Who Owns Your WhatsApp Data and Number? Ask Before You Sign

Nobody asks these questions while buying. Everybody asks them while leaving, which is the worst possible time, because by then the answers are whatever the contract already said. Ten minutes of due diligence at the start removes a problem that is otherwise expensive and sometimes unfixable.

This applies to us too. We make a WhatsApp CRM, so treat the standards below as the ones we think a customer should hold any vendor to, including us.

The one that matters most: whose Business Manager?

A WhatsApp Business API number lives inside a WhatsApp Business Account, which in turn lives inside a Meta Business Manager. Which Business Manager it sits in decides whether the number is genuinely yours.

• Your own Business Manager, provider added as a partner. This is correct. The number, the templates and the quality history belong to you, and switching providers means revoking one partner and adding another.
• The provider's Business Manager. Common, convenient at setup, and the source of most horror stories. Your number sits inside somebody else's asset, so moving it needs their cooperation. If the relationship has soured, you are negotiating for your own phone number.

Ask the question in exactly these words: "Will the WhatsApp Business Account be created inside my Meta Business Manager, with you added as a partner?" A clear yes is the answer you want. Anything vague is worth pushing on before money changes hands.

If you are already in the wrong position, it is usually recoverable — the process is in switching WhatsApp CRM providers without downtime.

What you should be able to export, and in what form

"We can provide a data dump on request" is not an export capability. It is a favour, and favours end. What a business should be able to download itself, any day, without a support ticket:

• Contacts with everything attached — tags, custom fields, segments, source, and the date each one was added. A contact list without the tags is a phone book, not a CRM export.
• Full conversation history — messages with timestamps and which agent sent what. This is the record that settles a customer dispute, and it is the first thing people discover they cannot get.
• Opt-in and opt-out records — with the date, the source and the exact consent wording. Under India's data protection law this is a compliance record you are expected to be able to produce, so it cannot live only inside a vendor's database.
• Approved message templates — the text and the category. Templates themselves move with the WhatsApp Business Account, but having your own copy saves rebuilding them from memory.
• Campaign results — what was sent, to whom, when, delivered and read counts.

Format matters: CSV or JSON, machine-readable. A PDF of your contacts is not an export.

Ten questions to ask before you sign

1. Will the WhatsApp Business Account be in my Meta Business Manager, with you as a partner?
2. Can I export contacts, conversations and consent records myself, whenever I want, without asking you?
3. What format is the export, and does it include tags, custom fields and agent names?
4. On the day I cancel, how long do I keep access to export?
5. Where is my data stored, and in which country?
6. Do you add a markup on Meta's per-message rate, or do I pay Meta's rate?
7. Who can see my customers' phone numbers inside your company, and is that logged?
8. If I want customer numbers masked from my own agents, can you do that?
9. What happens to my data after I leave — how long is it kept, and can I have it deleted?
10. Can you give me a reference customer who has left you?

The last one is the most revealing question on the list, and the one nobody asks.

The exit clause, in plain terms

Read the termination section of any contract before the pricing section. Four things to look for:

• Notice period. Thirty days is normal. Ninety days on a monthly plan is not.
• Access after cancellation. You need a window — two weeks is reasonable — in which the account still opens so you can export. A contract that cuts access on the cancellation date is a contract that holds your records hostage by design.
• Who pays for the migration. Usually you. Fine, as long as it is not a number invented after you announce you are leaving.
• Data deletion on request. You should be able to require it, and get written confirmation.

If a vendor will not put the export window in writing, that is the answer to question four, whatever they say on a call.

Your own house: things that are your responsibility

Half of the lost-data stories we see are not the vendor's fault at all.

• The number should be registered to the business. Not an employee's personal SIM, not an agency's. A number in a departed employee's name is a genuinely hard problem.
• The Business Manager admin should be the owner. Add staff and agencies as users; keep admin with the business. This is the same rule as with a domain registrar, and it is broken just as often.
• Export monthly and keep it somewhere you control. Fifteen minutes a month. A business with twelve monthly exports in its own drive is never trapped by anyone.
• Keep the consent record outside the tool too. It is a legal record, and legal records should not have a single point of failure.
• One login per person, never a shared account. Shared logins mean you cannot remove access for one person, and cannot tell who exported what. More on this in the shared team inbox guide.

What India's data protection law adds

Under the DPDP Act your business is responsible for the personal data of your customers even when a vendor processes it on your behalf. Practically, that means three things for a WhatsApp CRM:

• You must be able to produce the consent record if a customer or a regulator asks. If only your vendor can produce it, you are relying on their cooperation for your own compliance.
• You must be able to act on a deletion request. If a customer asks to be removed, you need a route that works, and you should know how long the vendor's backups retain the record afterwards.
• Your agreement should say what the vendor may do with the data. Processing it to deliver the service, yes. Anything else should be excluded explicitly.

The wider obligations are covered in the DPDP Act and WhatsApp marketing.

The short version

Insist that the WhatsApp Business Account sits in your own Meta Business Manager with the provider as a partner. Insist on self-service export of contacts, conversations and consent records in CSV or JSON. Get the post-cancellation export window in writing. Keep the number registered to the business, keep admin rights with the owner, and export monthly to storage you control. Do those six things and leaving any vendor, including us, becomes a technical task rather than a negotiation.

Frequently Asked Questions

Who owns a WhatsApp Business API number, the business or the provider?

The business should own it, and that depends on one thing: whose Meta Business Manager the WhatsApp Business Account sits in. If it is in your own Business Manager with the provider added as a partner, the number is yours and you can move it. If it sits inside the provider's Business Manager, moving providers becomes their decision rather than yours.

What should I be able to export from a WhatsApp CRM?

Contacts with all tags and custom fields, full conversation history with timestamps and agent names, opt-in and opt-out records including the consent wording, your approved templates, and campaign results. All of it in CSV or JSON, downloadable by you without raising a support ticket.

Can a provider stop me from leaving?

Not if your WhatsApp Business Account is in your own Meta Business Manager and you hold an export of your data. Those two things together make the switch a technical task rather than a negotiation. Check both before you sign, not on the day you want to leave.

How long should I keep access after cancelling?

Ask for at least two weeks of read and export access after the cancellation date, in writing. A contract that cuts off access on the final day effectively holds your conversation history and consent records, and those are the two things you are most likely to need later.

Is it a problem if my data is stored outside India?

It is not automatically a problem, but you should know the answer and have it in the agreement, along with what the vendor is permitted to do with the data and how long it is retained after you leave. Under the DPDP Act the responsibility for your customers' data stays with you regardless of where your vendor keeps it.