Passinv privacy policy

Last updated: 2026-11-10

Passinv is a WhatsApp bot, with a web dashboard, that lets small businesses store copies of their customers' identity documents (such as passports and ID cards) and retrieve them later. Passinv is operated by Anas Bashir. It is currently in a test phase, used by a small number of businesses admitted from a waiting list.

What we process

• Messages that business users send to the Passinv WhatsApp number, and files they upload in the web dashboard: document images and files, and the names, phone numbers and tags they add.
• Account data of each business user: their name if given, their WhatsApp phone number or numbers (so that only approved users can use the service), the business they belong to and their role in it (owner or team member), the business name, and the plan the business is on.
• The waiting list: what someone joining enters on the sign-up form (their name, the business name, type and city, and optionally an email address and a note), the WhatsApp number they verify by sending a code to Passinv, and when they last messaged Passinv (so Passinv knows whether it may message them when their account is ready). Passinv staff may add a note and record the decision.
• Team invites: who invited whom to which business, and when the invite was used. Invite links are stored only in a scrambled (hashed) form.
• Signing in to the web dashboard: one-time sign-in codes and links, and for each signed-in browser a session record (the kind of browser and device, such as "Chrome on Windows", and when it was created and last used). Codes, links and session keys are stored only in a scrambled (hashed) form.
• Cookies, all strictly necessary: passinv_session keeps you signed in; passinv_login, passinv_reg and passinv_inv link a sign-in code, a waiting-list sign-up or a team invite to the browser that asked for it. No tracking or advertising cookies.
• How often each feature is used per business per day (for example "3 searches"), without any content, and how many bot messages each business used this month (plans can limit it).
• A record of what Passinv staff change in accounts (for example a business's plan), without any customer data.
• Technical identifiers, such as WhatsApp message IDs, used to avoid processing a message twice.
• Delivery reports for the messages Passinv sends (whether each was delivered, and WhatsApp's pricing category), without their content, to measure each business's usage.

We do not log message text, names, phone numbers or documents.

Security

Data is encrypted in transit. Stored documents are encrypted with a key unique to each business. Signing in to the web dashboard needs approval from the user's own WhatsApp.

Why

Only to store this information for the business that sent it, to return it to that business when it asks, to run the waiting list and accounts, and to measure each business's usage. We do not sell it, use it for advertising, or share it with anyone else, except the service providers below.

Who can see it

Each business can only access the information it uploaded, through WhatsApp or the web dashboard; everyone on a business's team sees the same saves. Passinv staff see account data (people's names and numbers, businesses, plans, the waiting list) and counts (such as the number of documents and messages) to run the service, but never the customers' names, phone numbers or documents. The operator does not look at stored documents, except where necessary to keep the service secure or when required by law.

Service providers

• Meta (WhatsApp Business Platform) carries the messages between the business and Passinv.
• Cloudflare runs Passinv and stores its data. Its servers may be outside Qatar.

How long we keep it

Information is kept until the business deletes it. Deleted items are removed permanently after 7 days. Web sessions end 30 days after they were last used, or when the user signs out; sign-in codes and links work once, for a few minutes, and are removed a day later; team invite links work once, for 7 days. Waiting-list sign-ups are kept until the person asks for them to be deleted. A business can ask for all of its data to be deleted at any time.

If your document was stored by a business

Contact the business that holds it. You can also contact us to ask about, correct or delete information about you.

Contact

Privacy questions and requests: nasbas23@gmail.com.

Changes

We will update this page when anything above changes, and change the date at the top.