Privacy and data at WAIA Connect
WAIA Connect is a bridge between your system and WhatsApp. We don't store your conversations: messages pass through our server only for as long as it takes to deliver them. Here is everything we keep, where, and for how long.
In short
- Message content: not stored permanently. Only while it waits to be delivered to your webhook or to WhatsApp; it is deleted once delivered and, if it can't be delivered, after 73 hours at the latest.
- Files: the ones you receive are streamed from Meta on the spot, without being stored on our servers; the ones you send by link never pass through them.
- Where: Google Cloud, United States (region
us-central1, Iowa). - AI: no AI reads your WhatsApp messages. The support AI only reads what you write to support.
- Sensitive data (for example, health data): the service only transmits it. The customer is responsible for the processing of sensitive data being lawful.
- No third-party analytics: we don't use Google Analytics, advertising pixels or external tracking tools.
What we keep and for how long
| Data | Purpose | How long |
|---|---|---|
| Text of a message waiting to be delivered, with the contact's number and profile name and the reference or link of its files (never the file) | Delivering it to your webhook or to WhatsApp | Until delivery or the last retry; 73 h at most (it expires at 72 h and the automatic cleanup runs every hour). While waiting, it is in the database, under the provider's disk encryption |
| Previous WhatsApp Business history (only if you choose to receive it) | Delivering it to you once | Encrypted (AES-256-GCM); deleted once delivered or after 7 days |
| Metadata of each message: Meta identifiers (the message's, as an irreversible fingerprint), type, status, dates, country code and length; no text and no contact phone number | Showing you the status of your sends, measuring usage and billing | 30 days |
| References to received files (identifier, type, size, SHA-256 fingerprint) | Serving you the file when you request it | 7 days since last use |
| Your account data: email, name, company; connected business number and name | Providing the service | While the account exists |
| Account activity log (panel actions, with IP) | Security and auditing | While the account exists; if the account is deleted, it is anonymized, without IP |
| Support requests (and the emails you write to us) | Answering you | A request's text, while the account exists; attached screenshots, 30 days after it is answered; an email, 365 days |
| Database backups | Restoring the service after a failure | Daily, encrypted (AES-256), 30 days. They may include messages that were waiting for delivery at that time |
This is the short version. The full list, item by item (payments, emails we send you, attempts to connect a number, site visits), is in the Privacy Policy.
Where the data is
Server on Google Cloud, region us-central1 (Iowa, United States), with the provider's disk encryption. Backups on the same server, encrypted. Today we don't offer choosing another region.
Security
All traffic is encrypted (HTTPS/TLS). Meta access tokens and your webhook secrets are stored encrypted (AES-256-GCM); API keys are stored only as a fingerprint (SHA-256): nobody can read them, not even us.
Automatic checks every night: that no data is assigned to an account that isn't its own (isolation between accounts), that no secret shows up in logs or responses, and that the night's backup can be decrypted and is complete. Technical logs don't keep message text and roll over within a few days.
Artificial intelligence
WAIA Connect's support AI (current provider: Anthropic) receives only what you write to us —the text of a support request, of the contact form, or of the note left if connecting a number gets stuck— and a technical summary of the account (country, language, plan, number status). It never receives your WhatsApp messages or your contacts' data. We use its commercial API: under its terms, it doesn't train models on what we send.
Recommendation: don't paste your customers' or patients' messages into a support request.
Subprocessors (message content)
| Provider | Purpose | What data |
|---|---|---|
| Google Cloud (US) | Server, database and backups | Everything described on this page |
| Resend (US; emails are sent from São Paulo, region sa-east-1) | Platform and support emails | Email, name and email content |
| Cloudflare (US) | Domain (DNS), contact form protection and email reception | IP of the contact form visitor; emails arriving at hola@waiaconnect.com |
| Anthropic (US) | Support AI | Text of support requests, of the contact form and of onboarding notes (no WhatsApp messages) |
We announce on this page, 30 days in advance, before adding a subprocessor that handles message content.
Your own system (the webhook you configure) receives the full content of messages: it is their destination, and you choose it.
WhatsApp (Meta) is not our subprocessor: it is the channel you contract directly with Meta. Your WhatsApp Business account is yours, and Meta processes the messages under its own terms.
Account and billing providers
| Provider | Purpose | What data |
|---|---|---|
| Polar (US) | International card payments (merchant of record) | Payer's name, email, billing address and IP, and the payment. We never see the card |
| MercadoPago (Argentina) | Payments in Argentina | Payment email, amount and account identifier. We never see the card |
| Google (sign-in; US) | Sign in with Google | Email and name |
For your account, payment and sign-in data, WAIA Connect is the controller: it is governed by the Privacy Policy, not by the data processing agreement.
Your rights
You can request access, correction or deletion of your data, or closing the account, by writing from your panel, in Support, or, if you don't have an account, through the contact form. Deletion is done within 15 days. When the account is deleted your data is erased, except payment evidence and the audit log, which remain anonymized (what the law requires keeping, such as invoicing). Backups roll over within 30 days.
For legal matters (the data processing agreement, a request or a notice), write to legal@waiaconnect.com.
What we don't offer yet
Data hosting in a region chosen by the customer. Customer-managed encryption keys. Certifications (ISO 27001, SOC 2). Audits are fulfilled through documentation; an inspection, only in the cases the data processing agreement provides for. If your company needs it, write to us through the contact form and let's talk.
Data processing agreement (DPA)
Need a data processing agreement? Write to us at legal@waiaconnect.com.
⚠ This is an operational, honest text describing how the service works; it is not legal advice. The full detail is in the Privacy Policy.