Privacy Policy

This Privacy Policy describes how WhatSync handles information across our websites, application interfaces, APIs, connected services, customer support interactions, operational security functions, billing flows, and related business activities that reference or incorporate this Privacy Policy (collectively, the "Service"). This document is intended to operate as a global baseline notice and, to the extent required by applicable law, a supplemental regional notice for individuals located in, or whose personal data is otherwise regulated by, jurisdictions including the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, the United States, Brazil, Mexico, Argentina, Colombia, and other jurisdictions with materially analogous data protection or consumer privacy requirements.

Because the Service is designed to connect business communication systems with customer relationship management workflows, our role can vary depending on the context. In many circumstances, a customer using the Service determines which contacts, conversations, attributes, records, or workspaces are connected, and we process that information on the customer's behalf. In other circumstances, we independently determine the purposes and means of processing for account administration, fraud prevention, billing, product analytics, service improvement, legal compliance, security monitoring, and dispute management. When applicable law draws distinctions among concepts such as "controller," "processor," "business," "service provider," "operator," "responsável," "operador," "responsable," and "encargado," those distinctions will apply according to the facts of the relevant processing activity.

1. Scope, Applicability, and Interpretive Priority

This Privacy Policy applies to personal data, personal information, or equivalent legally protected information that we collect, use, disclose, transmit, store, analyze, secure, or otherwise process in connection with the Service. It does not apply to information that has been irreversibly anonymized or de-identified in accordance with applicable law, or to data processed exclusively by third-party platforms under their own independent terms and notices where we do not receive or control that information.

If you are using the Service through an organization, workspace, employer, agency, or principal account holder, that organization may separately control your use of the Service and may provide independent notices, policies, contractual instructions, or acceptable-use requirements. In the event of a conflict between this Privacy Policy and a separate written data processing addendum or other negotiated agreement between us and a customer, the negotiated agreement will control to the extent of the conflict with respect to customer-controlled data, except where applicable law requires a different result.

2. Categories of Information We Process

Depending on the manner in which the Service is configured and used, we may process the following categories of information:

• Account, identity, and contact data, including names, business email addresses, phone numbers, session identifiers, team membership data, invite metadata, authentication tokens, and account administration records.
• Integration and credential data, including encrypted connection credentials, scoped API permissions, device linkage state, and other technical information needed to establish, maintain, secure, or end connections between the Service and supported third-party systems. The QR connection does not require your WhatsApp password or SMS verification code.
• Communications and CRM-linked data, including message text, timestamps, directionality, associated contact names, phone identifiers, note metadata, conversation linkage data, selected groups, filtering preferences, and related synchronization outputs written to or read from customer systems.
• Transactional and commercial data, including plan status, subscription or billing metadata, payment processor references, service configuration choices, and customer support or contractual records.
• Device, network, and usage data, including IP address, approximate geolocation inferred from network metadata, browser or operating system information, diagnostic logs, error traces, webhook payload metadata, routing data, security events, and product interaction telemetry.
• Support, feedback, and operational communications, including inquiries, support tickets, product feedback, survey-style submissions, complaint records, follow-up correspondence, service communication preferences, and records of onboarding, support, billing, trial, or outage-related notices sent through approved channels, including WhatsApp where enabled by the user.
• Sensitive or special-category information, only to the extent that such information is embedded in customer communications, imported customer records, or support materials that a customer or user elects to process through the Service. We do not intentionally require special-category or sensitive personal data for the ordinary consumer-facing operation of the Service and ask customers not to use the Service for regulated or high-risk processing unless they have independently determined the Service is appropriate and lawful for that use case.

3. Sources of Information

We may collect information directly from you, from the organization that provides your access to the Service, from connected third-party platforms such as Attio, WhatsApp-related integrations, Meta, payment processors, support channels, analytics tools, infrastructure providers, and security or anti-abuse systems. We may also derive information from raw operational events, customer configurations, synchronization outcomes, service logs, and integrity checks used to determine connection health, billing status, and access rights.

For a QR connection, we also process the pairing, connection status, session continuity, and re-authentication events needed to keep the linked device working. WhatsApp and Meta control the underlying platform and may require a device to be linked again.

4. Purposes of Processing and Legal Bases

Subject to applicable law, we process information for the following purposes:

• To provision, authenticate, operate, maintain, troubleshoot, and improve the Service.
• To connect, synchronize, format, transmit, receive, reconcile, or present communications and CRM-related records across integrated systems.
• To administer accounts, team access, settings, support requests, invoices, subscriptions, and business relationships.
• To send service communications about setup, support, billing, account administration, product changes, outages, and security. We may send marketing messages where permitted by law, and you can opt out of those messages at any time.
• To secure the Service, detect or prevent misuse, fraud, spam, abuse, unauthorized access, unlawful conduct, policy violations, and operational failures.
• To analyze product usage, service quality, performance, and reliability, including through session replay, diagnostics, logging, and analytics technologies used to understand feature adoption and product issues.
• To comply with legal obligations, respond to lawful requests, establish or defend legal claims, enforce contracts, and preserve evidence.

Where the GDPR, UK GDPR, Swiss data protection rules, LGPD, or similar laws apply, the legal bases for the above processing may include: performance of a contract; taking steps at your request before entering into a contract; compliance with legal obligations; our legitimate interests or the legitimate interests of our customers, users, and counterparties in secure, auditable, and reliable business communications and CRM operations; and, where required, consent. If we rely on consent, you may withdraw it at any time, although that will not affect the lawfulness of processing before withdrawal and may not affect processing carried out on another lawful basis.

You may opt out of marketing communications by using the option in the message or contacting us. We may still send messages needed to provide the Service, respond to support requests, protect an account, or meet a legal obligation.

5. Disclosures to Third Parties

We do not sell the contents of WhatsApp messages, use message content for advertising, or use it to train a general-purpose AI model. If you enable an external AI integration and ask it to work with your messages, that provider processes the information under its own terms and your account settings.

We may disclose information to the following categories of recipients, subject to applicable law and appropriate contractual or statutory safeguards:

• Hosting, cloud, storage, observability, security, customer support, email, and infrastructure vendors that help us operate the Service.
• Integrated third-party platforms designated by the customer or necessary to provide the Service, including CRM systems, messaging-related providers, and payment processors.
• Professional advisers, auditors, insurers, financing sources, legal counsel, and potential acquirers in connection with corporate transactions, diligence, or risk management.
• Governmental authorities, regulators, courts, law enforcement, or counterparties where disclosure is required or reasonably necessary to comply with law, protect rights, or prevent harm.
• Other parties at your direction or with your authorization.

We do not represent that every disclosure will be characterized identically under every statute. To the extent a particular U.S. state law, consumer privacy framework, or similar regime treats a disclosure differently than we do for ordinary commercial purposes, we will interpret and address the disclosure as required by the applicable law governing that processing activity.

6. Cookies, Local Storage, and Similar Technologies

We use cookies, local storage, and similar technologies to maintain sessions, preserve setup acknowledgements, remember product preferences, measure usage, understand feature adoption, improve the Service, and support analytics, diagnostics, attribution, and security functions. Some of these technologies may be operated by third-party analytics or infrastructure providers acting on our behalf. You can manage certain browser-side technologies through your browser or device settings, but disabling them may affect the availability or functionality of parts of the Service.

7. International Data Transfers

The Service may involve cross-border processing and storage of personal data in jurisdictions other than the jurisdiction in which the data originated. Where required by applicable law, we implement transfer mechanisms intended to provide an adequate level of protection, which may include adequacy decisions, standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or the UK Addendum, and other lawfully recognized mechanisms, assessments, or supplementary measures. Operational necessity alone does not eliminate transfer compliance obligations; accordingly, transfer practices may be adapted over time to reflect regulatory developments, vendor changes, or new guidance.

8. Retention

We keep personal data for as long as needed to run an active account and provide the features the customer has enabled. We may keep limited billing, security, support, and audit records after an account closes where law or a legitimate business need requires it. Records already written into a customer's Attio workspace remain under that customer's control in Attio.

When a valid deletion request applies, we delete or de-identify the relevant personal data unless we must retain it to comply with law, resolve a dispute, prevent abuse, or establish or defend a legal claim. We will explain any applicable limitation when responding to the request.

9. Security

We use administrative, technical, organizational, and physical safeguards designed to reduce the risk of unauthorized access, destruction, loss, alteration, disclosure, or misuse of data. These safeguards may include encryption in transit and at rest where applicable, access controls, segmentation, credential handling protections, logging, rate limiting, change management, secure development practices, and incident response procedures. No method of transmission, storage, or processing is absolutely secure, and therefore we cannot guarantee absolute security.

10. Children and Restricted Uses

The Service is intended for business and professional use and is not directed to children. We do not knowingly market the Service to children or intentionally collect personal information directly from children in a manner that would trigger child-specific consent or notice obligations. Customers remain responsible for evaluating whether the Service is suitable for their own industry, sector, or regulated use cases, including healthcare, financial services, employment, minors' data, or other high-risk categories.

11. Automated Decision-Making and Profiling

The Service may use rules-based automation, filtering logic, deduplication, matching heuristics, synchronization conditions, and operational diagnostics to route records, suppress configured content, or determine whether particular messages or records should be synchronized, displayed, retried, or blocked. We do not describe these functions as decisions producing legal or similarly significant effects on individuals for purposes of applicable privacy laws unless and until a particular deployment context, customer workflow, or law requires that characterization.

12. Regional Notices and Supplemental Rights

EEA, UK, and Switzerland

Individuals in the EEA, UK, and Switzerland may have rights, subject to legal limitations and exemptions, including the right to request access to personal data; rectification of inaccurate or incomplete personal data; erasure; restriction of processing; objection to processing based on legitimate interests or direct marketing; data portability in a structured, commonly used, and machine-readable format where applicable; withdrawal of consent; and complaint to a competent supervisory authority. Where we process customer-controlled data solely on behalf of a customer, we may refer the request to the relevant customer or require the request to be submitted through the customer.

If the GDPR or UK GDPR applies, we may rely on Article 6(1)(b), 6(1)(c), 6(1)(f), and, where necessary, 6(1)(a) legal bases or their local analogues. Where international transfers are restricted, we may rely on adequacy, SCCs, the UK Addendum, the UK IDTA, or other recognized safeguards, together with supplementary measures where appropriate.

United States

Residents of certain U.S. states may have rights under applicable state privacy laws, including rights to know or confirm whether personal information is processed; access specific pieces or categories of personal information; correct inaccuracies; delete personal information; obtain portable copies of certain personal information; opt out of certain processing for targeted advertising, sale, sharing, or profiling in furtherance of decisions producing legal or similarly significant effects; appeal a refusal of a request where such appeal rights apply; and exercise rights through an authorized agent where permitted by law. Rights, exceptions, definitions, and verification standards vary materially by state, and some rights may not apply to all data categories or all users.

We do not state that every disclosure, analytics event, or operational transfer is exempt from every statutory definition of "sale," "sharing," or "targeted advertising" in every state. Instead, we evaluate those concepts according to the applicable law governing the relevant processing context and will handle verified requests accordingly. We do not discriminate unlawfully against individuals for exercising applicable privacy rights.

Brazil

To the extent the LGPD applies, titulares may have rights including confirmation of the existence of processing, access, correction of incomplete, inaccurate, or outdated data, anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD, portability where applicable, deletion of personal data processed with consent, information about public and private entities with which data has been shared, information about the possibility of denying consent and the consequences of such denial, revocation of consent, and petition to the ANPD, subject to legal limitations and operational feasibility.

Mexico

Where Mexican privacy law applies, individuals may have ARCO rights (access, rectification, cancellation, and opposition), as well as rights to revoke consent or limit the use or disclosure of personal data, subject to applicable legal conditions, identity verification, and exceptions. Requests should clearly describe the right being exercised and provide sufficient information to locate the relevant records.

Argentina, Colombia, and Other LATAM Jurisdictions

Depending on the applicable law, individuals in Argentina, Colombia, and other Latin American jurisdictions may have rights to be informed, access, update, rectify, suppress, object to, or otherwise contest the processing of personal data, as well as rights associated with habeas data or local data protection procedures. If a local law grants a broader or more specific right than this notice expressly describes, we will interpret this Privacy Policy in a manner intended to preserve that non-waivable right.

13. How to Exercise Privacy Rights

To submit a privacy request, contact hello@appstronauts.shop. We may request additional information to verify identity, authority, residency, or the scope of the request. We may deny, limit, or defer a request to the extent permitted by applicable law, including where we cannot verify identity, where the request is manifestly unfounded or excessive, where disclosure would adversely affect the rights of another person, where an exemption applies, or where we act solely on behalf of a customer and the request must be directed to that customer. If applicable law grants a right to appeal a denial, we will provide information about that process in our response.

14. Abusive, Vexatious, or Bad-Faith Requests

We reserve the right to decline, limit, defer, or charge a reasonable fee for requests that are manifestly unfounded, excessive, repetitive, vexatious, or made in bad faith, to the extent permitted by applicable law. We also reserve the right to retain records of such requests, including the identity and communications of the requestor, for the purpose of establishing, exercising, or defending legal claims and protecting against abuse of rights-request mechanisms. Threatening, coercive, or legally abusive communications directed at us, our personnel, or our service providers in connection with a rights request may be retained indefinitely and disclosed to legal counsel, insurers, courts, and regulatory authorities as reasonably necessary.

15. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in the Service, legal requirements, vendor relationships, operational practices, or regulatory guidance. The version posted on this page will include an updated effective date. Material changes may be communicated through the Service, by email, or through other appropriate means where required by law.

16. Contact Information

Privacy-related inquiries, verified rights requests, complaints, or questions about this Privacy Policy may be directed to hello@appstronauts.shop.

Last Updated: March 21, 2026