In short
- Waso is a platform that lets businesses talk to their customers on WhatsApp, Instagram and Messenger from one shared inbox, with the help of an AI agent.
- Messages and contacts belong to each business. Waso processes them on that business's behalf and only to provide the service.
- We do not sell personal data or use it for advertising. Waso does not train AI models on conversations.
- Anyone can ask for their data to be deleted. The steps are on the Data deletion page.
1. Who we are
Waso is a service operated by [legal entity name], tax ID (CUIT) [CUIT], with registered address at [registered address] (“Waso”, “we”).
For any question about this policy or your personal data, write to privacidad@wasoapp.com.
2. Who this policy applies to
This policy describes how we process personal data on wasoapp.com and on the Waso platform. It covers three groups of people:
- Clients. Businesses that subscribe to Waso, and the members of their team who use the platform with a username and password.
- End users. People who message a Client on WhatsApp, Instagram or Messenger, or who receive messages from a Client, and whose conversations are handled in Waso.
- Visitors. People who browse this site or contact us for information.
Our role for each group
For End user data, the Client is the data controller: it decides what data it collects, for what purpose and on what legal basis it contacts each person. Waso acts as a data processor and technology provider: we process that data on the Client's behalf, following its instructions and our contract, and we do not use it for our own purposes.
For Client account data and Visitor data, Waso is the data controller.
3. What data we process
| Category | Data | Source |
|---|---|---|
| Client and team accounts | Name, email address, role on the platform and password (stored as a hash, never in plain text). Business contact and billing details. | Provided by the Client when subscribing and when adding team members. |
| Meta connection | Identifiers of the Client's WhatsApp Business account, phone number, Facebook Page and Instagram professional account; access tokens; message templates; the messaging limit reported by Meta. | Provided by Meta when the Client authorizes Waso to access its accounts. |
| Messages | Content of messages sent and received (text, images, audio, video, documents and reactions), date and time, message identifiers, and sent, delivered and read statuses. | Received from Meta's platforms, or written by the Client's team or the AI agent. |
| End user data | On WhatsApp: phone number and profile name. On Instagram and Messenger: the identifier Meta assigns to the person for that account, name and username. Also the data the Client enters or imports: name, phone, email, segment, tags and other attributes the Client defines. | Meta, the End user during the conversation, and the Client. |
| Profile picture | On Instagram and Messenger, the profile picture is displayed in the conversation. Waso does not store the image: it is requested from Meta at the time it is shown. | Meta. |
| Conversation source | If the person wrote from an ad, replied to a story or mentioned the account: the ad identifier and title, or a reference to the story or post. | Meta, together with the message. |
| Generated content | Transcripts of received audio messages, replies drafted by the AI agent, and the stage, notes or tags the agent or the team assign to a contact. | Generated inside Waso. |
| Technical data | IP address, date and time of access, browser type and the activity logs needed to operate and protect the service. | Recorded automatically when the site or platform is used. |
Waso does not request or need sensitive data. If an End user includes such data in a message, it stays within the Client's conversation and is protected in the same way as the rest.
Cookies
This site does not use advertising or analytics cookies and contains no tracking pixels. The platform uses one strictly necessary cookie to keep you signed in. Our network provider may use technical cookies to protect the service from abuse.
4. How we use the data
- To provide the service to the Client: receiving and displaying conversations in the inbox, sending the replies and campaigns the Client decides to send, generating AI agent replies, transcribing audio, organizing contacts with stages, tags and notes, showing the status of each message and giving the Client reports on its own activity.
- To manage the account: creating users, controlling access by role, billing and support.
- To keep the service secure and stable: preventing abuse, detecting faults and fixing them.
- To comply with legal obligations and respond to valid requests from competent authorities.
- To answer enquiries from people who contact us through this site.
We process End user data on the basis of the Client's instructions and our contract with the Client. We process Client and Visitor data to perform the contract, for our legitimate interest in operating and protecting the service, to comply with legal obligations, or with your consent, as applicable.
We do not sell personal data. We do not use it to build advertising profiles or share it with third parties for advertising. We do not combine one Client's data with another's.
5. Data obtained from Meta platforms
Waso integrates with the WhatsApp Business Platform, the Instagram API and the Messenger Platform as a technology provider. The Client connects its own accounts through Meta's authorization flow and can revoke that access at any time from its Meta business account settings.
Data we receive through those platforms (“Platform Data”) is handled as follows:
- It is used only to provide the service to the Client that connected the account, on its behalf and following its instructions.
- It is not sold, licensed, or used for advertising or to profile individuals.
- It is not used for the benefit of another Client and is not combined across Clients.
- Access within Waso is limited to the people who need it to operate and support the service, under a duty of confidentiality.
- Files received through Instagram and Messenger are not copied to our servers: they are displayed from the address Meta provides, so they stop being available when the person deletes them or when they expire. Files received through WhatsApp are stored with the conversation because the platform offers no other way to display them.
- It is deleted when the Client asks, when the contract ends, or when the individual requests it, as explained under Retention and on the Data deletion page.
End users' use of WhatsApp, Instagram and Messenger is also governed by Meta's and WhatsApp's own privacy policies, which are separate from this one.
6. Artificial intelligence
Waso includes an AI agent that each Client configures to answer questions about its own business: products, prices, opening hours and service policies. It is not a general-purpose assistant.
- To draft a reply, the agent receives the recent messages in the conversation, the contact data the Client has stored and the business information the Client has entered.
- Received audio messages are transcribed automatically so the team and the agent can read them.
- Processing is carried out by an AI model provider through its API (see Providers). Under its terms, that provider does not use data sent through the API to train its models.
- Waso does not train its own or third-party AI models on conversations.
- The Client can turn the agent off, and the agent hands the conversation over to a member of the Client's team when the enquiry requires it.
7. Who we share data with
We share personal data only with providers we need in order to deliver the service, who act on our behalf under confidentiality and security obligations:
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms, Inc. (WhatsApp, Instagram, Messenger) | Sending and receiving messages on the channels the Client connected. | United States and other countries |
| OpenAI | Generating AI agent replies and transcribing audio. | United States |
| DonWeb | Hosting of servers and the database. | Argentina |
| Cloudflare | Network, protection against attacks and access control for the platform. | United States and other countries |
| Resend | Sending email, when the Client uses that channel. | United States |
| Reading the product catalog the Client chooses to share from Google Sheets. It receives no End user data. | United States and other countries |
We may also disclose data when required by law or by an order from a competent authority, or as part of a merger or transfer of the business, keeping the protections of this policy in place.
8. International transfers
Some of the providers listed operate outside Argentina, in countries that may not offer a level of protection equivalent to Argentine law. In those cases we rely on the contractual safeguards each provider offers and limit the data sent to what the contracted function requires.
9. How long we keep data
- Conversations and contacts: for as long as the Client keeps its account active, or until the Client deletes them or asks us to delete them.
- When the contract ends: we delete the Client's data within the following 30 days, unless the Client first asks for a copy or for immediate deletion. Backups are overwritten within a further 30 days at most.
- Meta access tokens: deleted when the Client disconnects the channel or the contract ends.
- Technical logs: for as long as needed to operate and protect the service, up to 90 days.
- Billing and contract records: for the periods required by tax and commercial law.
10. Data deletion
You can ask for your personal data to be deleted at any time by writing to privacidad@wasoapp.com. If you are an End user, you can also ask the business you spoke with directly. The step-by-step instructions, what is deleted and the timeframes are on the Data deletion page.
11. Security
- All communication with the site and the platform is encrypted in transit (HTTPS/TLS).
- Each Client's data is isolated from other Clients' data at the database level.
- Passwords are stored hashed and access to the platform is controlled per user and per role.
- Messages we receive from Meta are signature-verified before being processed.
- Access to the infrastructure is restricted to the technical staff who need it.
No system is infallible. If we detect a security incident affecting personal data, we will notify the affected Client without undue delay and, where applicable, the supervisory authority.
12. Your rights
Argentina's Personal Data Protection Law No. 25,326 gives you the rights to access, rectify, update and delete your data. To exercise them, write to privacidad@wasoapp.com stating your name and the contact detail you used (for example, your WhatsApp number). We may ask for additional information to verify your identity.
If you are an End user, the controller of your data is the business you spoke with. You can contact that business or us: if you write to us, we forward your request to the business and help it comply.
We respond within the statutory timeframes: 10 calendar days for access requests and 5 business days for rectification, update or deletion requests.
The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as provided in Section 14(3) of Law No. 25,326. The Agencia de Acceso a la Información Pública (Argentina's Agency for Access to Public Information), as the supervisory authority under Law No. 25,326, is empowered to hear complaints and claims from anyone whose rights are affected by a breach of personal data protection rules.
13. Children
Waso is a tool for businesses and is not directed at people under 18. We do not knowingly collect data from minors. If you believe we are processing a minor's data without authorization, write to us and we will delete it.
14. Changes to this policy
We may update this policy to reflect changes in the service or in the law. We will publish the current version on this page with its update date and, if the change is significant, notify Clients by email or within the platform.
15. Contact
[legal entity name]
[registered address]
Privacy and personal data: privacidad@wasoapp.com
General enquiries: hola@wasoapp.com
This is a translation of the Spanish version. If the two differ, the Spanish version prevails.