日本語への翻訳がまだ完了していません。
日本語の最終更新:
Data Privacy & Security
This page describes how Meta provides Cloud API as a standalone service for businesses to message users at scale via WhatsApp. Meta also offers additional optional services that businesses can choose to use with Cloud API. For example, a business can leverage Meta’s AI capabilities to converse with customers via Cloud API. When a business chooses to use these services, different terms could apply. Please consult the applicable documentation for additional details on how Meta processes data for these services.
Message Flows
When a user sends a message to one of these businesses, the message travels end-to-end encrypted between the user and the Cloud API. As per the Signal protocol, the user and the Cloud API, on behalf of the business, negotiate encryption keys and establish a secure communication channel. WhatsApp cannot access any message content exchanged between users and businesses.
Once a message is received by the Cloud API, it gets decrypted and forwarded to the Business. Messages are only temporarily stored by the Cloud API as required to provide the base API functionality.
Messages from a business to a user flow on the reverse path. Businesses send messages to Cloud API. The Cloud API service stores the messages temporarily and takes on the task to send the message to the WhatsApp platform. Messages are stored for any necessary retransmissions.
All messages are encrypted by the Cloud API before being sent to WhatsApp using the Signal protocol with keys negotiated with the user (recipient).
WhatsApp acts as the transport service. It provides the message forwarding software; both client and server. It has no visibility into the message content being sent. It protects the users by detecting unusual messaging patterns (like a business trying to message all users) or collecting spam reports from users.
Cloud API, operated by Meta, acts as the intermediary between WhatsApp and the Cloud API businesses. In other words, those businesses have given Cloud API the power to operate on their behalf. Because of this, WhatsApp forwards all messages destined for those businesses to Cloud API. WhatsApp also expects to receive from Cloud API all messages from those businesses. This is the same client behavior that the On-Premise client has.
Meta, in providing the Cloud API service, acts as a Data Processor on behalf of the business. As such, the businesses have requested Meta to provide programmatic access to the WhatsApp Business Platform.
Cloud API receives from WhatsApp the messages destined for the businesses that use Cloud API. Cloud API also sends to WhatsApp the messages sent by those businesses. Other parts of Meta (other than Cloud API) do not have access to the Cloud API business communications, including message content. Meta does not use any Cloud API data for advertising.
Stored and Collected Data
All data collected, stored and accessed by Cloud API is controlled and monitored to ensure proper usage and maintain the high level of privacy expected from a WhatsApp client.
Information about the businesses, including their business phone numbers, business address, etc. is maintained by Meta and the Business Manager product and is subject to the terms of service set by Meta. Cloud API relies on Business Manager and other Meta systems to identify any access to Cloud API on behalf of the business.
Messages sent or received via Cloud API are only accessed by Cloud API, no other part of Meta can use this information. Messages have a maximum retention period of 30 days in order to provide the base features and functionality of the Cloud API service; for example, retransmissions. After 30 days, these features and functionality are no longer available.
Cloud API does not rely on any information about the user (customer/consumer) the business is communicating with other than the phone number used to identify the account. This information is only used to deliver the messages via the WhatsApp client code. User phone numbers are used as sources or destinations of individual messages; as such they are deleted when messages are deleted. No other part of Meta other than Cloud API has access to this information.
No message content is shared or sent to WhatsApp at any time and no WhatsApp employee has access to any message content.
| Cloud API Data | System | Available to the rest of Meta? | Available to WhatsApp? |
|---|---|---|---|
Message content | Cloud API | No | No |
Consumer phone number | Cloud API | No | Yes |
Non-identifiable statistics | Cloud API | Yes | Yes |
Integrity signals - per business | WhatsApp Client | No | Yes |
Business information | Business Manager | Yes | Yes |
Billing - per business | Yes | Yes |
FAQs
Metaは、利用者に表示される広告にWhatsAppメッセージを使用することはありません。ただし、ビジネスにとっては当然のことですが、ビジネスは受け取ったメッセージを自社のマーケティングの目的で使用できます。これには、Facebookやその他のチャネル(メールやテレビなど)での広告も含まれる場合があります。
クラウドAPIは、ビジネスがクラウドAPIのローカルストレージを使用することを選択している場合を除き、Metaのデータセンターで運用されています。Metaのデータセンターは北米とEUにあります。
保存されたメッセージは暗号化されます。30日が経過すると自動的に削除されます。
他すべてのWhatsApp Business APIソリューションパートナー同様、Metaもビジネスの代わりに暗号化キーと復号化キーを管理しています。クラウドAPIを介したメッセージの送受信を可能にするため、クラウドAPIではビジネスの代わりに暗号化/復号化キーを管理しています。クラウドAPIの運用を行っているのはMetaですが、その規約により、クラウドAPIのサービス提供はメッセージ配信にのみ制限されています。WhatsAppがキーまたはメッセージにアクセスすることはありません。
弊社はSOC2 Type IIレポートを取得しています。詳しくは、 Metaビジネスメッセージのコンプライアンスセンター をご覧ください。
Metaは、個人データ保護と利用者のプライバシーをきわめて重要なものと考え、これからも変わらずデータ保護法制の遵守に努めます。クラウドAPIにおいても、Metaの利用者は一般データ保護規則(GDPR)に定められる義務を引き続き遵守できます。Metaでは、法的要件、業界の要件、規制上の要件、業界のベストプラクティスを遵守するよう徹底しています。 詳細情報をご覧ください。
MetaとWhatsAppは、EUや英国から米国にデータを移転する場合、GDPRを遵守した適切な移転メカニズムに依拠しています。
その他の情報については、以下の規約をご覧ください。
- ヨーロッパ地域にお住まいの方は、 WhatsApp Businessデータ移転に関する補足をご覧ください。
- 英国にお住まいの方は、 英国からのWhatsApp Businessデータ移転に関する補足をご覧ください。
適用される WhatsApp Businessデータ処理規約 または クラウドAPIに関するMetaホスティング規約 (該当復処理事業者のリストを含む)をご覧ください。
弊社は、Metaのビジネスおよびパートナーがそれぞれのデータの安全を確保しつつ、ビジネスソリューションを活用できるよう引き続き取り組んでまいります。