Identity, privacy and data

​

Usernames and business-scoped user ids

• Every message keeps its contact, even when Meta leaves out the phone number. The contact is stored with their BSUID, and their username is shown as their name.
• When Meta shares a phone number later, it is added to the same contact.
• When someone changes their phone number, Meta sends a user_changed_number (or user_changed_user_id) notice with their old and new ids. LazyApp moves the new number and BSUID onto the same contact, so history, consent and tags follow them. You get contact.updated.
• Delivery statuses carry the recipient’s BSUID, which LazyApp adds to the contact.

{ "type": "text", "recipient": { "type": "bsuid", "value": "US.13491208655302741918" }, "body": "Your table is ready." }

​

Meta’s contact book

curl https://lazyapp.in/v1/contacts/{contact}/contact-book -H "Authorization: Bearer $LAZYAPP_API_KEY"
# { "uuid": "…", "bsuid": "US.1349…", "present": true }

curl -X DELETE https://lazyapp.in/v1/contacts/{contact}/contact-book -H "Authorization: Bearer $LAZYAPP_API_KEY"
# 204

​

Identity change check

curl -X PATCH https://lazyapp.in/v1/connections/{connection}/identity-check \
  -H "Authorization: Bearer $LAZYAPP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "enabled": true }'

1. WhatsApp includes each customer’s identity hash in webhooks. LazyApp keeps it on the contact (identity.key_hash on GET /v1/contacts/{contact}) and sends it back with every message.
2. If the identity changed, WhatsApp does not deliver the message (status failed, code 137000), or a new message arrives with a different hash. LazyApp marks the contact (identity.changed_at) and sends contact.identity_changed.
3. From then on LazyApp holds every message to that contact with code: identity_changed, so an automation cannot leak anything while nobody is looking.
4. Verify the person another way (a call to the number on file, your app). Then acknowledge:

curl -X POST https://lazyapp.in/v1/contacts/{contact}/identity/acknowledge -H "Authorization: Bearer $LAZYAPP_API_KEY"

​

Block people

curl -X POST https://lazyapp.in/v1/connections/{connection}/block-users \
  -H "Authorization: Bearer $LAZYAPP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "users": ["+919812345670", "IN.88812345678901234"] }'

• Phone numbers and BSUIDs both work. Parent BSUIDs are refused by Meta.
• WhatsApp only lets you block someone who messaged you in the last 24 hours.
• Up to 1,000 people per request; the list holds up to 64,000.
• Meta answers per person. The response lists failures with a plain message, for example “WhatsApp only lets you block someone who messaged you in the last 24 hours.”
• DELETE the same path to unblock. GET it to page through the block list (next_cursor).

​

Opt-in

• Record opt-ins you collected elsewhere with POST /v1/contacts/{contact}/consent.
• Contacts who reply with stop words are opted out automatically, and marketing to them is refused (code: marketing_opt_out).
• Ask for opt-in per kind of message (order updates, offers) so people are not surprised, and watch your number’s quality rating when you try a new opt-in method.

​

Where WhatsApp stores your messages

curl https://lazyapp.in/v1/connections/{connection}/storage -H "Authorization: Bearer $LAZYAPP_API_KEY"
# { "mode": "default", "region": null, "retention_minutes": null, "status": null, "regions": {…} }

curl -X PUT https://lazyapp.in/v1/connections/{connection}/storage \
  -H "Authorization: Bearer $LAZYAPP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "mode": "local", "region": "IN", "confirm": true }'

• Download media customers send within the hour; after that it is gone.
• If your webhook endpoint is down for more than an hour, those messages are lost.
• Media you upload is kept for 24 hours instead of one, so a campaign can reuse an image.

​

Security on the platform

• Messages between WhatsApp and Meta are end-to-end encrypted; Cloud API holds the keys for your number. API calls and webhooks use TLS.
• LazyApp keeps access tokens and two-step PINs encrypted, and never writes a one-time passcode into webhooks or logs.
• WhatsApp Flows payloads are encrypted with your number’s flow key; LazyApp manages that key for you.
• See Security for how LazyApp protects your workspace.