LakehouseBox — WhatsApp addendum
Version: 18 October 2026
Effective: 18 October 2026
Provider: Lakehousebox, S.L., calle Bárbara de Braganza, 2, 2ª planta, 28004 Madrid, Spain, NIF B05742093
This addendum applies only to an organisation that uses messaging intake over WhatsApp: people the organisation names send messages, photos, voice notes and documents to the LakehouseBox WhatsApp number, and they arrive as rows in a table of one of the organisation's catalogs. It adds to the Terms of Service and the Data Processing Agreement; where it says something different about this channel, it prevails for this channel only. An organisation that does not use WhatsApp is not affected by it.
1. When it applies
An administrator of the organisation accepts this addendum, for the organisation, before its first WhatsApp intake is switched on. We record who accepted it, which version and when. A new version of this addendum is accepted again before it applies; until then the version accepted stays in force.
2. Roles
The organisation decides whom to add as a member of an intake and what their messages are for: it is the controller of those messages and of the members' phone numbers.
Lakehousebox, S.L. receives, stores and processes them on the organisation's instructions: it is the processor, as for the rest of the organisation's content (the Data Processing Agreement).
Meta Platforms Ireland Limited (Dublin, Ireland; part of Meta Platforms, Inc., United States) runs WhatsApp and the WhatsApp Business Platform the messages pass through. For this channel only, it is a sub-processor in addition to those listed in Annex III of the DPA.
Scaleway SAS (Paris, France), already a sub-processor (Annex III of the DPA), also transcribes voice notes with its generative AI service in Paris, only when the organisation has hosted agents turned on and the intake's table has a
transcriptcolumn. The transcription is charged to the organisation's monthly AI allowance.
3. Where the messages go
- A member sends a message to the LakehouseBox WhatsApp number. It travels through Meta. Meta stores message content at rest in Germany for this number (Meta's local storage, set when the number was registered); while it is processed it may be held in Meta's data centres in other countries, including outside the European Union, for up to 60 minutes. Meta keeps the contact phone numbers and, for up to 7 days, the files sent. We cannot shorten what Meta keeps: that is governed by Meta's own terms for the WhatsApp Business Platform.
- Meta forwards the message to our servers in Germany (section 4). Photos, voice notes and documents are fetched from Meta at once.
- Using WhatsApp therefore means this content leaves the European Union-only processing that the rest of the Service offers. An organisation that needs that should not use this channel.
4. What we store, and where
| what | where | how long |
|---|---|---|
| each member's phone number and the name (label) the organisation gives them | our control plane (Hetzner, Germany), never in the organisation's tables | until the member or the intake is removed |
| each message as a row: when it was sent and received, its kind, text or caption, the member's label (never the phone number), a shared location, the file's name, type and size, and a voice note's transcript when there is one | the organisation's own table, in its catalog (Germany) | as long as the organisation keeps it: it is the organisation's content |
| photos, voice notes, videos and documents (up to 32 MB each; a larger one is recorded without its file) | the organisation's catalog files (Germany), under intake/<intake>/ |
as long as the organisation keeps them |
| the message while it is being stored (the original message, held until its row is written) | our control plane (Germany) | cleared as soon as the row is written, or after the last of five attempts fails |
| the message's WhatsApp identifier and the sender's phone number, to recognise a message Meta sends twice | our control plane (Germany) | 7 days after the message was stored, or after its last attempt failed |
A message from a number that is not a member of an intake is dropped: nothing of it is stored, only counted.
5. What the number does, and does not do
The number sends one automatic reply, "Recibido ✓" followed by the intake's name, at most once every two minutes per member, to confirm that a message was stored. It does not start conversations, does not answer questions and is not a chat assistant. Voice notes are transcribed (section 2) so that their text is in the table; nothing else is generated from the messages.
6. What the organisation does
- It adds as members only people who have agreed to send their messages to it this way, tells them that their messages pass through WhatsApp (Meta) and end up in the organisation's LakehouseBox catalog, and has a legal basis for that.
- It answers its members' requests about their messages (access, correction, erasure) in its own table, where it can read, change and delete the rows and files itself; we assist as the DPA says.
- It does not use the number for anything Meta's WhatsApp Business policies forbid, nor to send messages to people who did not write first.
7. Removing a member or stopping
To remove a member, stop an intake or stop using WhatsApp, an administrator writes to hello@lakehousebox.com. Once a member is removed, their messages are dropped unstored as in section 4. What is already in the organisation's table and files stays there until the organisation deletes it; deleting the catalog deletes it, with the intake. The other records in section 4 end as that table says.
8. Contact
Lakehousebox, S.L., calle Bárbara de Braganza, 2, 2ª planta, 28004 Madrid, Spain, NIF B05742093, hello@lakehousebox.com.
Change log
- 2026-10-18 — first version, in force from 18 October 2026 (founder, 2026-10-18: a separate addendum an organisation accepts when it turns the WhatsApp intake on, so that the Terms, the Privacy Policy and the DPA stay as they are). The number is +34 614 16 02 34, registered with Meta's local storage in Germany the same day.