Skip to content
OmniChannels.ai
Menu

Free tool

SMS and WhatsApp Privacy Policy and Terms Generator

Generate the mobile messaging section your privacy policy is missing, plus messaging terms for your SMS or WhatsApp program: what you collect, who processes it, retention, opt-out, rights and international transfers. English, Arabic or bilingual, with country clauses for the UAE, Saudi Arabia, the GCC, Egypt, the EU, the UK, Brazil and the US.

Free · no sign-up · runs in your browser

This is not legal advice. Have your counsel review.

These drafts are a starting point based on public rules we reviewed. Laws, regulator policies and carrier or Meta requirements change and depend on your facts. Have a qualified lawyer in each country review and adapt the text before you use it.

Document language

The clauses are generated in English, Arabic or both side by side. Choose the language above.

Countries and laws
Company

Shown in the messaging terms. Leave empty to use the legal name.

Messaging
Channels
Message types

Leave empty for "frequency varies".

Data handling
Service providers that process the data

Delivery records and message content.

This is a clause set to paste into your existing privacy policy and terms, not a full policy.

  1. 1. Mobile messaging

    This section explains how Acme Trading LLC ("we", "us") collects and uses personal data when we communicate with you by SMS and WhatsApp. It forms part of our Privacy Policy.

  2. 2. What we collect

    • your mobile number and, if you give it, your name
    • a record of your consent or opt-out: date and time, where and how it was given, the wording shown and, for online forms, technical data such as IP address
    • the messages we send you and your replies, including keywords such as STOP or HELP
    • delivery data such as timestamps, delivery status and the mobile network
    • your WhatsApp profile name and WhatsApp ID, and read receipts where WhatsApp provides them

  3. 3. How we use it

    • to send the service messages you need about your orders, bookings or account (to perform our contract with you, or as permitted by law)
    • to send verification codes that protect your account and prevent fraud
    • to send marketing messages, only if you have opted in, and until you opt out
    • to keep a record of consents and opt-outs, so that we can respect your choices and show that we follow the law
    • to check delivery, fix problems and protect our messaging service from fraud and abuse

  4. 4. Marketing consent and opting out

    We send marketing messages by SMS and WhatsApp only to people who have opted in. Opting in is never a condition of buying from us. You can opt out at any time, free of charge:

    We act on opt-outs promptly and within any time limit the law sets. We may send one message to confirm the opt-out. We keep your number on a suppression list so that we do not message you again unless you opt in again.

    • reply STOP or ايقاف to any SMS or RCS message
    • reply STOP or tap the opt-out button in a WhatsApp message
    • contact us at privacy@acme.example

  5. 5. Who we share it with

    We share messaging data only with service providers that help us send messages, under contracts that limit their use of the data to that purpose, and with:

    We do not sell your mobile number. We do not share mobile numbers or opt-in consent data with third parties or affiliates for their own marketing purposes.

    • our messaging provider, which sends and routes our messages
    • mobile network operators and messaging aggregators, which deliver messages to your phone
    • WhatsApp and Meta, which process WhatsApp messages under their own terms as part of the WhatsApp Business Platform
    • public authorities, where the law requires us to

  6. 6. International transfers

    Some of our providers process data outside [country]. When that happens, we transfer data only as the applicable law allows and use the safeguards it requires, for example a decision that the destination offers adequate protection, standard contractual clauses or another approved mechanism.

    For personal data covered by the UAE Personal Data Protection Law, transfers outside the State follow Articles 22 and 23 of Federal Decree-Law No. 45 of 2021.

  7. 7. How long we keep it

    • message content and delivery records: up to 12 months, unless the law requires longer
    • consent records: while your consent is active and for 3 years after it ends, to show that we had consent
    • opt-out (suppression) records: for as long as needed to make sure we do not message you again

  8. 8. Security

    We protect messaging data with access controls, encryption in transit and contracts with our providers. WhatsApp messages are encrypted in transit, but the WhatsApp Business Platform and the providers we use to send them process message content to deliver them. SMS is not end-to-end encrypted, so we do not ask for sensitive information such as passwords by SMS.

  9. 9. Your rights

    Depending on where you live, you may have the right:

    To use these rights, contact privacy@acme.example. We may need to confirm your identity first.

    • to be told how we use your personal data
    • to access the personal data we hold about you and get a copy
    • to have inaccurate or incomplete data corrected
    • to ask us to delete your data, subject to legal exceptions
    • to ask us to restrict processing
    • to object to processing, including at any time to direct marketing
    • to receive your data in a portable format
    • to withdraw your consent at any time, without affecting earlier processing
    • to complain to the data protection authority

  10. 10. Information for specific countries

    United Arab Emirates: we process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and send promotional messages in line with the rules of the Telecommunications and Digital Government Regulatory Authority (TDRA). Data processed in a free zone with its own data protection law, such as DIFC or ADGM, is governed by that law instead.

  11. 11. Children

    Our messaging programs are not intended for anyone under 18.

  12. 12. Contact

    Acme Trading LLC · privacy@acme.example

Nothing you type here is sent to our servers.

Short answer

An SMS privacy policy section explains what you collect when you message people (number, consent record, messages, delivery data), why, who processes it (your messaging provider, operators, WhatsApp/Meta), how long you keep it and how to opt out. It should state that you do not sell numbers or share opt-in data for others' marketing. Messaging terms add the program description, frequency, costs, HELP and STOP.

Trusted infrastructureOfficial Meta Business Solution ProviderGoogle RBM partnerGSMA memberISO/IEC 27001:2022ISO/IEC 27018ISO 9001:2015ISO 22301SOC 2 Type IIGDPR compliant

How to create your messaging privacy clauses

  1. 1

    Choose language and countries

    Pick English, Arabic or a bilingual document, and every market you message. Country clauses and rights adapt to your choice.

  2. 2

    Enter company details

    Add your legal name, address, privacy contact and, if you have one, your data protection officer. For Arabic output, add the Arabic company name.

  3. 3

    Describe your messaging

    Select channels, message types, the service providers that process the data, retention periods and whether data leaves your country.

  4. 4

    Copy, download and review

    Copy the privacy section and the terms, download a Word .doc or print. Publish both pages without a login, link them at every opt-in point, and have counsel review.

Why your privacy policy needs a messaging section

Generic privacy policies rarely say what happens to a mobile number once it enters an SMS or WhatsApp program. Regulators and reviewers want to see it: Saudi Arabia's PDPL requires a privacy policy to be available before data is collected, Oman's Executive Regulation asks for the data protection policy to be displayed in a conspicuous place, WhatsApp's Business Messaging Policy requires a published privacy policy, and US carriers check the policy linked from your opt-in when they review 10DLC and toll-free campaigns.

The generator writes a section to paste into your existing policy, not a whole policy. That keeps it short and accurate, and it lines up with the consent wording from our opt-in consent generator.

  • What you collect: number, consent record, messages, replies and delivery data.
  • Why: service messages, verification codes and, with consent, marketing.
  • Who processes it: messaging provider, operators, WhatsApp/Meta, Google for RCS.
  • How long you keep message logs, consent proof and opt-out records.
  • How to opt out, people's rights and how to contact you.

WhatsApp and Meta in your privacy policy

When you use the WhatsApp Business Platform, Meta processes message content to deliver it. Meta's documentation for the Cloud API describes Meta as acting as a data processor or service provider on behalf of the business, and says messages are kept for a maximum of 30 days to provide the service. Your policy should name WhatsApp and Meta as providers and say that WhatsApp's own terms also apply.

Be careful with security claims. WhatsApp messages are encrypted in transit, but the platform and your providers process the content, so the generated text avoids promising end-to-end encryption for business messages.

Messaging terms for SMS programs

Messaging terms tell people what they signed up for: the program, the message types, how many messages to expect, that message and data rates may apply, how to stop and get help, that operators are not liable for delays, and that they must be the account holder of the number. US carriers and the CTIA Messaging Principles expect these points for recurring programs, and they are good practice everywhere.

Arabic and bilingual policies for the GCC

Customers in the UAE, Saudi Arabia and the rest of the GCC often expect an Arabic version, and it makes your commitments clear to Arabic-speaking regulators. The generator writes native Arabic clauses, right-to-left, and a bilingual document with English and Arabic for each clause. It names the relevant laws, such as the UAE's Federal Decree-Law No. 45 of 2021, Saudi Arabia's PDPL and Bahrain's Law No. 30 of 2018, and their transfer rules.

The output is a draft based on public laws reviewed on the date shown in the file. It is not legal advice. Have counsel check it against your real data flows and contracts.

SMS privacy policy: common questions

What should an SMS privacy policy include?

What you collect (number, consent record, messages, delivery data), why you use it, who processes it, how long you keep it, how to opt out, people's rights and how to contact you. Add that you do not sell numbers or share opt-in data with third parties for their marketing.

What is the 10DLC privacy policy statement?

US carriers commonly look for wording such as "We do not share mobile numbers or opt-in consent data with third parties or affiliates for their own marketing purposes." The generator includes it in every policy. Carrier requirements change, so check your provider's current campaign guidance.

Do I need a separate SMS terms and conditions page?

For recurring US programs it is expected, and it helps everywhere. It can be a section of your site terms, as long as it is public, linked at the opt-in point and covers the program, frequency, costs, HELP, STOP and operators' non-liability.

Is Meta a data processor for WhatsApp messages?

For the Cloud API, Meta's documentation says it acts as a data processor or service provider on behalf of the business, with WhatsApp's data processing terms applying. Name WhatsApp and Meta as providers in your policy and check the terms for your setup.

Can I get the policy in Arabic?

Yes. Choose Arabic for a right-to-left document or bilingual for English and Arabic side by side. Add your company name and country in Arabic for a native result.

How long should we keep SMS logs and consent records?

Keep message logs only as long as you need them, often 6 to 24 months, and consent proof while the consent is active plus the period you may need to prove it. Egypt requires three years from the last message. Set your periods with counsel.

Is this privacy policy generator legal advice?

No. It produces draft clauses from public rules. Laws, regulator policies and carrier requirements change, so have a lawyer in each market review the text before you publish it.

More free tools