Meta Review

MatnBot app review reference

ITBeep operates MatnBot for customer-authorized WhatsApp Cloud API support and automation. This page does not expose app secrets, access tokens, business IDs, phone-number IDs, provider message IDs, or internal workspace identifiers.

Review contact: privacy@matnbot.com. App support: hello@matnbot.com.

Required public URLs

Privacy Policy

Handling of account, workspace, bot, Meta, and WhatsApp data.

Terms of Service

Customer responsibilities, AI operation, and connected-channel terms.

Data Deletion

Public deletion request, Meta callback behavior, and request status.

App Icon

1024 × 1024 MatnBot icon for app settings.

Requested Meta permissions

  • whatsapp_business_management identifies authorized WhatsApp accounts and phones and manages templates for those assets.
  • whatsapp_business_messaging sends customer-requested messages and processes inbound messages and delivery status for connected phones.
  • public_profile is used only as part of Meta authorization in Embedded Signup; MatnBot account login uses its own email and password authentication.

Reviewer test flow

  1. Open matnbot.com/login and sign in with the reviewer credentials in the App Review submission.
  2. Open Dashboard, then Settings, Channels, and WhatsApp.
  3. Start Embedded Signup and authorize the test WhatsApp Business account and phone.
  4. Bind the phone to a bot and choose the operating mode.
  5. View available templates, send an inbound message, and verify the outbound reply and delivery state in the operator console.
  6. Test AI pause and human takeover, then disconnect the channel after review.

Safety boundaries

Provider tokens remain server-side, sensitive diagnostics are redacted, and workspace roles are verified before channel changes. AI cannot override consent, authorization, channel policy, billing, privacy, kill-switch, or human takeover controls.

Data handling

Customer access tokens are stored in an encrypted server-side credential vault. MatnBot validates webhook requests, limits diagnostic exports, and provides documented public deauthorization and data-deletion paths.