Privacy policy

Draft for Cambridge Marketing's approval. Last updated 1 October 2026.

CambWA is a WhatsApp customer relationship service run by Cambridge Marketing, Sri Lanka ("we"). Businesses ("clients") use CambWA to answer and follow up the people who message them on WhatsApp ("their customers"). This policy explains what CambWA handles, why, and the choices you have. We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

Who is responsible

For the chats and contact details a client keeps in CambWA, the client decides what is collected and why, and is responsible for it. Cambridge Marketing processes that information on the client's behalf, only to run the service. For the accounts of the people who sign in to CambWA, Cambridge Marketing is responsible.

What CambWA handles

• People who sign in: name, email address, a password (stored only as a strong one-way hash), an authenticator secret (encrypted), sign-in times, IP addresses and device type, for security and the audit log.
• Clients' customers: their WhatsApp number and display name, the messages exchanged with the client's business, and details the client or MAI records on the lead (for example what they need, a budget or a date).
• The CambWA Android app reads the text of new notifications from one WhatsApp app only: WhatsApp Business when it is installed (the personal WhatsApp beside it is never read), otherwise WhatsApp. It does this so it can record a customer's message and send the client's reply. It does not read other apps, contacts, photos or calls.
• The CambWA Chrome extension works only on web.whatsapp.com. It reads the chat that is open so it can show the lead beside it, and sends the messages the client queued.
• Official WhatsApp (Meta) connections: the messages and delivery updates Meta sends to CambWA for the client's number.

How it is used

To deliver the service the client chose: showing chats, keeping leads, sending the client's replies and follow-ups, producing reports, and keeping the service secure. CambWA does not sell personal data, show advertising, or use clients' data to market to their customers on its own behalf.

MAI, the AI assistant

When a client switches MAI on, the text of the recent conversation and the client's own business information are sent to Cloudflare Workers AI to write a reply. They are used only to produce that reply. MAI does not decide anything with legal or similar effect about anyone; a person can always take over the chat.

Who else handles it

• Hostinger hosts CambWA's servers and stores its data.
• Cloudflare runs the AI model behind MAI.
• Meta (WhatsApp) carries the messages, under WhatsApp's own terms and privacy policy.

Each only processes data to provide their part of the service. Information may be processed outside Sri Lanka by these providers, with safeguards appropriate to the law.

Security

Every person signs in with a password and an authenticator code. Each client's data is kept in its own separate store. Tokens and secrets are encrypted, backups are encrypted, and every change and sign-in is recorded in a tamper-evident audit log the client can read. Cambridge Marketing staff only open a client's workspace to give support, and each time is shown to the client and recorded.

How long it is kept

For as long as the client uses CambWA. When a client leaves, their workspace is deleted within 30 days of their request, and encrypted backups that contain it expire within a further 14 days. Security records may be kept longer where the law requires.

Your rights

You can ask to see, correct or delete information about you, or object to its use. If you are a customer of a business that uses CambWA, please ask that business first; you can also reply STOP to stop receiving their campaigns. If they can't help, contact us and we will pass your request to them. See Deleting your data.

Contact

Cambridge Marketing, Sri Lanka. Contact us through marketing.cambt.com. We will update this policy when the service changes and show the new date at the top.