Privacy Policy

This Privacy Policy (this "Policy") sets forth the practices of the operator of WhatSync (together with its affiliates, successors, and permitted assigns, "WhatSync," "we," "us," or "our") with respect to the collection, receipt, use, disclosure, transmission, storage, retention, analysis, and other processing of personal data, personal information, or equivalent legally protected information (collectively, "Personal Data") in connection with our websites, web and desktop application interfaces, application programming interfaces, Model Context Protocol and other machine-to-machine endpoints, connected and integrated services, customer support interactions, operational security functions, billing flows, and related business activities that reference or incorporate this Policy (collectively, the "Service"). This Policy is intended to operate as a global baseline notice and, solely to the extent required by applicable law, as a supplemental regional notice for individuals located in, or whose Personal Data is otherwise regulated by, jurisdictions including the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, the United States, India, Brazil, Mexico, Argentina, Colombia, and other jurisdictions with materially analogous data protection or consumer privacy requirements.

By accessing, registering for, connecting an account to, or otherwise using the Service, or by authorizing any third-party application, agent, or client to access the Service on your behalf, you acknowledge that you have read and understood this Policy and that your Personal Data, and Personal Data you make available to the Service, will be processed as described herein. If you do not agree with any portion of this Policy, your sole and exclusive remedy is to discontinue use of the Service. This Policy is to be read together with, and is subject to, our Terms and Conditions (the "Terms").

1. Definitions and Rules of Interpretation

1.1. Capitalized terms used but not defined in this Policy have the meanings given to them in the Terms. "Customer" means the individual or entity that registers for, subscribes to, or otherwise procures the Service, and "User" means any individual who accesses the Service under a Customer account. "Customer Data" means Personal Data and other content that a Customer or User submits to, connects to, synchronizes through, or causes to be processed by the Service, including messaging content, media, contact information, group information, and records exchanged with Third-Party Services. "Third-Party Services" means any platform, application, model, agent, client, software, or service not owned or operated by us, including messaging platforms, customer relationship management systems, artificial intelligence applications and assistants, automation tools, payment processors, and infrastructure providers.

1.2. In this Policy, the words "include," "including," and "such as" are deemed to be followed by "without limitation"; the word "may" denotes a permitted practice and does not constitute a representation that a practice is undertaken in every instance; headings are for convenience only and do not affect interpretation; and references to applicable law include laws, regulations, binding regulatory guidance, and court orders as amended or replaced from time to time. Descriptions of the Service's features are illustrative, reflect the Service as of the Last Updated date, and do not constitute a warranty that any feature will be offered, maintained, or available.

2. Scope, Applicability, and Order of Precedence

2.1. This Policy applies to Personal Data that we process in connection with the Service. It does not apply to information that has been anonymized, aggregated, or de-identified such that it no longer reasonably identifies an individual in accordance with applicable law, nor to Personal Data processed by Third-Party Services under their own terms, policies, and notices, including where such processing is initiated, authorized, or directed by a Customer or User.

2.2. Where a User accesses the Service through an organization, workspace, employer, agency, or principal account holder, that party may independently control the User's use of the Service and may maintain separate notices, policies, contractual instructions, or acceptable-use requirements, for which we bear no responsibility. In the event of a conflict between this Policy and a separately executed written data processing addendum or other negotiated agreement between us and a Customer, such agreement shall control solely to the extent of the conflict and solely with respect to Customer Data, except where applicable law mandates a different result.

3. Allocation of Roles and Customer Responsibilities

3.1. Our role in relation to Personal Data varies with the context of processing. With respect to Customer Data, the Customer determines which accounts, devices, numbers, contacts, conversations, groups, media, attributes, records, and Third-Party Services are connected and how Customer Data is used, and we act on the Customer's documented instructions as reflected in the Customer's configuration of, and use of, the Service. With respect to account administration, billing, fraud and abuse prevention, security, product analytics, service improvement, legal compliance, and dispute management, we may independently determine the purposes and means of processing. Where applicable law distinguishes among concepts such as "controller," "processor," "business," "service provider," "data fiduciary," "data processor," "operator," "responsável," "operador," "responsable," and "encargado," those characterizations shall be determined by the facts of the relevant processing activity.

3.2. Customer Data frequently contains Personal Data of individuals who are not Users, including correspondents, contacts, group participants, and other third parties ("Data Subjects"). The Customer is solely responsible for, and represents and warrants that it has, (a) a lawful basis for collecting and processing such Personal Data and for causing it to be processed through the Service and any Third-Party Service it elects to connect; (b) provided all notices and obtained all consents, authorizations, and opt-ins required by applicable law and by the terms of any messaging platform, including in respect of commercial, marketing, and automated communications; (c) the authority to connect each account, device, and phone number it connects; and (d) configured the Service, including any filtering, exclusion, retention, or synchronization settings, in a manner appropriate to its obligations. We have no direct relationship with Data Subjects and are not responsible for the Customer's compliance with its own legal obligations.

4. Categories of Personal Data Processed

Depending on the manner in which the Service is configured and used, and without any obligation to process any particular category, we may process the following categories of Personal Data:

• Account, identity, and contact data, including names, email addresses, phone numbers, session identifiers, team membership data, invitation metadata, authentication tokens, and account administration records.
• Integration and credential data, including connection credentials, linked-device session material, access and refresh tokens, scoped permissions, OAuth grants issued to or by Third-Party Services, device linkage state, and other technical information necessary to establish, maintain, secure, or terminate connections between the Service and Third-Party Services. The linked-device method of connection does not require the User to disclose a messaging account password or SMS verification code to us.
• Communications content and metadata, including message text, media, documents, voice notes, images, and other attachments, timestamps, directionality, delivery and read status, reactions, associated contact names (including names that a linked device shares from the device's address book and names individuals display on the messaging platform, subject to the Customer's filtering settings), phone identifiers, group membership and metadata, conversation linkage data, templates, campaigns, recipient lists, filtering preferences, and outputs written to, or read from, Third-Party Services.
• Transactional and commercial data, including plan status, subscription, invoicing and billing metadata, payment processor references, messaging platform billing and usage data, service configuration choices, and customer support or contractual records. We do not store full payment card numbers, which are processed by our payment processors under their own terms.
• Device, network, and usage data, including IP address, approximate geolocation inferred from network metadata, browser, device, and operating system information, diagnostic logs, error traces, webhook payload metadata, API and tool invocation records, routing data, security events, session recordings, and product interaction telemetry.
• Support, feedback, and operational communications, including inquiries, support tickets, product feedback, complaint records, follow-up correspondence, communication preferences, and records of onboarding, support, billing, trial, security, or outage-related notices sent through any channel, including WhatsApp where enabled by the User.
• Sensitive or special-category data, solely to the extent such data is embedded in Customer Data, imported records, or support materials that a Customer or User elects to process through the Service. We do not require such data for the ordinary operation of the Service. Customers are prohibited from using the Service for regulated or high-risk processing unless they have independently determined, at their sole risk, that the Service is appropriate and lawful for that purpose.

5. Sources of Personal Data

5.1. We may obtain Personal Data directly from you; from the Customer that provides your access to the Service; from Third-Party Services that a Customer or User connects or authorizes, including messaging platforms, Meta Platforms, Inc. and its affiliates ("Meta"), customer relationship management systems, artificial intelligence applications and agents, and automation tools; from payment processors, support channels, analytics tools, infrastructure providers, and security or anti-abuse systems; and from publicly available sources. We may also derive Personal Data from operational events, configurations, synchronization outcomes, service logs, and integrity checks used to determine connection health, billing status, and access rights.

5.2. For linked-device connections, we process the pairing, connection status, session continuity, history synchronization, and re-authentication events required to maintain the linked device. The underlying messaging platform is controlled by its operator, which may at its discretion restrict, suspend, unlink, or require re-linking of any device or account, and may limit the history or content made available to a linked device. We do not control, and are not responsible for, any such action.

6. Purposes of Processing and Legal Bases

6.1. Subject to applicable law, we may process Personal Data for the following purposes:

• To provision, authenticate, operate, maintain, troubleshoot, support, and improve the Service.
• To receive, send, store, index, search, synchronize, format, transmit, reconcile, and present communications, media, and related records across the Service and connected Third-Party Services, including in response to requests made by Users or by applications, agents, or clients authorized by Users.
• To administer accounts, team access, settings, support requests, invoices, subscriptions, and business relationships.
• To send service communications concerning setup, support, billing, account administration, product changes, outages, and security, and, only to Users who have actively opted in, marketing communications.
• To secure the Service and to detect, investigate, prevent, and respond to misuse, fraud, spam, abuse, unauthorized access, unlawful conduct, violations of the Terms or of Third-Party Service policies, and operational failures.
• To analyze product usage, service quality, performance, and reliability, including through session replay, diagnostics, logging, and analytics technologies.
• To comply with legal obligations, respond to lawful requests, establish, exercise, or defend legal claims, enforce the Terms and other agreements, and preserve evidence.
• In connection with any merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar transaction or proceeding, or the evaluation thereof.

6.2. Where the GDPR, UK GDPR, Swiss data protection law, the LGPD, India's Digital Personal Data Protection Act, 2023, or similar laws apply, the legal bases for such processing may include performance of a contract or steps taken at your request prior to entering into a contract; compliance with legal obligations; our legitimate interests and the legitimate interests of Customers, Users, and counterparties in secure, auditable, and reliable business communications; legitimate uses recognized by applicable law; and, where required, consent. Where we rely on consent, it may be withdrawn in the manner provided by applicable law, without affecting the lawfulness of processing before withdrawal or processing carried out on another lawful basis.

6.3. We send marketing communications only to Users who have actively opted in through a separate, optional choice that is not selected by default. Creating an account, signing in, accepting the Terms, connecting WhatsApp or a Third-Party Service, or using the Service is not consent to marketing. A User who has opted in may withdraw that consent at any time using the mechanism provided in the communication or by contacting us. We may continue to send communications reasonably necessary to provide the Service, respond to requests, protect an account, or comply with law.

7. Third-Party Services, Messaging Platforms, and AI Applications

7.1. The Service interoperates with Third-Party Services that are selected, connected, and authorized by Customers and Users. Each Third-Party Service processes Personal Data under its own terms, privacy policies, and data handling practices, which we do not control and for which we accept no responsibility or liability. Once Personal Data is transmitted to, retrieved by, or made available to a Third-Party Service at the direction or with the authorization of a Customer or User, its subsequent processing is governed solely by the relationship between the Customer or User and that Third-Party Service.

7.2. Where a User connects an artificial intelligence application, assistant, agent, or client to the Service, including through the Model Context Protocol, an API key, or an OAuth grant, that application may read, search, retrieve, summarize, and act upon Customer Data, including message content and media, and may initiate outbound communications, to the extent of the permissions granted. The User is solely responsible for the selection, configuration, instructions, prompts, and permissions of any such application, for reviewing its outputs and actions, and for any communication sent or action taken through it. Artificial intelligence outputs may be inaccurate, incomplete, or inappropriate, and we make no representation regarding the conduct of any such application or the provider that operates it.

7.3. WhatsApp is a trademark of Meta. WhatSync is an independent service and is not affiliated with, endorsed by, sponsored by, or approved by Meta, WhatsApp, OpenAI, Anthropic, or any other Third-Party Service provider, except to the extent of any official platform program expressly identified within the Service. Meta and other messaging platform operators independently process Personal Data in connection with their platforms and establish the rules, limits, pricing, and enforcement policies applicable to accounts and messages, for which we bear no responsibility.

8. Limitations on Our Use of Message Content

Except as described in this Policy, as directed or authorized by a Customer or User, or as required by applicable law, we do not sell the content of messages processed through the Service, use such content to serve advertising, or use such content to train general-purpose artificial intelligence models. This Section does not restrict (a) processing necessary to provide, secure, support, troubleshoot, or maintain the Service; (b) processing of aggregated, anonymized, or de-identified information; (c) access by our personnel or service providers where reasonably necessary for the foregoing purposes or with the Customer's authorization; or (d) processing by Third-Party Services under Section 7.

9. Disclosures of Personal Data

9.1. We may disclose Personal Data to the following categories of recipients, subject to applicable law and such contractual or statutory safeguards as we consider appropriate:

• Hosting, cloud computing, object and media storage, database, queueing, observability, analytics, security, customer support, email, and other infrastructure providers that assist us in operating the Service.
• Third-Party Services designated, connected, or authorized by a Customer or User, or necessary to provide the Service, including messaging platforms, Meta, customer relationship management systems, artificial intelligence applications, and payment processors.
• Our affiliates, professional advisers, auditors, insurers, financing sources, and legal counsel.
• Actual or prospective acquirers, investors, successors, or counterparties in connection with any transaction or proceeding described in Section 6.1, in which case Personal Data may be transferred as a business asset.
• Governmental authorities, regulators, courts, law enforcement, and other parties where we believe in good faith that disclosure is required by law or legal process, or is reasonably necessary to protect the rights, property, or safety of WhatSync, our Customers, Users, or others, or to detect, prevent, or address fraud, security, or technical issues.
• Other parties at your direction or with your authorization.

9.2. We do not represent that any disclosure will be characterized identically under every statute. To the extent a particular law treats a disclosure differently from our ordinary characterization, we will address that disclosure as required by the law governing the relevant processing activity.

10. Cookies, Local Storage, and Similar Technologies

We and our service providers may use cookies, pixels, local storage, session replay, and similar technologies to maintain sessions, preserve acknowledgements and preferences, measure and analyze usage, support attribution, diagnose issues, and secure the Service. You may manage certain browser-side technologies through your browser or device settings; disabling them may impair the availability or functionality of the Service. Except where required by applicable law, we do not respond to "Do Not Track" or similar browser signals.

11. International Data Transfers

Personal Data may be transferred to, stored in, and processed in countries other than the country in which it was collected, including countries whose data protection laws may differ from those of your jurisdiction. Where required by applicable law, we rely on transfer mechanisms intended to provide appropriate protection, which may include adequacy decisions, standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or the UK Addendum, and other lawfully recognized mechanisms, assessments, or supplementary measures, which may be adapted from time to time to reflect regulatory developments, vendor changes, or new guidance.

12. Retention and Deletion

12.1. We retain Personal Data for as long as reasonably necessary to maintain an active account and provide the features the Customer has enabled, and thereafter for such period as we determine is reasonably necessary to comply with legal, tax, accounting, and regulatory obligations, resolve disputes, prevent fraud and abuse, enforce our agreements, and establish, exercise, or defend legal claims. Retention periods vary by data category, context, and legal requirement.

12.2. Upon a valid deletion request or account closure, we will take commercially reasonable steps to delete or de-identify the relevant Personal Data within a reasonable period, subject to the exceptions in Section 12.1. Residual copies may persist in backups, logs, caches, and disaster recovery systems until overwritten in the ordinary course. Deletion from the Service does not delete Personal Data previously transmitted to, retrieved by, or stored within any Third-Party Service, on any messaging platform, or on any device, which must be addressed directly with the relevant party.

13. Security

We maintain administrative, technical, organizational, and physical safeguards designed to reduce the risk of unauthorized access, destruction, loss, alteration, disclosure, or misuse of Personal Data, which may include encryption in transit and at rest where applicable, access controls, segmentation, credential handling protections, logging, rate limiting, change management, and incident response procedures. No method of transmission, storage, or processing is completely secure, and we do not guarantee the security of any Personal Data. You are responsible for safeguarding your devices, credentials, API keys, access links, and the permissions you grant to Third-Party Services, and for promptly notifying us of any suspected unauthorized access. Where required by applicable law, we will notify affected parties of a personal data breach in the manner and within the time required.

14. Children and Restricted Uses

The Service is intended for business and professional use by individuals who have reached the age of majority in their jurisdiction and is not directed to children. We do not knowingly collect Personal Data directly from children. If we become aware that we have collected such data directly from a child in violation of applicable law, we may delete it and terminate the associated account. Customers are solely responsible for determining whether the Service is suitable for their industry, sector, or regulated use case, including healthcare, financial services, employment, or the processing of minors' data.

15. Automated Processing and Profiling

The Service may use rules-based automation, filtering logic, deduplication, matching heuristics, rate controls, synchronization conditions, and operational diagnostics to route records, suppress configured content, or determine whether particular messages or records are synchronized, displayed, sent, retried, or blocked. We do not characterize these functions as decisions producing legal or similarly significant effects on individuals for purposes of applicable law unless a particular deployment context, Customer workflow, or law requires that characterization. Automated actions initiated by Third-Party Services connected by a Customer or User are the responsibility of that Customer or User.

16. Regional Notices and Supplemental Rights

EEA, UK, and Switzerland

Individuals in the EEA, the UK, and Switzerland may, subject to legal limitations and exemptions, have rights to request access to Personal Data; rectification of inaccurate or incomplete Personal Data; erasure; restriction of processing; objection to processing based on legitimate interests or for direct marketing; data portability where applicable; withdrawal of consent; and to lodge a complaint with a competent supervisory authority. Where we process Customer Data on behalf of a Customer, we may refer the request to that Customer or require that it be submitted through that Customer. Where the GDPR or UK GDPR applies, we may rely on Article 6(1)(b), 6(1)(c), 6(1)(f), and, where necessary, 6(1)(a), or their local analogues, and, for restricted transfers, on adequacy, SCCs, the UK Addendum, the UK IDTA, or other recognized safeguards, together with supplementary measures where appropriate.

India

To the extent the Digital Personal Data Protection Act, 2023 and rules thereunder apply, Data Principals may, subject to the conditions and exemptions set out therein, have rights to obtain information about processing, to correction, completion, updating, and erasure, to grievance redressal, and to nominate another individual to exercise rights in the event of death or incapacity. Data Principals are required to comply with the duties imposed on them by such law, including the duty not to register a false or frivolous grievance or complaint. Grievances should first be directed to us using the contact details in Section 20.

United States

Residents of certain U.S. states may have rights under applicable state privacy laws, which may include rights to know or confirm whether Personal Data is processed; to access specific pieces or categories of Personal Data; to correct inaccuracies; to delete Personal Data; to obtain portable copies of certain Personal Data; to opt out of certain processing for targeted advertising, sale, sharing, or profiling in furtherance of decisions producing legal or similarly significant effects; to appeal a refusal of a request; and to exercise rights through an authorized agent where permitted. Rights, exceptions, definitions, thresholds, and verification standards vary materially by state, and some rights may not apply to all data categories, all users, or to us. We do not represent that every disclosure, analytics event, or operational transfer falls outside every statutory definition of "sale," "sharing," or "targeted advertising"; we evaluate those concepts under the law governing the relevant processing and will handle verified requests accordingly. We do not discriminate unlawfully against individuals for exercising applicable privacy rights.

Brazil

To the extent the LGPD applies, titulares may have rights including confirmation of the existence of processing, access, correction of incomplete, inaccurate, or outdated data, anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD, portability where applicable, deletion of Personal Data processed with consent, information about public and private entities with which data has been shared, information about the possibility of denying consent and the consequences of such denial, revocation of consent, and petition to the ANPD, in each case subject to legal limitations and operational feasibility.

Mexico

Where Mexican privacy law applies, individuals may have ARCO rights (access, rectification, cancellation, and opposition), as well as rights to revoke consent or limit the use or disclosure of Personal Data, subject to applicable legal conditions, identity verification, and exceptions. Requests must clearly describe the right being exercised and provide information sufficient to locate the relevant records.

Argentina, Colombia, and Other Latin American Jurisdictions

Depending on the applicable law, individuals in Argentina, Colombia, and other Latin American jurisdictions may have rights to be informed, access, update, rectify, suppress, object to, or otherwise contest the processing of Personal Data, as well as rights associated with habeas data or local data protection procedures. Where a local law grants a non-waivable right broader or more specific than this Policy expressly describes, this Policy shall be interpreted to the minimum extent necessary to preserve that right.

17. Exercising Privacy Rights

To submit a privacy request, contact hello@whatsync.app. We may require information sufficient to verify identity, authority, residency, and the scope of the request before acting on it. We may deny, limit, or defer a request to the extent permitted by applicable law, including where we cannot verify identity or authority, where the request is manifestly unfounded or excessive, where fulfilment would adversely affect the rights or freedoms of others or disclose confidential or privileged information, where an exemption applies, or where we act on behalf of a Customer and the request must be directed to that Customer. Where applicable law grants a right to appeal a denial, we will describe that process in our response.

18. Abusive, Vexatious, or Bad-Faith Requests

We reserve the right to decline, limit, defer, or charge a reasonable fee for requests that are manifestly unfounded, excessive, repetitive, vexatious, or made in bad faith, to the extent permitted by applicable law. We may retain records of such requests, including the identity and communications of the requestor, for the purpose of establishing, exercising, or defending legal claims and protecting against abuse of rights-request mechanisms. Threatening, coercive, or abusive communications directed at us, our personnel, or our service providers may be retained for as long as reasonably necessary for those purposes and disclosed to legal counsel, insurers, courts, and regulatory authorities as reasonably necessary.

19. General Provisions

19.1. Changes. We may amend this Policy at any time to reflect changes in the Service, legal requirements, vendor relationships, operational practices, or regulatory guidance. The amended Policy will be effective upon posting on this page with an updated Last Updated date, unless a later date is specified or applicable law requires otherwise. Where required by applicable law, we will provide notice of material changes through the Service, by email, or by other appropriate means. Your continued use of the Service following the effective date of an amended Policy constitutes your acknowledgement of the amended Policy.

19.2. No Contractual Rights; No Third-Party Beneficiaries. This Policy is a statement of our practices and does not create any contractual or other legal rights in or on behalf of any party beyond those afforded by applicable law or the Terms. Nothing in this Policy confers any right, benefit, or remedy upon any Data Subject or other third party, except as required by applicable law.

19.3. Limitation. To the maximum extent permitted by applicable law, our liability arising out of or relating to this Policy or the processing described herein is subject to the disclaimers, limitations of liability, exclusions, and dispute resolution provisions of the Terms, which are incorporated herein by reference.

19.4. Severability and Language. If any provision of this Policy is held invalid or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall remain in full force and effect. The English version of this Policy controls over any translation to the extent permitted by applicable law.

20. Contact Information

Privacy-related inquiries, verified rights requests, grievances, complaints, and questions regarding this Policy may be directed to hello@whatsync.app.

Last Updated: October 10, 2026