Last updated: 31 July 2026
Why you are reading this
You have landed here for one of two reasons. Either you bought something from a Pakistani online store and a message about it arrived on your WhatsApp, or you run that store and want to know exactly what happens to your customers' details before you connect anything to us. Both answers are on this page. What Support is a Karachi business that runs customer support and order updates on WhatsApp for e-commerce and cash-on-delivery merchants. We do not sell products, we do not run advertising, and we do not own the relationship with any shopper — we operate the messaging layer between a store and the person who bought from it. You will find us at Shop # 62, Second Floor, Central Plaza Shopping Mall, behind Gul Plaza, 75800, Karachi, Pakistan, at info@whatsupport.xyz, or on +92 371 1099395.
The store decides, we carry out
Two organisations touch your information and they answer for different things. The store you ordered from is the controller: it chooses to collect your details, writes the consent wording sitting at its checkout, and is accountable for the order itself. What Support is the processor: we act on that store's instructions, for the narrow job of carrying support replies and order updates to you over WhatsApp, and for nothing else. We hold no independent licence to use your number for our own ends, and we do not take one. The single exception is when you approach us directly — through this website, our email, or our own WhatsApp line — because then the conversation is ours and we answer for it. A useful rule: ask the store about the parcel, ask us about the message.
What reaches us, and what never does
The list is deliberately short. From the store's checkout we receive:
- the name you typed at checkout;
- your WhatsApp or mobile number;
- order specifics — order ID, a summary of items, order value, COD amount, delivery city;
- a consent record: which store you opted in to, and when.
From the WhatsApp conversation itself we hold delivery and read status, whatever you send back (a confirmation, a question, or a STOP), and the timestamps around it. From this website we log ordinary technical data such as IP address and browser type. What never reaches us, in any circumstance: your CNIC or any government identifier, passwords, card numbers or payment data of any kind, your location beyond the delivery city you gave the store, and anything on your phone outside the WhatsApp thread itself. We do not build advertising profiles, and we have nothing to sell to advertisers.
The consent that makes a message lawful
A message is lawful because you asked for it, and for no other reason. At the store's checkout sits a consent box, unticked when the page loads, which you tick yourself. It names the store, states plainly that messages will arrive on WhatsApp, and explains they are transactional support and order-update messages about your purchase rather than promotions. Consent inferred from the mere act of ordering does not count. A pre-ticked box does not count. A list borrowed from a different brand does not count. Alongside that consent we rely on legitimate interest for the small set of records that prove you agreed and protect the service from abuse, and on legal obligation wherever Pakistani law requires us to keep or hand over something. Because every send is a utility message tied to a real purchase, no campaigns, cold outreach or bulk sends run through this service.
Where a message travels before it reaches you
Your message rides the official WhatsApp Business Platform (Meta Cloud API), which means your number and the message body necessarily pass through Meta Platforms, Inc. and its group companies, under WhatsApp's own privacy terms. Every template we use is filed with Meta and approved before it can be sent. That infrastructure, along with some of our hosting and database providers, runs on servers outside Pakistan, so your details may be processed in countries whose data-protection rules differ from ours; where that happens we rely on the consent you gave and on contractual commitments from those providers to protect your information to a standard consistent with this page. What Support is built on Meta's platform, not part of it. We are not affiliated with, partnered with, sponsored by or endorsed by WhatsApp, Meta or Facebook, and we claim no official relationship with them.
Everyone who can see your details
Named, in full:
- The store you ordered from — it receives your replies and any confirm-or-cancel outcome so it can dispatch, hold, or follow up on the order.
- Meta / WhatsApp — as the carrier that actually delivers the message, described above.
- Our sub-processors — cloud hosting and infrastructure, database and storage, and error-monitoring or analytics tooling. Each is bound by contract to protect your data and to use it only to run this service.
Beyond that list, nobody. We do not sell your data, we do not rent it, and we do not pass contact lists to advertisers or to any unrelated business. We will disclose information where a valid legal order compels us, or where we need to investigate fraud, abuse or a security incident — and we keep such disclosures to the minimum the situation actually demands.
How long each kind of record lives
Different records have different lifespans, and we do not keep things simply because storage is cheap.
- Message and delivery data — held while it is useful for delivering and reconciling messages and for the store's reasonable record-keeping, then deleted or anonymised.
- Consent and opt-out records — kept longer on purpose, because we may need to prove you agreed or that you told us to stop, and because honouring a STOP permanently means remembering it permanently.
- Website logs — a short, routine period, then gone.
- When a merchant leaves us — we delete or return that merchant's customer data within a reasonable window, unless a law requires us to hold it.
How we guard it
Data is encrypted in transit and at rest. Access is limited to the small number of people who need it to keep the service running, and our WhatsApp platform credentials are stored securely rather than sitting in a shared spreadsheet. We watch for unusual activity and keep a written process for responding when something looks wrong. No system is perfect and we will not pretend otherwise; what we can commit to is moving quickly, and telling the affected merchant and the relevant authorities where the law requires it.
One word stops it — and everything else you can ask for
Reply STOP to any message from us and we stop messaging that number for that store, immediately and permanently, with nothing asked in return. The option is never buried and using it never costs you anything; emailing info@whatsupport.xyz does the same job. Separately, you may ask to see what we hold about you, have it corrected, have it deleted, object to or restrict how it is processed, or withdraw your consent altogether. Because the store is the controller, some of those are fastest through them, but you are always welcome to come straight to us and we will action it or route it. We reply within a reasonable time, and we may ask you to confirm your identity first — handing your data to the wrong person would be a worse failure than a slow answer.
Who this service is not for
Nobody under 18 should be in this system at all. What we run is built for adult shoppers and for the adults operating stores; it is not aimed at children, and we do not knowingly hold a minor's data. If a child's details have reached us through some merchant's checkout, write to us and they will be deleted.
When this page changes
Services change and so do the rules around them. When this policy is revised we update the date at the top of the page, and anything meaningful appears here rather than in a quiet email. Continuing to use the service after a change means the current version is the one that applies to you.
Talking to a human about your data
What Support, Shop # 62, Second Floor, Central Plaza Shopping Mall, behind Gul Plaza, 75800, Karachi, Pakistan. Email info@whatsupport.xyz or call +92 371 1099395, Monday to Saturday, 10:00 AM to 7:00 PM PKT. Start your message with the word "Privacy" and it reaches the right desk faster.