Claimed to remove metadata from servers unless legally obliged to collect it: www.quora.com/Does-WhatsApp-store-messages-on-its-servers-or-is-all-deleted-after-delivery-and-only-stored-on-recipients-phones/answer/Ciro-Santilli
They've had a few breaches: www.whatsapp.com/security/advisories/
They claim to delete metadata: www.quora.com/Does-WhatsApp-store-messages-on-its-servers-or-is-all-deleted-after-delivery-and-only-stored-on-recipients-phones/answer/Ciro-Santilli