Privacy Policy

This service is operated by Whapify.

Last updated: September 6, 2026

What we collect

• Account name, email, and the contact details you give us.
• The WhatsApp numbers you connect, with the display name and profile picture those numbers publish.
• Password, stored as a hash, never as plain text.
• Message content and metadata in both directions: what you send, what arrives, who it was with, and when.
• Media that passes through the service: images, documents, audio, and video, with the file name and type.
• Contacts and group members you import, or that arrive with a message.
• Payment and billing records, including the orders you place and their status.
• Operational records: sign-in times and IP addresses, API key usage, and webhook delivery attempts with the response each address returned.

Why we collect it

To run your account, to send and receive messages on your behalf, to show you what happened to each one, to take payment, to keep the service safe from abuse, and to meet the legal obligations that apply to us.

AI replies, and the message text that leaves us

AI-assisted replies are off until you turn them on. When you turn them on you choose the AI provider, you supply your own key for it, and you write the instructions the model follows. From that point, the text of an incoming message and a short window of the recent messages in that conversation are sent to that provider so it can compose an answer. Files are not sent; the model receives text.

What the provider does with what it receives is governed by that provider's terms, not by this page, so read them before you turn the feature on. Turning it off stops anything further being sent. Your provider key is stored encrypted and is never shown again after you save it.

Where media is held

Files that pass through the service are held either on servers we operate or with an object storage provider we contract with, depending on how the deployment is configured. Either way, a file is stored under a key that identifies only the account and the file itself, it is served over a signed link that expires, and it is deleted with the message it belongs to.

Webhooks you configure

If you add a webhook, we post event data to the address you choose, and on a message event that includes the beginning of the message body, up to two hundred characters. We sign every delivery so your receiver can check it came from us, and we keep a log of each attempt and the status your address returned. What happens to the data after it arrives is decided by whatever you pointed us at, which is outside our control.

API keys

A key acts as your account. We store it as a hash and show the secret once, at creation; after that we hold only its prefix, when it was made, and when it was last used, so you can tell a live key from a forgotten one. Anyone holding a key can send with it, so treat it the way you treat your password and revoke one you no longer recognise.

Where it is stored and for how long

Data is stored on servers we operate, with media as described above, for as long as your account is active.

Messages do not stay forever. A message older than the retention period, ninety days by default, is deleted automatically, along with the media that belongs to it alone. That deletion is permanent and there is no undo, so export anything you need to keep before it ages out.

If you delete your account, account and message data is deleted following the process under Your rights below, except records we have to keep longer under payment or tax rules.

Who it is shared with

We share data only as far as a specific function requires, and we do not sell it. The parties that receive anything are:

• A payment gateway, which receives your name, email, and the amount and reference of an order, so a payment can be taken and recorded.
• An email delivery provider, which receives your address and the message we are sending you, for verification codes and account notices.
• An object storage provider, which holds media files, where the deployment is configured that way.
• The AI provider you configure, which receives message text as described above, and only while that feature is on.
• Any address you configure as a webhook, which receives the event data described above.
• Authorities, where the law requires it of us.

Who on our side can see it

Our staff work through an operator console that shows accounts, subscriptions, orders, and usage counts. It has no screen that opens a conversation. Every change made there is written to a record that cannot be edited or erased, holding who made it, what changed, and when, so an action taken on your account can always be traced to a person.

Security

• Every account is separated at the data level.
• Credentials are stored as hashes, never as plain text.
• Secrets you give us, such as an AI provider key or a webhook signing secret, are stored encrypted.
• All traffic runs over HTTPS.
• Webhook deliveries are signed, so your receiver can tell ours from someone else's.

Your rights

You can see the data we hold about you, ask for a correction if something is wrong, ask for a copy of it, and delete your account and its data.

To exercise any of these, contact [email protected] from your account email.