Privacy when you connect an AI app
Last updated 2026-10-17
This is a plain-language summary written for launch. Have a lawyer review it before you rely on it.
What this page covers
You can connect whatsapi to an AI app or agent, like Claude, ChatGPT, Codex or Cursor: with the whatsapi plugin, as a connector, or with an API key. This page says what that app can see and do, what we keep, for how long, and how to cut the app off. Everything else about your data is in our Privacy Policy.
What the app can see and do
The app acts as you, with an API key of your account. It can send WhatsApp messages from your numbers to anyone: texts, files, locations, contact cards and verification codes. It can also read the chats your numbers keep, mark messages as read, check whether a phone number is on WhatsApp, add and pair a number, change a number's settings, and set up your webhook and your Supabase hook. It can't disconnect or delete a number. It sees only what a tool returns when it calls one, and the messages it sends count toward your monthly quota.
Who receives your data
What a tool returns goes to the company behind the AI app you connected, such as Anthropic for Claude or OpenAI for ChatGPT and Codex. That company handles it under its own privacy policy, and whatsapi does not control what it keeps. The messages the app sends go to WhatsApp and to the people they're addressed to, like any message you send. We don't pass any of this on to an AI provider ourselves.
When you connect
The page where you approve the app shows its name and the address it will send you back to. We keep a record of each sign-in, with the app's name and your account, for as long as it can be used: 5 minutes after you approve an app in your browser, or 10 minutes for a sign-in code. A daily cleanup deletes it within two days after that.
The app's key
Connecting makes an API key named after the app, like "Claude (claude.ai)". We store only a fingerprint of the key (a hash), never the key itself, along with its name, its first few characters, and when it was made and last used. The key works until you revoke it. After that, its record stays with your account. An account can have up to 10 active keys.
What the app sends
We keep the messages the app sends the same way as the ones you send yourself. Our message log keeps who each one went to, from which number, and whether it went out, for 30 days. A message waiting in your send queue keeps its text until it goes out and for up to a week after. Events we send to your webhook are kept for a week. We also count the app's messages per day under its key, and those counts stay with your account.
Logs
Our API logs which endpoint each request called, the result and how long it took, with no IP address and no message content. We delete those lines within 31 days. Errors go to a separate log, which keeps the last 30 days that had errors. Our web server's access log also records the IP address and which app sent the request, with keys and secrets removed. We keep it for 180 days, then delete it.
How to cut an app off
Revoke its key on the API keys page of your dashboard (app.whatsapi.sh/keys). The app loses access at once. Remove whatsapi from the AI app too, so it forgets the key. If you delete your account, its keys go with it. Your rights under the LGPD and the GDPR, and how to use them, are in our Privacy Policy. Questions: gustavo@openwings.com.br.