Staying inside WhatsApp's rules
WhatsApp privacy is not only about data law — it's also platform compliance. Violating WhatsApp's Business Messaging Policy can get your number limited or banned. Here is how Spun helps you stay clean.
Two layers of obligation
Sending messages through WhatsApp means you have two simultaneous obligations:
- Privacy law (GDPR, Israeli PPL, CAN-SPAM, TCPA, country-specific telecom law) governs what you can store and message about, and requires consent, retention controls, and deletion rights.
- WhatsApp's own terms govern how you can use the platform: opt-in requirements, anti-spam pacing, template rules for business API customers, prohibited content categories.
Even a perfectly GDPR-compliant business can still get banned from WhatsApp for spam-like volume, low opt-in quality, or prohibited content. The features below address the WhatsApp-platform side specifically — privacy-law controls are documented across the other privacy pages.
Consent & opt-in
You must have permission to message every contact. Spun gives you the tools to capture, prove, and respect that permission.
Opt-in source tracking
Every contact can carry an opt-in source: existing customer, web form, in-person, referral, etc. Stored on the contact record so you can answer "where did this person consent" months later — required by most messaging-privacy laws.
Automatic STOP / unsubscribe handling
When a contact replies "STOP", "unsubscribe", "remove me" or your custom keywords, Spun marks them opted-out and suppresses outbound campaigns/automations. The chat itself stays open for 1:1 reply if they message you again.
Customer-responsibility notice
During onboarding and inside campaign tools, Spun reminds the operator that they must have permission to message every contact. The customer is the controller; Spun is the processor.
Anti-spam & anti-ban controls
Avoid being flagged by WhatsApp's pattern detection. These controls reduce the operational signals that lead to limitations or bans.
Campaign pacing
Spun spreads broadcast sends across time with jitter to avoid spam-like bursts. Configurable per campaign. Helps your WhatsApp number stay below pattern-detection thresholds.
Spam detection
Heuristics monitor for accidental mass-spam patterns (identical message to large recipient lists, sudden volume spike, high block rate). Triggers a warning to the org admin before WhatsApp takes action.
Local-presence proxies
WhatsApp connections route through residential or ISP-grade proxies in the country matching your number — significantly reducing the connection-source signals that lead to bans.
Message template discipline
For official WhatsApp Business API customers (Pro and above), Spun enforces template usage rules: opt-in within 24-hour customer-service window, approved templates outside the window.
Org-level controls
Admins can stop all WhatsApp sending instantly, route specific contacts internally, or audit every outbound message.
Per-org sending kill switch
Admins can disable all outbound WhatsApp sends instantly. Used during testing, account review, or when transferring numbers. Stops campaigns, scheduled messages, chatbot replies, and manual sends.
Keep contact internal
Per-contact flag that forces all outbound messages to route through Spun Chat only. Server-level hard-block on WhatsApp sends until an admin explicitly changes the setting.
Audit log of outbound sends
Every message sent through Spun is logged with sender, recipient, content hash, and channel. Used for dispute resolution and compliance reviews.
Important: connection method disclosure
Spun connects to WhatsApp through a third-party WhatsApp Business gateway provider (see sub-processors). This is how nearly all multi-agent WhatsApp business tools work — direct WhatsApp Business API access is reserved for very large companies.
Practical implications:
- WhatsApp's E2EE protects messages while they are inside WhatsApp's infrastructure. The gateway necessarily sees plaintext when relaying to Spun. Spun in turn sees plaintext to display, search, and process messages.
- This means messaging through Spun is not end-to-end encrypted between you and your customer in the WhatsApp sense. It is encrypted in transit between every system, but at least one Spun system can read it.
- WhatsApp may impose limitations on numbers connected through Business API providers if anti-spam signals trigger. We do everything reasonable to avoid this, but ultimate responsibility for the content sent rests with the customer.
- If a regulator or court asks Spun for messaging data, we follow our legal process described in the Privacy Policy.
What you cannot send via Spun
In addition to WhatsApp's own prohibited categories, our Acceptable Use Policy prohibits the following.
- Bulk messaging to contacts who have not opted in
- Messaging after a contact has sent STOP / unsubscribe
- Messages that violate WhatsApp's Business Messaging Policy (illegal goods, deceptive content, etc.)
- Phishing, fraud, or impersonation
- Spam, malware, or links to malicious software
- Content targeting children where consent has not been obtained from a parent/guardian
- Content prohibited in the recipient's jurisdiction
Violations may result in suspension of your Spun org. Repeated or severe violations may result in account termination and reporting to law enforcement where applicable.
WhatsApp ban or limitation?
If your WhatsApp number has been limited or banned and you believe it was the result of activity through Spun, contact [email protected]. We help you appeal and audit recent activity.