This guide explains where the data you manage in MuseRelay is stored, what is encrypted and what happens to the messages of each channel. We only describe what the platform does today.
Where your data is stored
Conversations from all your channels (WhatsApp, Instagram, Messenger, website chatbot and email), your contacts, appointments and tickets are stored on our servers in the European Union: the main one, hosted by Contabo GmbH in Germany, and a replica in Spain.
Photos, audio, videos and documents arriving through WhatsApp, Instagram and Messenger, and ticket attachments, are downloaded to those same servers. They don’t depend on Meta’s link staying available.
What is encrypted
- Attachments: photos, audio, videos and documents are stored encrypted with AES-256, using MuseRelay’s own keys, separate from the application’s. Anyone copying the disk would only see unreadable files. In the dashboard they open as usual.
- Credentials: your channel tokens, mailbox passwords and integration keys are stored encrypted and never shown in the dashboard.
- Connections: everything travels encrypted (HTTPS/TLS), between your browser and the platform and between the platform and the services it uses.
Backups
The database is backed up every day; each copy is kept for 60 days and then deleted automatically. There is also a replica of the database and files at the premises of Screen Art S.L.U., our EU representative, in Mallorca (Spain). Everything travels over encrypted channels and stays within the European Union; attachments and credentials remain encrypted in the copies too.
Email: your mailbox remains the source
For the Email channel we store only the text of the messages and the thread details. Attachments are not copied to our servers: they are downloaded from your mailbox when someone opens them.
How long files are kept
Channel files are kept for the period you configure (90 days by default) and are then deleted automatically.
Who else is involved
- Meta (Ireland) delivers and receives WhatsApp, Instagram and Messenger messages: that is how those channels work.
- The AI models that write the replies run in European data centres.
- The full list, with country and purpose, is on Subprocessors.
Your customers’ rights
Your customers receive the privacy notice inside the conversation and can request a copy of their data or its deletion from the same chat, as the GDPR provides.
GDPR
The GDPR requires security measures appropriate to the risk (Article 32). Keeping data in the EU, encrypting files and credentials and limiting how long they are kept are part of those measures, and give you and your customers peace of mind. The full terms are in the data processing agreement.