Privacy Policy

WANotifier Inc ("WANotifier", "we", "us", "our") provides a WhatsApp marketing and automation platform. This policy explains what personal data we handle, why we handle it, and what rights you have.

It applies to our website at wanotifier.com, our application at app.wanotifier.com, our mobile apps, and our other business activities.

1. Who we are

WANotifier Inc
8 The Green #13143,
Dover, DE 19901, USA

Privacy contact: [email protected]

WANotifier Inc is part of a group that includes Fantastech Solutions Private Limited ("FSPL"), our affiliate in Pune, India, whose personnel operate and support the Service on our behalf.

EU and UK Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns about your personal data, you may contact our appointed representatives.

EU Representative
Euverify Ltd (Ireland)
Unit 3D, North Point House, North Point Business Park
New Mallow Road, Cork, T23 AT2P, Ireland
[email protected]

UK Representative
Euverify Ltd (UK)
3rd Floor, 86–90 Paul Street
London, EC2A 4NE, United Kingdom
[email protected]

To submit a data subject access request, a deletion request, or any other GDPR-related enquiry, you can use our secure portal. This link also lets you verify our appointed representatives. Requests submitted through the portal are logged and tracked.

2. Two different roles

This distinction determines which parts of this policy apply to you.

We are a controller: we decide why and how the data is used, for:

Account and billing data of our customers
Website visitors, enquiry and demo-request data
Marketing prospects and newsletter subscribers
Job applicants and personnel

We are a processor: we act on our customer's instructions, for:

Contact lists our customers upload
Message content our customers send and receive
Conversation history, chat assignments and notes

Where we act as processor, our customer is the controller. They decide who is messaged and why.

If you received a WhatsApp message sent through our platform and want your data corrected or deleted, please contact the business that messaged you. We will assist them, but we cannot act on their data without their instruction.

Our processing as a processor is governed by our Data Processing Agreement.

3. What we collect as controller

Account and billing

What: name, email address, phone number, company name, billing details, transaction history
Why: to create and operate your account, take payment, and meet tax and accounting obligations
Legal basis: performance of a contract, Article 6(1)(b); legal obligation for financial records, Article 6(1)(c)
Retention: for the life of your account plus the period described in Section 6; invoices and transaction records for 8 years

Technical and usage data

What: IP address, browser and device information, access logs, feature usage
Why: to operate and secure the Service, prevent fraud and abuse, and understand how the product is used
Legal basis: our legitimate interests in running a secure and reliable service, Article 6(1)(f)
Retention: access and security logs for up to 12 months

Support conversations

What: messages you send us through chat, email or our support channels
Why: to resolve your queries and improve our support
Legal basis: performance of a contract and our legitimate interests
Retention: 24 months from the last exchange

Enquiries and demo bookings

What: name, email address, company, phone number, and anything you tell us in the form
Why: to respond to you and take pre-contract steps at your request
Legal basis: steps prior to entering a contract, Article 6(1)(b), or consent
Retention: 24 months from your last engagement

Marketing communications

What: email address, name, engagement history
Why: to send product updates, offers and newsletters
Legal basis: consent, Article 6(1)(a), or our legitimate interests for existing customers and business contacts
Retention: until you unsubscribe, or 24 months from your last engagement

Cookies and analytics

What: cookie identifiers, pages visited, referral source
Why: to measure and improve our website and advertising
Legal basis: consent, Article 6(1)(a)
Retention: as set out in our cookie banner and Section 12

Job applicants and personnel

What: CV, cover letter, employment history, and information you provide during the hiring process
Why: to assess your application and, if you join us, to manage the employment or contractor relationship
Legal basis: steps prior to entering a contract, Article 6(1)(b); our legitimate interests in recruitment
Retention: 12 months after the hiring decision for unsuccessful applicants

Third-party sign-in

If you choose to create or access your account using a third-party sign-in service such as Google or Facebook, we receive your name, email address and a unique account identifier from that provider. We use this only to create and authenticate your account. We do not receive your password. Your use of the sign-in service is governed by that provider's own privacy policy.

Business outreach

Where we contact business prospects who have not signed up, we rely on our legitimate interests under Article 6(1)(f), limited to business contact details used in a business context. Every message carries an unsubscribe link. We honour opt-outs immediately and permanently, and we retain a minimal suppression record so that we do not contact you again.

4. What we handle as processor

When our customers use the Service, we process the following on their behalf:

Contact names, phone numbers, email addresses and custom fields they upload
WhatsApp message content, media and attachments
Delivery, read and response status
Conversation notes, tags and lifecycle stages

We process this data only on our customer's documented instructions. We do not use it for our own purposes, we do not sell it, and we do not use it to train AI models.

Retention is controlled by the customer. When a subscription ends, we retain the customer's data for 12 months so the account can be reactivated without loss. We notify the customer before that period expires, after which the data is deleted from production systems within 30 days and from backups within a further 7 days. Customers may instruct deletion or export their data at any time, which overrides this period.

Messages and the WhatsApp Cloud API

Messages sent through the Service are transmitted via Meta's WhatsApp Cloud API. Meta stores messages temporarily in order to deliver them, and deletes them automatically after 30 days. That processing is carried out by Meta under its own terms.

5. Who we share data with

We use the service providers listed on our sub-processors page, which names each provider, its location and what it does. That page is kept current, and customers may subscribe to change notifications.

We also disclose data where legally required, and to professional advisers under confidentiality obligations.

Affiliate programme

If you refer customers to us through our affiliate programme, we share conversion data with you so that your commission can be calculated. This is limited to referral visits, subscription identifiers and commission amounts, and does not identify the individual customer.

If you are an affiliate, we process your own contact and payment details in order to administer the programme and pay you. Our legal basis is performance of a contract, Article 6(1)(b).

Third-party links

Our website may contain links to sites we do not own or operate. Those sites have their own privacy policies and terms, and we have no control over how they handle personal data. We encourage you to read the privacy policy of every site you visit.

Business transfers

If WANotifier is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be disclosed to prospective and actual counterparties and their advisers, and may transfer as part of that transaction. Our legal basis is our legitimate interest in conducting and completing such transactions.

During any evaluation stage, disclosure is limited to what is necessary, made under confidentiality obligations, and uses aggregated or de-identified data wherever that will serve the purpose. Where we act as processor, customer data is disclosed only in accordance with our Data Processing Agreement.

If a transaction completes and the acquirer intends to process personal data for materially different purposes, we or the acquirer will notify affected individuals and, where required, obtain consent.

We do not sell personal data.

6. Where your data is stored and transferred

Our production infrastructure is hosted in India (DigitalOcean, Bangalore region). Personnel of our Indian affiliate FSPL access the Service to operate and support it.

India does not benefit from an EU or UK adequacy decision. Transfers therefore rely on:

EU: the Standard Contractual Clauses adopted by the European Commission
UK: the International Data Transfer Addendum to those Clauses
Supplementary technical and organisational measures, assessed through a transfer risk assessment

Some of our sub-processors process data in other countries, including the USA. Details and safeguards for each are on our sub-processors page.

Message content necessarily passes through Meta Platforms infrastructure as part of the WhatsApp Business Platform. This is inherent to the service and is governed by Meta's own terms.

To request a copy of our transfer safeguards, email [email protected].

7. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, logging and monitoring, centrally managed devices, secure development practices, and periodic security testing.

Our full set of measures is published in Annex II of our Data Processing Agreement.

No system is perfectly secure. We notify affected controllers without undue delay on becoming aware of a personal data breach, and notify supervisory authorities and data subjects where legally required.

8. Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

Access a copy of your personal data
Rectify inaccurate or incomplete data
Erase your data in certain circumstances
Restrict processing in certain circumstances
Object to processing based on legitimate interests, including direct marketing
Portability, receive your data in a structured, commonly used, machine-readable format
Withdraw consent at any time, without affecting processing carried out before withdrawal
Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects

To exercise any of these, email [email protected] or use the secure portal linked in Section 1. We respond within one month and do not charge for this.

You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority in your country of residence, place of work, or where the issue arose.

9. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

Our customers may configure automated message flows, chatbots and AI-assisted replies within the platform. They are responsible for those configurations and for informing their own contacts.

10. AI features

Where the Service offers AI-assisted features, content may be processed by the AI providers listed on our sub-processors page. We hold contractual commitments that customer content is not used to train or improve those providers' models, and we do not use customer content to train our own models.

11. Children

The Service is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from children under 16. If you believe we have, contact [email protected] and we will delete it.

12. Cookies

Our website uses cookies and similar technologies. Non-essential cookies, analytics and advertising, are set only with your consent, which you give through our cookie banner and can withdraw at any time using the consent link in our footer.

Essential cookies needed to operate the site and keep you logged in are set without consent, as permitted by law.

We do not currently respond to browser-initiated Do Not Track signals, as there is no consistent industry standard for compliance. Our cookie banner gives you direct control over non-essential cookies.

13. Mobile applications

Our iOS and Android apps collect device identifiers, push notification tokens and usage diagnostics in order to deliver notifications and maintain app stability.

We do not access your phone's contacts or address book.

If you grant permission, the app can access your photo library, camera, files or microphone so that you can attach media and documents to a chat. We access these only for the feature you have asked for, and you can withdraw permission at any time in your device settings.

14. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in-product notification at least 30 days in advance. The date at the foot of this page shows when it was last revised.

15. Contact

For questions, requests or complaints:

WANotifier Inc
8 The Green #13143, Dover, DE 19901, USA
[email protected]

EU and UK residents may also contact our representatives named in Section 1.

Last updated: 11th Sept, 2026