Privacy Policy
Last updated: October 20, 2026
This policy explains what whasp (“we”) collects, why, and how long we keep it. It covers our customers, the companies that use whasp, and the end users who chat with our customers’ numbers.
Our role
- Customer account data (email, keys, billing): we are the controller.
- End user messages and data: the customer is the controller. We act as its processor and handle this data only to deliver messages for it.
Each customer is responsible for having a lawful basis to process its end users’ data, and for telling its users they are talking to an AI. If you are an end user, contact the service you chat with. If you write to us, we will point you to them.
Messages: passed through, not stored
whasp sends and receives messages. The customer’s system keeps the history, not ours.
- Outgoing messages. Text and attachments are kept only while queued or being sent, then deleted. We fetch attachments from the customer’s link when the message is sent.
- Incoming messages. The content goes to the customer’s webhook and is not stored. We keep only a one-way hash of the text, to match replies and reactions to the right message.
- Incoming files are stored for 24 hours so the customer can download them, then deleted.
- Webhook events keep their content only until delivered, or until we give up after retries.
- Message records keep metadata only: ids, phone numbers, timestamps and status. Never content.
There is no way to read a conversation back from whasp.
On the cloud phone. The WhatsApp app on each phone keeps its own chat history on that phone, as it does on any phone. Our app on the phone reads new messages only to pass them on. We do not copy that history to our servers. The phone and its data are wiped when the number ends, before the phone serves another number.
Messages travel over WhatsApp, which Meta runs under its own terms and privacy policy.
What we keep about end users
For each chat on a customer’s number: the end user’s phone number, their WhatsApp display name, when they first and last wrote, and whether they opted out. We use this to route replies, apply limits and honor STOP. We also keep the message records above.
What we keep about customers
- Account email, to sign you in and send billing and service notices.
- Session cookies and sign-in links, stored only as a hash.
- API keys, stored only as a hash plus the last 4 characters, so you can tell them apart.
- Webhook URL and signing secret, to deliver and sign your events.
- Billing records and the ledger: your top-ups and every balance change. Card and wallet details go to the payment processor. We do not see them.
- Number metadata: label, profile name, about text and photo, status, health, usage counts and paid period.
- Operational logs: technical events such as errors, sends and deliveries. They can include account ids, phone numbers and IP addresses. We use them to run, debug and secure the service.
At sign-in we use your IP address and a bot check to block abuse.
Cookies
We set one cookie: the session cookie that keeps you signed in to the dashboard. No analytics or advertising cookies.
Why we use it
- To provide the service you signed up for (our contract with you).
- To secure the service and prevent abuse (our legitimate interests).
- To keep billing records (our legal obligations).
Who we share it with
We use service providers in these categories:
- Cloud infrastructure and email delivery: hosting, databases, file storage, bot checks and sign-in emails.
- Payment processor: handles top-ups.
- Phone and connectivity providers: the cloud phones, phone numbers and IP connections each number runs on. Messages pass through these phones.
They process data only to provide their services to us. We do not sell personal data. We disclose data to authorities only when the law requires it.
Our providers may process data in the United States and in other countries, which may be outside your own.
How long we keep it
- Outgoing message content: until sent or failed.
- Incoming files: 24 hours.
- Webhook event content: until delivered or failed. The delivery record (type, status, attempts) is kept 7 days.
- Sign-in links: 30 minutes. Sessions: 30 days.
- Account, number, chat and message metadata: while the account is open, or until the customer asks us to delete it.
- Billing records: as long as the law requires.
- Operational logs: a limited time.
Security
Session cookies, sign-in links, API keys and phone secrets are stored only as hashes. All traffic uses HTTPS. Webhook events are signed so customers can check they come from us.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to how we use it. Customers: write to support@whasp.ai. End users: contact the service you chat with first, since it controls your data. You may also complain to your local data protection authority.
Children
whasp is a business service. It is not meant for children.
Changes
We may update this policy. For material changes, we email customers before they take effect.