Last updated: 9 May 2026. Plain language version below — the formal one is the same, just longer.
WhatAReply Inc. ("WhatAReply", "we", "us") provides software that helps businesses run their WhatsApp Business communications. This policy explains what we do with personal data.
Account data — your name, email, password (hashed), business name, billing details. You give us this when you sign up.
Workspace data — your contacts, messages, templates, campaigns, settings, and uploaded files. You give us this as you use the product.
Customer conversation data — when your customers message your WhatsApp number, those messages flow through our servers so we can deliver them to your inbox and (if you've enabled it) reply with AI.
Usage data — basic technical logs (IP address, browser, pages visited, errors) so we can keep the service running and secure.
We do not use your conversations to train any third‑party or public AI model. Your customer messages are private to your workspace.
We use a small number of trusted vendors to run the service:
Each one is contractually bound to handle your data only on our instructions.
Wherever you live, you can:
If you're in the EU, UK or California you also have rights under GDPR / UK GDPR / CCPA — same as above, just spelt out in legalese.
We keep your workspace data for as long as your account is active. If you cancel, we delete it within 30 days (backups within 90 days). Some billing records we have to keep for tax law — usually 7 years.
By default your data is stored on servers in the United States. Business plan customers can request EU or India residency. Either way, transfers between regions use standard contractual clauses approved by the European Commission.
Encrypted at rest with AES‑256, encrypted in transit with TLS 1.3. Tenant API keys and access tokens are encrypted with a per‑install key. Passwords are bcrypt-hashed. We log every admin action and review them regularly. See our security page for the longer version.
We use essential cookies (login session, CSRF token) and an anonymous analytics cookie to count page visits. We do not run advertising trackers. Cookies are first‑party only.
If we materially change this policy, we'll email you and post a notice in the app at least 30 days before it takes effect.
Privacy questions, deletion requests, or anything else: privacy@whatareply.com. A real person reads every email.