Privacy Policy
Last updated 2026-10-21
This is a plain-language summary written for launch. Have a lawyer review it before you rely on it.
What we collect
Account data: your email, and your name if you give one. Billing records, through Stripe. Metering counters: how many messages, when, and per key. A log of the messages you send: who each one went to, from which number, and whether it went out. When WhatsApp gives us a contact's phone number and contact ID, we keep the link between them so we can show the phone number instead of the ID. Delivery logs: each event we sent to your webhook and what came back, kept for a week. The URL of your webhook endpoint. And the chat history of your numbers, described below. API keys are stored only as hashes.
Your conversations
Each number you pair keeps the latest messages of every chat, so you can read them through the API: what it received, what it sent from the phone or through us, and what WhatsApp sends when you pair it. You choose how many per chat. 0 keeps none, lowering it deletes the oldest ones, and deleting a number deletes its history. For photos, audio and files we keep their details, not the files. Messages waiting in your send queue keep their text until they go out and for up to a week after, and so do the events in your webhook's delivery log. We use all of this only to run the service. We never sell it, use it for ads or train models on it.
Why we process it
To run the service: sign-in, sending, metering, billing and abuse prevention. To help you when you ask. And to meet legal obligations. The lawful bases are performance of a contract and legitimate interest. Billing also rests on a legal obligation to keep tax records.
Who we share it with
Supabase, which hosts our accounts and database. Stripe, for payments. Amazon SES, from Amazon Web Services, which delivers our emails from the United States (AWS's us-east-1 region) and sees your address and what each one says. AWS may store and scan each email to block spam and viruses. The hosting and gateway providers that run our servers. And WhatsApp itself, because sending a message necessarily hands its content to WhatsApp. We never sell data. If a public authority lawfully asks for data, we disclose only what the law requires, and we tell you whenever we are allowed to.
Your rights
Under the LGPD and the GDPR you can access, correct, export or delete your personal data, and object to or restrict how we process it. Write to gustavo@openwings.com.br and we will answer within the legal deadlines. Deleting your account removes your keys, your numbers and their chat history, your usage data and your message log. Billing records stay for as long as tax law requires.
Retention and security
We keep your data while your account is active, and delete old logs on a schedule. Access to production systems is restricted and logged, keys are hashed, and traffic is encrypted. No system is perfect, and we will tell you about a breach that affects your data wherever the law requires it.
Cookies and analytics
The marketing site uses no advertising trackers. The dashboard stores only what it needs to work: your session, your language and the email you type to sign in. That email stays in your browser for up to 30 minutes, so the next sign-in screen can fill it in. Once you are signed in, it is deleted. If we ever add analytics, we will say so here first.
Contact
OpenWings Automação Comercial Ltda. (CNPJ 63.852.648/0001-06), Rua Padre João Wislinski, 441, Santa Cândida, Curitiba – PR, CEP 82630-494, Brazil, is the controller for the data described here. Its data protection officer, the encarregado that the LGPD requires, is Gustavo Salomé Silva. Privacy questions and data requests: gustavo@openwings.com.br.
Signing in with Google or GitHub
If you sign in with Google or GitHub, all we receive from them is what the consent screen shows: your name, your email address and your profile picture. We use them to create your account and to recognise you when you come back. We do not ask for access to your Gmail, your Drive, your calendar, your contacts or your repositories. We do not sell this data, we do not use it for advertising, and we do not train any model on it. To disconnect, remove whatsapi at myaccount.google.com/permissions or at github.com/settings/applications; to delete the whole account, write to gustavo@openwings.com.br. whatsapi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Emails we send
We send two kinds of email. About your account: confirming your email, signing you in, setting a new password, confirming a new address, and verification codes. These are part of the service, so they cannot be turned off while the account exists. News and tips: we send none today. If we start, only the people who left the box ticked at sign-up will get them, and every one will carry a link to unsubscribe.
AI apps and agents
You can connect whatsapi to an AI app like Claude or ChatGPT, or to an agent, a program that uses AI to act for you. The app then acts as you, with an API key of your account. What it can see and do, what we keep, for how long, and how to cut it off are on a page of their own.