Privacy Policy

This Privacy Policy explains how 362186785046-k5j3jbtmftfiqs6sjjjmnvspr66ep4ea.apps.googleusercontent.com ("we", "us") collects, uses and protects personal data when you use wAPI (the "Service") or visit this website. We process personal data in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka.

1. Two kinds of data

• Account data: information about you and your team as users of the Service. We decide how this is used.
• Customer data: contacts, messages and files your business stores or sends through the Service. Your business decides how this is used, and we process it only on your instructions to provide the Service.

2. What we collect

• Sign-up and profile: name, email address, mobile number, business name and address, password (stored hashed) and, if you use them, Google sign-in identifiers, two-factor and passkey details.
• Billing: plan, wallet top-ups, payment amounts and references. Card details are entered on our payment partners' pages and are never stored by us.
• WhatsApp connection: your WhatsApp Business account and phone number IDs and the access token Meta issues to us.
• Customer data: contact names, phone numbers, tags and custom fields, message content and media, templates, campaign results and AI bot knowledge you upload.
• Usage and technical data: IP address, browser, sign-in times, an activity log of changes in your workspace, short-link click counts, and essential cookies used to keep you signed in.
• Website analytics: on our public website (not inside the app) we may use Google Analytics and the Meta Pixel, which set cookies to measure visits and the performance of our ads. You can block these cookies in your browser settings.
• Contact form: the name, email and message you send us.

3. How we use it

• to create and run your account and deliver your messages;
• to bill you, prevent fraud and keep the Service secure;
• to send service emails such as verification, invitations, low-balance warnings and security alerts;
• to provide support and answer your enquiries;
• to meet legal, tax and accounting obligations.

We do not sell personal data and we do not use customer data for advertising.

4. Who we share it with

We use trusted service providers who process data on our behalf:

• Meta Platforms, Inc., to send and receive WhatsApp messages through the WhatsApp Business Cloud API;
• PayHere and DirectPay, to process payments;
• Backblaze, Inc., to store message media and encrypted backups;
• AI providers (Anthropic, OpenAI or Google), only when AI bots or assistant features are switched on, to generate replies from the conversation text and your knowledge base;
• Google, if you choose to sign in with Google, and Google Analytics for website visit statistics;
• Meta, through the Meta Pixel on our public website, to measure our advertising;
• our hosting and email delivery providers.

Some of these providers are located outside Sri Lanka. We share only what is needed for each purpose. We may also disclose data where required by law or to protect our rights and users.

5. How long we keep it

We keep account and customer data while your account is active. When you close your account we delete or anonymise it within a reasonable period, except billing records that we must keep by law. Backups are kept for a limited time and then overwritten.

6. Security

Data is sent over encrypted HTTPS connections. Secrets such as access tokens are encrypted at rest, backups are encrypted, and access to production systems is restricted. No system is completely secure, so we cannot guarantee absolute security.

7. Your rights

You can ask to access, correct or delete your personal data, object to or limit processing, or withdraw consent. Many details can be changed directly in your account settings. If you are a customer of a business that uses wAPI, please contact that business first; we will help them respond. You may also complain to the Data Protection Authority of Sri Lanka.

8. Changes

We may update this policy and will post the new version here with a new "Last updated" date.

9. Contact

For privacy questions or requests, contact us using the details below.