Privacy Policy

1. Data we collect

We collect only the data we need to run the service and support our customers:

• Account data — first name, last name, email address, hashed password and the workspace you belong to.
• Billing data — company name, country, VAT number (if applicable) and the payment details required by our payment processor. Card details are never stored on our servers.
• WhatsApp session data — the phone number that you link to Whatslink, session state (connected, disconnected, waiting for QR) and technical identifiers required to keep your session alive.
• Message metadata and content — sender, receiver, timestamp, direction, text and any attachment URL of the WhatsApp messages that are pushed to Whatslink so they can be synced to HubSpot.
• HubSpot connection — the OAuth tokens and portal identifiers needed to log notes on HubSpot contacts on your behalf.
• Support and product data — questions you send us, errors reported by the app and basic technical logs.

2. How we use your data

We process the data above to:

• Create your account and authenticate you.
• Match WhatsApp conversations to the right HubSpot contact and log them as HubSpot notes.
• Charge your subscription and prevent fraud.
• Send transactional email (password reset, account confirmation, disconnected WhatsApp session, invoices).
• Provide customer support and improve the product.
• Comply with legal obligations.

We never sell your data and we do not use the content of your WhatsApp messages for advertising or model training.

3. Legal basis (GDPR)

• Contract — to deliver the service you signed up for.
• Legitimate interest — to keep the platform secure, debug issues and improve the product.
• Legal obligation — invoicing, tax and other statutory requirements.
• Consent — where explicitly asked, for example optional marketing emails.

4. Subprocessors

Whatslink relies on a small number of trusted vendors to operate the service. They only process your data on our instructions:

• Supabase — application database, authentication and file storage (EU region).
• Cloudflare — hosting, CDN and DDoS protection.
• Stripe — subscription billing and payment processing.
• Resend — transactional email delivery.
• Railway — hosting of the WhatsApp bridge that keeps your linked WhatsApp sessions online.
• HubSpot — the CRM you explicitly connect so we can write notes to your contacts.

5. Data retention

We keep account and workspace data for as long as your subscription is active. When you cancel, we remove your workspace data within 90 days, except where we are legally required to keep invoices or logs longer.

Message content stored inside Whatslink is deleted from our database once it has been synced to your HubSpot portal, or after 30 days if the sync could not complete. You always have the final copy in HubSpot.

6. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate data.
• Request deletion of your data, subject to legal retention rules.
• Object to or restrict certain processing.
• Export your data in a structured, machine-readable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@whatslink.dev.

7. Security

All traffic to Whatslink is encrypted with TLS. Passwords are hashed, HubSpot and WhatsApp credentials are encrypted at rest with AES-GCM, and access to production systems is limited to a small number of authorised engineers. More details are on our Security Standards page.

8. Cookies

We only use cookies that are strictly necessary to run the app (authentication and session state). We do not use advertising cookies or third-party tracking pixels on the product itself.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app before they take effect.