Privacy Policy

1. Information we collect

Account information

Your email address and a securely hashed version of your password (we use Argon2 — your actual password is never stored). We never send your password anywhere, and we can't recover it if you forget it.

WhatsApp connection data

When you connect a WhatsApp account, we store the linked-device session credentials needed to keep that connection open, plus the connected phone number and display name. This data stays on our server — it is never sent to your browser or any third party.

Contacts and campaign content

Contact lists you upload (names, phone numbers) and the messages you configure for a campaign are stored so the Service can send and track them, and so you can review delivery status afterward.

Usage and log data

Standard operational data — request timestamps, IP address (used for rate limiting and abuse prevention), and error logs. Logs never include your password, session tokens, WhatsApp credentials, or message content.

2. How we use your information

• To operate the Service — sending messages through the WhatsApp account you connect.
• To enforce the sending controls (delays, hourly limits, pauses) that protect your account.
• To maintain security: authenticating you, detecting abuse, and preventing excessive requests.
• To communicate with you about your account when necessary (e.g., a security notice).

We do not use your data for advertising, and we do not sell it.

3. How your data is stored

Account, campaign, and contact data live in a PostgreSQL database; queued messages and live status updates pass through Redis. Every query is scoped to your own account — there is no code path that lets one account read or modify another's data. See our Terms of Service for what happens to messages once they leave the Service through WhatsApp.

4. Sharing your information

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. The one necessary exception: messages you send are transmitted through WhatsApp's own infrastructure (via an unofficial connection — see our Terms of Service), which is operated by WhatsApp/Meta and governed by their own privacy practices, entirely outside our control.

5. Data retention and deletion

We retain your data for as long as your account is active. You may request deletion of your account and all associated data (campaigns, contacts, WhatsApp session) at any time by contacting us — see Section 9 below.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you. Contact us to exercise any of these rights and we'll respond as promptly as we can.

7. Cookies

We use exactly one cookie: an httpOnly session cookie that keeps you signed in. It can't be read by JavaScript and isn't used for tracking or advertising. We do not use third-party analytics or advertising cookies.

8. Children's privacy

The Service is not directed at, and should not be used by, anyone under 18. We do not knowingly collect information from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact us

Questions about this policy or your data? Reach us at support@whatsapp-automation.app.