Welcome to Wavvy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp Business automation platform.
1. Information We Collect
1.1 Account Information
When you register for Wavvy, we collect:
- Full name and username
- Email address
- Phone number (for verification purposes)
- Password (encrypted and securely stored)
1.2 WhatsApp Session Data
To provide our services, we process:
- WhatsApp session credentials and authentication tokens
- Contact information you import or create
- Message templates and campaign data
- Message logs and delivery status
- Media files you upload to our platform
1.3 Usage Information
We automatically collect:
- API usage statistics and request logs
- Platform activity and feature usage
- Device information and IP addresses
- Browser type and operating system
2. How We Use Your Information
We use the collected information to:
- Provide and maintain our WhatsApp automation services
- Process and deliver your messages through WhatsApp
- Manage your campaigns, templates, and contacts
- Monitor usage limits and enforce plan restrictions
- Provide customer support and respond to inquiries
- Improve our platform and develop new features
- Detect and prevent fraud or abuse
- Send important service updates and notifications
3. Data Storage and Security
We implement industry-standard security measures to protect your data:
- All passwords are encrypted using bcrypt hashing
- Database connections are secured with SSL/TLS
- Session data is stored securely with encryption
- API keys are generated using cryptographically secure methods
- Regular security audits and updates
- Access controls and authentication mechanisms
4. Data Sharing and Disclosure
We do not sell your personal information. We may share data only in these circumstances:
- WhatsApp/Meta: Message content is transmitted through WhatsApp's infrastructure to deliver your messages
- Service Providers: Third-party services that help us operate (e.g., cloud hosting, email delivery)
- Legal Requirements: When required by law or to protect our rights and safety
- Business Transfers: In connection with a merger, acquisition, or sale of assets
5. Third-Party Integrations
Our platform integrates with:
- WhatsApp Business Automation: For message delivery and session management via connected WhatsApp Web sessions
- AI Assistant Providers: OpenAI, Google Gemini, Anthropic Claude, and OpenRouter exclusively for WhatsApp customer service auto-replies (DeepSeek has been completely and permanently removed from our platform and infrastructure)
- Courier Services: Trax, Leopards, BlueEx, FastEx, and PostEx for automated order tracking
- Google API Services: For optional merchant authentication and Gmail sending functionality (described in detail below)
Each integration is subject to their respective privacy policies.
6. Google API & Gmail Data Policy (Limited Use)
Wavvy offers an optional integration with Google APIs (including Google OAuth and the Gmail API) to allow users to authenticate and enable merchants to send transactional order dispatch and courier tracking update emails directly from their connected Gmail account.
6.1 Data Accessed and Used
When you connect your Google account, Wavvy requests the minimum necessary scopes:
https://www.googleapis.com/auth/gmail.send: Used exclusively to send transactional courier tracking and order notification emails on your behalf from your connected Gmail address.https://www.googleapis.com/auth/userinfo.email & https://www.googleapis.com/auth/userinfo.profile: Used to identify your connected Google account and display your email address in the integration settings and allow secure sign-in.
Important Note on Access: Wavvy does not read, view, parse, index, or store your incoming emails or inbox messages. We only transmit outgoing emails that you or your automated workflows trigger.
6.2 Storage and Protection of Google User Data
- OAuth access and refresh tokens are stored securely in encrypted format and used solely to perform email sending requests authorized by you.
- We do not share, sell, or disclose your Google tokens or Google User Data to any third-party advertisers, data brokers, or external AI platforms.
6.3 Prohibition on AI Training
In strict compliance with Google Data Protection Policies:
- No Generalized AI Model Training: Google User Data obtained through Google APIs is never transferred, sent to, or used by any third-party AI provider (e.g., OpenAI, Anthropic, Google Gemini, or any other external AI service) to develop, create, improve, or train generalized artificial intelligence (AI) and/or machine learning (ML) models.
- No Human Inspection: Wavvy personnel and human reviewers do not read your email content or Google user data unless you have given explicit consent for troubleshooting, it is strictly necessary for security purposes (such as investigating system abuse), or required by applicable law.
6.4 Architectural Data Segregation: Complete Isolation from AI Features
Wavvy maintains complete, auditable architectural data segregation between Google API services and our AI assistant features:
- Independent Pipelines: Google OAuth and Gmail integrations exist exclusively within an isolated email notification and authentication pipeline. They are architecturally decoupled from all AI functionality.
- Scope of AI Features: Wavvy's AI features are strictly limited to customer auto-replies on WhatsApp chat sessions. The AI models only receive merchant-provided knowledge base prompts and customer WhatsApp chat text.
- Zero Google Data Access for AI: No Google User Data—including email addresses, profile data, outgoing email text, metadata, or OAuth tokens—is ever piped, routed, exposed, or transmitted to any AI model or LLM API.
- Permanent Removal of DeepSeek: In strict adherence to Google's Limited Use policy, DeepSeek has been completely eliminated from our application architecture, codebase, model catalogs, and API integrations.
6.5 Google API Limited Use Disclosure
Wavvy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6.6 Revocation and Deletion
You can disconnect your Google account at any time via your Wavvy dashboard settings or revoke access directly through Google Security Settings. Upon disconnection, your stored OAuth tokens are immediately and permanently deleted from our servers.
7. Your Rights and Choices
You have the right to:
- Access: Request a copy of your personal data
- Correction: Update or correct inaccurate information
- Deletion: Request deletion of your account and associated data
- Export: Download your contacts, templates, and campaign data
- Opt-out: Unsubscribe from marketing communications
8. Data Retention
We retain your data for as long as your account is active or as needed to provide services. When you delete your account:
- Personal information is permanently deleted within 30 days
- Session data and credentials are immediately removed
- Message logs may be retained for up to 90 days for legal compliance
- Anonymized usage statistics may be retained indefinitely
9. Cookies and Tracking
We use cookies and similar technologies to:
- Maintain your login session
- Remember your preferences
- Analyze platform usage and performance
- Prevent fraud and enhance security
You can control cookies through your browser settings. See our Cookie Policy for more details.
10. Children's Privacy
Wavvy is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.
11. International Data Transfers
Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting the new policy on this page
- Updating the "Last Updated" date
- Sending an email notification for material changes
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
- Email: privacy@wavvy.pk
- Registered Office: Borjan 3rd Floor, Flat Number 8, M.A Jinnah Road, Okara, Pakistan
- Support: Direct live chat or through your dashboard support portal