ChatBridge24 (the "Application") is operated by Saabsoft. This page explains how to have the data it holds deleted, who can ask for that, and how long each step takes. Meta's Platform Terms and the Bitrix24 Marketplace both require us to publish it, and it applies however you use the Application.
Two ways to use ChatBridge24
ChatBridge24 connects a business's WhatsApp account to the people who work there. There are two ways to use it, and this page answers every question for both:
- A ChatBridge24 workspace — created directly at app.chatbridge24.com with an email address and a password. Bitrix24 is not involved.
- A Bitrix24 portal — the ChatBridge24 app installed into a Bitrix24 portal, where conversations also appear in that portal's Open Channels and CRM.
What we store, how we protect it and how long we keep it are the same either way. What differs is how you sign in, where messages are delivered, and how you ask us to delete things. A ChatBridge24 workspace works on its own, and the ChatBridge24 app for Bitrix24 is available on the Bitrix24 Marketplace; wherever something applies to only one of the two, this page says so.
What we hold
Once a WhatsApp number is connected, we store the messages exchanged through it, the media attached to them, the contact identifiers WhatsApp supplies (a phone number or, where WhatsApp withholds it, an opaque identifier), and the credentials that keep the connection alive. On the WhatsApp Business Platform those credentials are the access token the business grants us and, where the number was registered through us, the two-step-verification PIN it chose for the number. All of them are encrypted.
Staff marks. Marks that staff place on a contact's number (Suspicious or Spam), with an optional note. A mark is visible to the users who can read that contact's chats, its note is erased when the mark is removed, a removed mark is kept without its note for 90 days and then deleted, and all marks are deleted when the workspace is closed or the Application is uninstalled, as described below.
Blocked contacts. When a team member blocks a contact, we keep that contact's phone number (or WhatsApp identifier) and an optional note on the business's block list, so their messages are kept out of the CRM and nothing is sent to them. A block is removed when a manager unblocks it; the removed entry is kept without its note for 90 days and then deleted, and every entry is deleted with the rest of the business's data as described below.
Do-not-contact list. When someone asks a business to stop messaging them, we keep their phone number and a short extract of the message they sent, so that campaigns and the automatic reply cannot message them again. It is kept while the business uses the Application and is deleted with its other data.
Saved audiences. We store the audiences a business's users save (lists of phone numbers or WhatsApp identifiers, with names and template values); an audience is kept until those users delete it. All of it is deleted when the workspace is closed or the Application is uninstalled, as described below.
Imported message history. When a WhatsApp Business app number is connected to the WhatsApp Business Platform as well (coexistence), Meta sends the contacts saved in the app and, if the business allows it in the app, up to six months of its one-to-one chats, and we store those too. It is deleted with everything else below.
Automation and automatic-reply records. For each message an automation rule sends we keep a record of the run, including the recipient's phone number and the message text, for 90 days, so that we can answer later whether a rule did or did not message someone. Records of which step of an automatic-reply scenario ran are kept for 30 days.
The advert a customer tapped. When someone reaches a business by tapping a Click-to-WhatsApp advert, Meta sends that advert's details with their first message and we keep a cleaned copy: the advert's identifier, its headline and body text, the link it pointed to, the platform it ran on, and Meta's click identifier. Advert images are always discarded, and Meta does not send the advert's name. This is kept with the conversation and deleted with it.
Staff check-ins and WhatsApp identities. If a business uses them, we also store the WhatsApp number an administrator links to each of its employees, and the positions an employee chose to share when asked to check in — collected only when they tap Share on the check-in page, and, while sharing live, only for as long as that page stays open. Positions are deleted automatically after the retention period the business sets (30 to 365 days, 90 by default); an administrator can remove an employee's WhatsApp link at any time; and all of it is deleted with the business's other data as described below. For this data the business, as the employer, is the controller. A check-in request reaches the employee as a Bitrix24 notification, so it is available on a Bitrix24 portal only: a ChatBridge24 workspace cannot send check-in requests today.
ChatBridge24 account data. A workspace created at app.chatbridge24.com also holds, for each person, an email address and name, a password hash and never the password, and a record of each signed-in device — the browser's own description of itself, a shortened part of the network address rather than the whole of it, and when the session was created and last used. For the second step of signing in it holds the mobile number a person gives for sign-in codes, an encrypted authenticator secret where one is set up, and one-way hashes of their recovery codes and of each sign-in code sent to them. We also keep a log of sign-in attempts. Sign-in attempts are deleted after 90 days. Device and session records, two-step sign-in details, and the single-use links used for invitations and verification, are kept until the workspace is closed and are deleted with it; ending a session you do not recognise marks it ended straight away, and its record goes when the workspace does.
Audit records. We keep a record of what each person changed in the Application — for a Bitrix24 portal as well as a ChatBridge24 workspace. Each entry is deleted 180 days after it was written. It runs on that clock alone: it is not deleted by the routes below.
Access logs. Like any website, every request to the Application passes through our load balancer, which records the network (IP) address it came from and the address requested. These logs are kept for 90 days and are used only for security and diagnosis. They are not part of a workspace's or a portal's own data, and the deletion routes below do not clear them. The Privacy Policy lists everything we hold in full.
Who is responsible for what
The business is the controller of its conversations, either way. For a Bitrix24 portal, the portal that installs the Application is the data controller; for a ChatBridge24 workspace, the account holder is. In both cases Saabsoft is a data processor and handles that conversation data on the business's instructions.
We are the controller of a ChatBridge24 account record, and of the audit record. The email addresses, password hashes, two-step sign-in details, device records and sign-in log of a workspace exist because we run the sign-in system, and the audit record of what each person changed — which we keep for a Bitrix24 portal as well — exists so that we can account for a change. Neither is held because a customer instructed us to hold it, so for both we are the controller rather than the processor, and a request about them comes to us.
Delete everything: close a ChatBridge24 workspace
A workspace created at app.chatbridge24.com is closed from inside the Application: Settings → Account → "Close this workspace". An administrator of the workspace must confirm with their own password and type DELETE; a manager, agent or viewer cannot do it.
Closing it signs everyone out, cancels any open invitations, and marks the workspace inactive immediately. It also cancels any subscription paid by card at the end of the period already paid for, so the card is not charged again. Everything the workspace holds — the email addresses, names and password hashes of its people, their device, sign-in and two-step sign-in records, and any messages, media and contacts — is then deleted automatically within 30 days, the same period that applies to an uninstalled Bitrix24 portal.
Those 30 days are also a recovery window, and recovery is not self-service. Nothing inside the Application can reopen a closed workspace. If one is closed by mistake, write to the contact address below within 30 days and we can reopen it; after that the data is gone. To have it deleted sooner than 30 days, use the request route below.
If you cannot sign in, use “Forgotten your password?” on the sign-in page: the Application emails a reset link to the email address you sign in with. If it is the phone or the authenticator app for the second sign-in step that you have lost, choose “Use a recovery code” and enter one of the recovery codes you saved. If neither is possible, write to the contact address below and tell us what happened; we will do what we can, but we cannot prove who you are from an email alone and we will not delete a workspace on an unverified request — doing so would let anyone delete somebody else's.
Delete everything: uninstall from a Bitrix24 portal
A portal administrator can remove the Application from their Bitrix24 portal at any time (Bitrix24 → Applications → ChatBridge24 → Delete). Bitrix24 then notifies us. Once we have verified that the notification comes from the portal's own installation, every linked WhatsApp number is disconnected immediately, our access to that portal is dropped, any subscription paid by card is cancelled at the end of the period already paid for, and the portal's messages, media and contacts are deleted automatically within 30 days (at once, if the administrator ticks Bitrix24's "delete data" option). A notification we cannot verify is never acted on automatically, because that would let anyone delete a portal's data: we are alerted instead, confirm the removal with the portal administrator, and then complete it.
The 30-day period exists so that reinstalling within that window does not destroy the portal's history. To have the data removed sooner, use the request route below.
Delete one WhatsApp number
Removing a single connected number from inside the Application stops all further processing for it and deletes the credentials we hold for it — on the WhatsApp Business Platform the access token the business granted and the two-step-verification PIN where we hold one — so we can no longer read or send anything on that number. Where that number's subscription is paid by card, removal offers to cancel it at the same time.
It does not delete that number's conversations. Its messages, media and contacts stay in our database, so that the history is still there if the number is connected again, and they are deleted when the whole workspace or portal is deleted as described above. To have one number's conversations deleted on their own, ask us using the route below.
Request deletion directly
To request deletion without closing a workspace or uninstalling, to ask for deletion sooner than 30 days, or to ask for a copy or correction of the data held, write to:
Request deletion on WhatsApp · or telephone +971 4 383 9665 · or write to info@chatbridge24.com (see the Contact section of our Privacy Policy).
Please tell us which business the request is about. For a Bitrix24 portal, give its portal address (for example example.bitrix24.com). For a ChatBridge24 workspace, give the email address the workspace was created with — a ChatBridge24 workspace has no Bitrix24 address, and that email address is the only thing that identifies it to us; add the workspace name as well if one was set. Where the request concerns a single number, give that WhatsApp number. We respond within 30 days.
The routes inside the Application are the reliable ones, because they prove who is asking: closing a workspace requires an administrator's own password, and uninstalling requires access to the Bitrix24 portal itself. A written request cannot prove that on its own, so we may have to ask for more before we act on it.
If you are an end customer who messaged a business using the Application — rather than that business — the business is the data controller for your conversation, and we act on their instruction. Contact the business directly, or write to the address above and we will pass the request to them.
A request about a ChatBridge24 account record — your own email address, password hash, two-step sign-in details, device records or sign-in log — or about an audit record of what you changed, is different. For that data we are the controller, so bring it to us at the address above rather than to the business.
What is not deleted here
Anything a Bitrix24 portal has separately written into its own Bitrix24 CRM (leads, contacts, timeline entries) belongs to that portal and is deleted inside Bitrix24, not by us. In the same way, anything a business has received into its own software through the REST API or its outgoing webhooks is held there, and is deleted there rather than by us. Messages delivered to WhatsApp are also held by WhatsApp under its own privacy policy. The audit records and the access logs described above are also untouched by these routes and expire on their own schedules — 180 and 90 days.
Deleted data does not reappear from backups, but it is not removed from them at once: point-in-time recovery of the database expires after 35 days, a daily backup after 7 days and its copy in a second European Union region after 35 days, and one weekly backup after 365 days in both regions. The Privacy Policy lists the backup copies in full, including the one-time archive that is deleted on request rather than on a schedule, and media files deleted before 25 September 2026 that may remain in the media disaster-recovery replica.