Privacy policy

Last updated 1 November 2026

ReachChat is a product of HighImpct ("we"). This policy explains what data ReachChat handles when businesses use it with GoHighLevel and WhatsApp, and how we protect it.

Who this covers

Our customers are businesses and agencies. For the messages and contacts their customers send, the business is the controller and we process the data on its behalf to provide the service.

What we process

• Account data: GoHighLevel agency and sub-account IDs, user IDs and roles, and access tokens GHL issues to ReachChat (stored encrypted).
• WhatsApp data: WhatsApp Business account and phone number IDs, the access token Meta issues (encrypted), message content, media links, delivery statuses, contact phone numbers and profile names.
• Settings: labels, owners, templates, automations and opt-out lists.
• Billing data: which numbers are billed and when. Payment details stay with GoHighLevel and Meta; we never see card numbers.

How we use it

Only to run ReachChat: deliver messages between WhatsApp and GoHighLevel, run the automations a business sets up, show status and health, bill numbers, and provide support. We do not sell data and do not use message content for advertising.

Where data goes

• Meta Platforms (WhatsApp Business Cloud API) to send and receive messages.
• HighLevel (GoHighLevel) to show messages in Conversations and run workflows.
• Cloudflare to host and run ReachChat.

How long we keep it

• Technical logs: 14 days.
• Message records needed for delivery status and routing: while the business uses ReachChat.
• After uninstall, GoHighLevel tokens are deleted at once. The WhatsApp token is kept, encrypted, only to disconnect your WhatsApp account from ReachChat, and is deleted with the rest of your data within 30 days, unless the business asks earlier. Deleted data can stay in encrypted backups for up to 30 more days. Two records are kept after that: billing records, for accounting, and opt-out (STOP) records, kept for as long as needed so a contact who opted out is never messaged again by mistake.

Security

Access tokens are encrypted at rest. Requests from GHL and Meta are verified by signature or secret key. Access to production systems is limited.

Your rights

Businesses can request a copy or deletion of their data. End customers should contact the business they message; we will help that business respond. Email support@watalkers.com.

Changes

We will post updates here and change the date above.