Privacy Policy

1. Who we are

WAiMATE (“WAiMATE”, “we”, “us” or “our”) provides a platform that lets businesses send and receive WhatsApp messages, manage their contacts and team inboxes, automate conversations, and sell through WhatsApp catalogues.

This policy applies to our website, our web application, our mobile applications and the messaging services we provide (together, the “Service”).

2. Our role

Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles it on a controller’s behalf. We act in both capacities:

• We are the controller of the personal data of our customers and their team members — account, billing, support and security information — and of the data described in this policy that we use for our own purposes.
• We are a processor of the messages, contacts, orders and other content our customers handle through the Service. The business that contacted you is the controller of that data and is responsible for having a lawful basis to message you and for its own privacy notice. If you ask us about data a business holds about you, we will pass your request to that business promptly.

3. Information we collect

Information you give us

• Account information: your name, username, email address, password (stored only as a secure hash), company name, country, time zone, language and preferred currency.
• Team information: the names, email addresses and roles of team members you invite.
• Billing information: your plan, invoices, payment references and transaction amounts. Card details are entered directly with our payment processor and never reach our servers.
• Business verification: documents you upload to verify your business.
• Support correspondence: messages you send us and our replies.

Information processed when you use the Service

• WhatsApp Business information: connected phone numbers, WhatsApp Business Account identifiers and access tokens.
• Messages and contacts: message content (text, images, audio, video, documents, locations and contact cards), phone numbers, WhatsApp profile names, delivery and read status, and timestamps.
• Commerce information: catalogues, orders, customer names, phone numbers and delivery addresses.

Information collected automatically

• Technical and security information: IP address, browser and device type, your device’s time zone, sign-in records and audit logs of actions taken in your account.
• Mobile and browser notifications: a device token, if you turn on push notifications.

Information from others

• Meta: messages, delivery statuses and account information sent to us through the WhatsApp Business Platform.
• Our customers: contact lists and details they upload or import.
• Our payment processor: confirmation of payment outcomes.

We do not use automated decision-making that produces legal or similarly significant effects on you.

4. How we use it, and our legal bases

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights. You may object at any time (see section 10).

5. Stopping messages from a business

If a business has messaged you through WAiMATE, reply STOP to that conversation. Equivalent words such as unsubscribe and cancel, and their equivalents in several other languages, work too. Your reply takes effect immediately: our systems block further messages from that business to your number and send you a single confirmation. Reply START if you change your mind.

An opt-out applies to the business you replied to. Other, unrelated businesses that use our platform are separate organisations and are not told about your choice.

6. Who we share it with

We share personal data only as described below, and never sell it.

• Meta Platforms, which operates the WhatsApp Business Platform through which messages are delivered. Meta’s own terms and privacy policy govern its processing.
• SafePay, which processes subscription payments.
• Google (Firebase Cloud Messaging), which delivers push notifications using a device token. Message content is not sent through it.
• Our cloud hosting provider, which hosts the Service and stores its data on our behalf.
• Email delivery providers, which send our service and notification emails.
• Professional advisers, authorities and successors where required by law, to establish or defend legal claims, or as part of a merger, acquisition or sale of assets, subject to equivalent protections.

Each service provider acts under a written agreement that restricts its use of personal data to providing its service to us. Within a customer’s account, data is visible to that customer’s authorised team members according to the permissions the customer sets.

7. International transfers

We host the Service in a single region. Depending on where you are, this may mean your personal data is processed outside your country. WhatsApp messages are also carried by Meta’s global infrastructure.

Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum. You may request a copy of the relevant safeguards by contacting us.

8. How long we keep it

We keep personal data only for as long as we need it for the purposes above, after which it is deleted or anonymised:

Deleted data may persist in backups for a limited period, until those backups are overwritten on their normal cycle.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest for access tokens and payment credentials, strict separation between customer accounts, role-based access controls, account lockout after repeated failed sign-ins, support for multi-factor authentication, and logging of staff access to customer accounts. No system is completely secure; if a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data, subject to records we are legally required to keep;
• receive your data in a structured, machine-readable format and transfer it elsewhere;
• object to or restrict our processing, including processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent; and
• complain to the data protection authority where you live or work.

How to exercise them

Account holders can download their data and delete their account instantly from the Privacy Centre, on the web or under Account › Privacy & your data in our mobile app. We respond within one month. If a request is complex we may extend this by up to two further months, and will tell you why within the first month. We may need to verify your identity before acting on a request.

If your request concerns messages a business sent you, that business is the controller; we will forward your request to it.

11. Additional information for California residents

In the preceding 12 months we have collected the categories of personal information described in section 3: identifiers, commercial information, internet and electronic network activity, geolocation information you choose to share in a message, and professional information. We use and disclose them for the business purposes described in sections 4 and 6.

We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Service.

You have the right to know, delete and correct personal information, and not to be discriminated against for exercising those rights. You may exercise them as described in section 10, or through an authorised agent who provides proof of authorisation.

12. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Cookies

We use only the cookies and similar technologies needed to run the Service and remember your preferences. We do not use advertising or analytics cookies. See our Cookie Policy.

14. Changes to this policy

We may update this policy from time to time. The version and effective date appear at the top of this page. If we make material changes, we will notify account holders by email or in the Service before they take effect.

15. Contact us