I found that my internet service provider uses a transparent proxy on some sites and apps like Google, Whatsapp, etc. I know they use it to save bandwidth but my question here is if they are able to spy easily or not?
If HTTP is used, yes they can spy on you. If HTTPS is used, no they will not be able to spy on you. The transparent proxy is normally run on port 80 (HTTP) only, since it does not work with HTTPS.
The transparent proxy only caches content which is common to most users. e.g.
favicon.ico. Since every user is going to load the same site logo, it is a waste of bandwidth to download it from Google/Whatsapp repeatedly. Websites usually use headers to indicate that the content is "cache-able".
Cache-Control: max-age=3600 indicates that the content is valid for 1 hour, hence your ISP only needs to retrieve the latest copy once every hour.
However, your personal mailbox or conversation list will never be cached. This is because it is unique to you, so there is no benefit from caching it. Hence, websites normally do not add cache headers to the response. If the website uses POST to retrieve this data, according to HTTP 1.1 RFC 2616 S. 13.10, the cache should be invalidated. If the website uses GET request, the URL is likely to be unique, e.g.
http://example.com/getmessage.php?uid=123456, since every user has a different UID, it is pointless to cache such responses.