Privacy Policy
Effective Date: October 17, 2026. whatiha is committed to upholding strict privacy standards for businesses, their operators, and their end-user WhatsApp contacts.
01. Overview & Data Roles
whatiha (“we,” “us,” or “our”) provides autonomous conversational software connecting businesses with customers over WhatsApp, SMS, and Voice telephony.
Under applicable data protection laws (including the EU General Data Protection Regulation “GDPR” and the California Consumer Privacy Act “CCPA”):
- whatiha as a Data Processor: With respect to the personal data of leads, patients, and clients who communicate with our subscribers via WhatsApp (“End-User Data”), whatiha acts solely as a Data Processor on behalf of our business Subscribers (the “Data Controller”).
- whatiha as a Data Controller: With respect to our business account holders, billing information, and direct website visitors, whatiha acts as a Data Controller.
02. Information We Collect
We collect and process the following categories of information:
End-User & WhatsApp Data
- • Phone numbers & WhatsApp profile usernames
- • Inbound and outbound message transcripts
- • Voice memos and audio recordings for Whisper transcription
- • Appointment booking preferences & calendar slots
- • Lead status, intent tags, and deal qualification values
Account & Billing Data
- • Business name, corporate address & admin email
- • Encrypted authentication credentials (passwords hashed via Argon2/bcrypt)
- • OAuth tokens for Google Calendar & Cal.com integrations
- • Payment processor tokens (managed securely via Stripe; we do not store raw credit card numbers)
03. How We Use Collected Data
whatiha uses data exclusively to fulfill legitimate business and platform services:
- Facilitating instant real-time AI conversations and voice note generation on WhatsApp.
- Syncing confirmed bookings to subscriber calendars (Google Calendar, Cal.com) without scheduling conflicts.
- Triggering ghosted lead re-engagement sequences and margin recovery audits.
- Generating operational analytics, response speed metrics, and revenue attribution reports.
- Preventing system abuse, fraud, and violations of WhatsApp Business policies.
04. Authorized Third-Party Subprocessors
To deliver our enterprise features, we partner with industry-leading infrastructure providers under strict Data Processing Agreements (DPAs):
| Provider | Service Role | Data Location |
|---|---|---|
| Meta Platforms (WhatsApp) | WhatsApp Cloud API & messaging delivery | US / EU |
| OpenAI / Anthropic / Google Vertex | Intent classification, multilingual response drafting & Whisper transcription | US / Global (Zero-retention tier) |
| Google LLC | Calendar sync via Google Calendar OAuth | US / EU |
| Stripe, Inc. | Payment processing & subscription billing | US / EU |
| Dedicated Hostinger Cloud VPS | Encrypted PostgreSQL database, Redis queues & web application hosting | EU / US Tier-3 Datacenters |
05. Security Architecture & Multi-Tenant Isolation
We implement defense-in-depth measures to safeguard client data against unauthorized access:
- PostgreSQL Row-Level Security (RLS): Every query is strictly isolated by Organization ID, preventing cross-tenant leakage.
- Encryption in Transit & At Rest: All web traffic and API webhooks are encrypted using TLS 1.3 / HTTPS. Sensitive credentials and secrets are encrypted at rest with AES-256.
- Automated Backup & Failover: Daily snapshot backups with automated disaster recovery protocols.
06. Data Subject Rights (GDPR & CCPA)
Depending on your location, you have rights regarding your personal data, including the right to:
- Request access to copies of your personal data held by whatiha.
- Request correction of inaccurate or incomplete personal records.
- Request full erasure (“Right to be Forgotten”) of your account, chats, and contact lists.
- Withdraw consent or object to processing at any time.
To exercise these rights, submit a request to our Data Protection Officer at privacy@whatiha.ai. Requests are responded to within 30 days.
07. Contact Us
For inquiries regarding this Privacy Policy, data processing agreements, or security reviews, please contact:
whatiha.ai Systems Inc. — Data Privacy Office
Email: privacy@whatiha.ai
Security Response: security@whatiha.ai
Need a signed Data Processing Addendum (DPA)?
We provide standardized GDPR-compliant DPAs with EU Standard Contractual Clauses (SCCs).