Skip to content
retransmit.

Privacy policy

Last updated September 6, 2026

This policy explains what Retransmit collects, why we collect it, how long we keep it, who we share it with, and what you can do about it. It covers the retransmit.dev website, the dashboard, and the hosted API, across every channel we offer: email, SMS, and WhatsApp. If you self-host Retransmit, this policy does not apply to your instance; you control that data.

Who we are

Retransmit is a messaging API and dashboard for email, SMS, and WhatsApp at retransmit.dev, operated by Logesta Labs LLC. In this policy, "we" and "us" mean Logesta Labs LLC. We are the data controller for your account data and the information described below. For anything in this policy, contact us at contact@logestalabs.com.

What we collect

We collect only what the service needs to run:

  • Account data: your name, email address, and profile picture, provided by the sign-in provider you choose (Google or GitHub), or just your email address if you sign in with a magic link, plus the account settings you configure in the dashboard.
  • Email data: the emails you send through the API, including recipient addresses, subject lines, content, attachments, and delivery events such as sends, deliveries, bounces, and complaints.
  • SMS data: the text messages you send through the API, including recipient phone numbers, sender ids, message text, and delivery receipts.
  • WhatsApp data: the WhatsApp Business number you connect, the messages you send from it, the replies people send to it, your message templates, and the credentials Meta issues so we can act on your behalf. The WhatsApp Business Platform section below lists every item.
  • Sending configuration: your verified domains, connected phone numbers, API keys, webhook endpoints, and suppression lists.
  • Usage and billing data: API request logs, credit balance, purchase history, and send volumes, used for billing, capacity planning, and abuse prevention.
  • Technical data collected automatically: IP address, browser type, and request timestamps, recorded in server logs when you use the website, dashboard, or API. We use this to secure the service and diagnose problems.
  • Website analytics data: the page URL, referring page, browser window width, a randomly generated visitor identifier, and conversion events such as opening the quickstart. We use this to understand website traffic and which calls to action are useful.

Sign in with Google or GitHub

You create a Retransmit account by signing in with Google or GitHub, or with a magic link sent to your email address. A magic link gives us only that email address. Here is exactly how we handle the data we receive from Google and GitHub.

  • What we access: your basic profile only. That is your name, your email address, and your profile picture. We request no other scopes. We cannot read your Gmail, contacts, calendar, files, or repositories, and we never ask for that access.
  • How we use it: to create your account, sign you in on later visits, display your identity in the dashboard, and send you service emails about your account, such as billing and security notices.
  • How we store it: in our database on Amazon Web Services infrastructure, encrypted in transit and at rest, for as long as your account exists.
  • How we share it: we do not sell it, and we do not share it with anyone except the infrastructure providers that host the service on our behalf. We do not use it for advertising, and we do not transfer it to third parties for their own purposes.

Google API Services disclosure

Retransmit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide sign-in and the account features described above. It is never used for advertising, never sold, and never used to train generalized machine learning models. Humans do not read it except with your permission, for security purposes, or where the law requires it.

WhatsApp Business Platform

You can connect a WhatsApp Business number to Retransmit and send and receive WhatsApp messages through it. The connection runs through Meta's Embedded Signup, a Facebook Login for Business flow that Meta hosts inside our dashboard. Retransmit is registered with Meta as a Tech Provider. The Meta app you connect to belongs to Logesta Labs LLC, which is why Meta's dialog shows that name. Here is exactly what we receive from Meta and what we do with it.

  • What we receive when you connect: the id of your WhatsApp Business Account, the id and phone number of the business number you chose, the display name Meta verified for it, its quality rating, and a business integration access token scoped to that WhatsApp Business Account. We request the whatsapp_business_messaging and whatsapp_business_management permissions and no others. We do not receive your personal Facebook profile, friends, pages, ad accounts, or anything outside the WhatsApp Business Account you chose.
  • How we use the token: to register your number with the WhatsApp Cloud API, to send the messages you ask us to send from it, to subscribe our app to your account's webhooks so delivery statuses and replies reach you, to create, sync, and delete message templates on your account, and to refresh the number's display name and quality rating. We use it for nothing else.
  • Messages you send: we store the recipient number, the message type and text, the template name and parameters, links to any media, and each delivery status Meta reports (sent, delivered, read, failed) together with Meta's status notification. Media is sent by link. We do not host it; Meta fetches it from the URL you provide.
  • Messages people send to your number: Meta forwards them to us through a webhook. We store the sender's phone number, the profile name their WhatsApp shares, the message type, the text or caption, the message object as Meta sent it, and the time it was received. We forward each message to the webhook endpoints you configured so you can reply. We do not download media files from inbound messages.
  • Templates: the name, language, category, header, body, footer, buttons, example values, and review status of each template you create in Retransmit or sync from WhatsApp Manager.
  • How we store it: the access token and the number's two-step verification PIN are encrypted at rest with AES-256-GCM using a key held outside the database, on top of the disk encryption that covers everything else. Neither is ever shown in the dashboard or returned by the API. Only members of your organization with the admin role can connect or disconnect a number.
  • How we share it: with Meta, to deliver your messages and manage your account, and with the infrastructure providers that host the service on our behalf. We do not sell it, use it for advertising, or use it to train models. We do not share it with anyone else.
  • Disconnecting: remove a number from the WhatsApp page in the dashboard. We delete the stored token and PIN right away and unsubscribe our app from your WhatsApp Business Account when no other connected number shares it. Your message logs, templates, and delivery events stay in your account so you can audit past sending, and are deleted with the account. You can also remove Retransmit from your WhatsApp Business Account at any time in Meta Business Suite under Business settings, which revokes our access on Meta's side immediately.

Meta Platform data disclosure

Retransmit's use of data received from Meta follows the Meta Platform Terms, the Meta Developer Policies, the WhatsApp Business Terms of Service, and the WhatsApp Business Messaging Policy. We use Platform Data only to provide the WhatsApp features described above, on behalf of the business that connected the account. When you connect a number, you share the data listed above with Retransmit, and the messages you send and receive pass through Meta's servers under Meta's own privacy policy.

You remain responsible for the content of your messages, for opening conversations with approved templates, and for holding the opt-in that WhatsApp requires before a business messages someone. If Meta asks us to delete Platform Data, or if a person asks to delete data that relates to them, we delete it. Humans at Retransmit do not read your messages except with your permission, for support at your request, for security and abuse prevention, or where the law requires it.

How we use your data

We use your data to operate the service: to deliver your emails, SMS, and WhatsApp messages, pass replies back to you, show you logs and analytics for your own sending, bill your prepaid balance, prevent spam and abuse, secure the platform, and respond to support requests.

We do not sell your data. We do not serve ads. We do not use the content of your messages for advertising or to train models.

Where the GDPR applies, our legal bases are: performance of our contract with you (running the service you signed up for), legitimate interests (securing the platform and preventing abuse), legal obligation (tax and accounting records), and consent where we ask for it.

Your recipients' data

When you send email, SMS, or WhatsApp messages through Retransmit, you give us the addresses, phone numbers, and message content of people who are not our customers, and when they reply on WhatsApp, their replies. For that data you are the controller and we are your processor: we process it only to deliver your messages, record delivery events, pass replies back to you, and maintain your suppression list, on your instructions. You are responsible for having a lawful basis to contact your recipients.

If you received an email or message sent through Retransmit and have questions about it, contact the sender first; they control that data. You can also reach us at contact@logestalabs.com and we will help route your request.

Cookies

The dashboard uses first-party session cookies to keep you signed in. The website stores your theme preference in your browser. To measure pageviews and conversion journeys across visits, the website also stores a random visitor identifier in local storage until you clear the site's data and in a first-party _wa_id cookie with a renewable two-year expiry. We do not use advertising cookies or use this identifier for cross-site tracking.

Who we share it with

We share data only with the providers we need to run the service:

  • Amazon Web Services: our infrastructure runs on AWS data centers in the European Union and the United States. Your emails are delivered through Amazon SES, email attachments are stored in Amazon S3, and some SMS is delivered through AWS End User Messaging.
  • Meta Platforms: when you connect a WhatsApp Business number, Meta receives the messages you send, delivers replies and status updates to us, and holds the account, number, and template data described in the WhatsApp Business Platform section. Meta processes it under the WhatsApp Business Terms and its own privacy policy.
  • SMS carriers: the mobile carriers and gateways that deliver your SMS receive the recipient number, sender id, and message text. Which one carries a message depends on the destination; today they are MTN Cameroon, Orange Cameroon, and AWS End User Messaging.
  • Slane Analytics: analytics.slane.io receives website page URLs, referrers, browser window widths, random visitor identifiers, and conversion event names and placements so we can measure website usage.
  • Payment providers: when you buy credits, your payment details go directly to the payment provider. We never see or store card numbers; we receive only confirmation that a payment succeeded.
  • Authorities: we disclose data to law enforcement or regulators only when the law requires it, and we push back on requests that are overbroad.

International transfers

Our infrastructure runs in the European Union and the United States, so your data may be processed in either region. Meta and the SMS carriers process the messages they deliver in their own regions under their own terms. Where data moves out of the European Economic Area, we rely on safeguards such as the European Commission's Standard Contractual Clauses with our providers.

Retention and deletion

We keep data only as long as it serves a purpose:

  • Account data is kept while your account is active and deleted when your account is deleted.
  • Message logs and delivery events for email, SMS, and WhatsApp, including replies to your WhatsApp number, are kept while your account is active so you can audit your sending, and deleted when your account is deleted. Email attachments are deleted 30 days after upload.
  • WhatsApp access tokens and PINs are deleted the moment you disconnect the number.
  • Suppression entries are kept while your account is active, to protect recipients who bounced, complained, or unsubscribed from receiving further email.
  • Billing records are kept as long as tax and accounting law requires.
  • Server logs containing IP addresses are kept for a short period for security and debugging, then deleted.

Deleting your account

You can delete API keys, domains, webhook endpoints, suppression entries, and connected WhatsApp numbers from the dashboard at any time. To delete your account and its data, including everything we received from Meta, email contact@logestalabs.com from your account address. We will delete your data within 30 days, except for records we must keep for legal or billing reasons, and we will confirm when it is done.

If you connected a WhatsApp number, you can also remove Retransmit from your WhatsApp Business Account in Meta Business Suite. That revokes our access on Meta's side even before we delete our copy.

Step by step instructions for every case are on the data deletion page at retransmit.dev/data-deletion.

Security

All traffic is encrypted in transit with TLS, and data is encrypted at rest. WhatsApp access tokens and PINs carry a second layer of AES-256-GCM encryption. API keys are scoped, shown once, and revocable. Webhook payloads we send are signed with HMAC-SHA256 so you can verify they came from us, and webhooks we receive from Meta are checked against Meta's signature before we process them. Access to production systems is restricted to the people who operate the service. If we learn of a breach that affects your data, we will notify you without undue delay.

Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you and get a copy of it.
  • Correct data that is inaccurate.
  • Delete your data.
  • Export your data in a portable format.
  • Restrict or object to certain processing.
  • Withdraw consent where processing is based on consent.
  • Complain to your local data protection authority if you believe we have mishandled your data.

Exercising your rights

Email contact@logestalabs.com with your request and we will respond within 30 days. We may ask you to verify that you control the account before acting. We do not discriminate against you for exercising any of these rights.

Children

Retransmit is a developer tool for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

If this policy changes in a way that matters, we will update the date above and note the change on this page. For significant changes we will also notify you by email. Continued use of the service after a change means you accept the updated policy.

Contact

Questions, requests, and complaints about privacy go to contact@logestalabs.com. We read everything and a person will reply.