1377 of 2013 and related rules, data subjects have the right to:
• Know, update and rectify their personal data.
• Request proof of the authorisation granted for processing.
• Be informed, upon request, of the use made of their data.
• Lodge complaints with the Superintendency of Industry and Commerce.
• Revoke authorisation and/or request erasure of their data, where no legal or contractual duty prevents it.
• Access their personal data free of charge.
Where the GDPR applies, data subjects located in the European Economic Area additionally have the rights of access, rectification, erasure, restriction of processing, portability and objection, and may lodge a complaint with their national supervisory authority.
How to exercise these rights: by writing to dev@rcstudio.dev from the address associated with the account, stating the specific request. RC Studio will respond within the following deadlines:
• Enquiries (Law 1581): ten (10) business days, extendable by five (5) more.
• Complaints (Law 1581): fifteen (15) business days, extendable by eight (8) more.
• GDPR requests: one (1) month, extendable by two (2) more where complexity justifies it.
15. Confidentiality
When providing technical support, RC Studio may access confidential customer information, including configurations, technical logs and, if the customer voluntarily provides them, credentials to their systems. RC Studio undertakes to treat such information in strict confidence, to use it solely to resolve the reported incident, not to disclose it to third parties except at the request of a competent authority, and to securely delete it once the request has been handled.
This obligation survives for five (5) years from termination of the contractual relationship.
16. Intellectual property and licence of use
• The customer retains ownership of their information, data, content and WhatsApp number.
• RC Studio retains ownership of the modules and of the connection service, over which it grants the customer a licence of use under the applicable purchase terms.
• The connection service licence is non-transferable and granted for the customer's own use; it does not authorise resale or assignment to third parties without express authorisation.
17. Minors
WhatsApp Coexistence is a product aimed at businesses and its use is restricted to adults. RC Studio does not knowingly collect personal data from minors. If such data is found to have been collected, it is securely deleted.
18. Cookies, analytics and advertising measurement
18.1. Cookies used by the portal. All of them are first-party; there are no third-party cookies.
|
Cookie |
Purpose |
Lifetime |
|
wacoex_user |
Keeps you signed in. Strictly necessary |
30 days |
|
wacoex_csrf |
Stops a third party submitting forms on your behalf. Strictly necessary |
12 hours |
|
wacoex_oauth |
Protects the Google sign-in flow. Strictly necessary |
10 minutes |
|
lang |
Remembers the language you chose |
1 year |
|
wacoex_attr |
Remembers which channel you came from (search, an ad, Odoo Apps…) so we know what works |
90 days |
18.2. First-party, anonymous analytics. RC Studio counts visits in aggregate by day, page, source channel, device type, browser and browser language. No IP address is stored, no visitor identifier, and no profile is built: just counters. This measurement always runs, needs no consent from you and involves no third party.
18.2.1. Third-party analytics. In addition, RC Studio may use Google Analytics 4 and the Meta pixel to learn aggregate audience data (country, device and, where those platforms infer them, age ranges and interests) and to measure its advertising campaigns. Each works differently:
The Meta pixel does not load until you accept it. If you choose "Necessary only", no Meta script runs at all.
The Google tag always loads, but it starts with consent denied (Google Consent Mode v2). Until you accept, that tag writes no cookie, neither creates nor reads any identifier for you, does not personalise advertising, and strips the advertising click identifier from what it sends. All it transmits is an anonymous signal — the page viewed, the approximate country and the fact that the visit happened — which lets Google estimate in aggregate how many visits each advert produces, without identifying you or being able to recognise you on another visit. If you accept, measurement becomes complete and cookie-based. You can change your mind by clearing the site's data in your browser, and the notice will appear again. When active, those platforms process the data as independent controllers under their own policies, and the IP address is sent to Google anonymised.
This depends on the country you visit us from, which Google determines from your IP address. In the European Economic Area, the United Kingdom, Switzerland, Turkey, the Middle Eastern countries and Colombia, the tag starts denied and measures nothing until you accept, because prior consent is mandatory in those territories. In other countries — including Brazil and Mexico, whose laws allow legitimate interest and tacit consent respectively where the notice is available — the tag starts granted and you may refuse at any time from the same notice, which revokes measurement.
18.3. Advertising campaign measurement. When RC Studio advertises its services, it may report to the platform where the ad ran (for example Meta or Google) the fact that someone completed a registration or subscribed, in order to know which ads work. That report contains your email address turned into an irreversible cryptographic digest (SHA-256), never in clear text, together with the advertising click identifier if you arrived from an ad. No pixel or script from those platforms is installed on the site: the report is sent from our server, and only if the visitor actually arrived from a campaign.
18.4. How to avoid it. You can set your browser to reject cookies, though the strictly necessary ones are required to sign in. If you do not want your registration reported as a conversion to an advertising platform, write to dev@rcstudio.dev and we will exclude you.
19. Changes to this policy
RC Studio may amend this policy to reflect changes in the service or in applicable law. The version in force will always be published at this address, with its update date. Changes that substantially affect the processing of personal data will be notified by email at least fifteen (15) days before they take effect.
20. Governing law and jurisdiction
This policy is governed by the laws of the Republic of Colombia. Any dispute shall first be addressed through direct settlement within thirty (30) calendar days. Failing agreement, the parties submit to the jurisdiction of the competent courts of the Republic of Colombia, without prejudice to the consumer's right to approach the competent administrative authorities.
21. Contact
Email: dev@rcstudio.dev
Website: https://rcstudio.dev
Licence portal: https://coexistence.rcstudio.dev
Last updated: 24 September 2026.