Effective date: October 15, 2026
This Privacy Policy explains how The Provider, a New York corporation doing business as Whatsgate (“Whatsgate”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal information in connection with:
This Policy also explains the distinction between personal information we process for our own purposes and information we process on behalf of business Customers.
Controller/business for website, account, billing, and business-operation data:
Privacy contact: service@whatsgate.org
Whatsgate is an independent, unofficial integration and is not affiliated with, endorsed by, sponsored by, or authorized by WhatsApp LLC, Meta Platforms, Inc., or their affiliates.
The Service may programmatically interact with WhatsApp Web or other third-party services through a session authorized by a Customer.
For personal information about account holders, website visitors, prospects, billing contacts, and support contacts, Whatsgate generally determines why and how the information is processed and acts as a controller or business under applicable privacy laws.
For personal information contained in messages, media, contacts, groups, recipient information, webhook payloads, and other Customer Content processed through the Service on a Customer's instructions, the Customer generally determines the purposes and means of processing and acts as the controller/business, while Whatsgate acts as a processor/service provider.
If you are an individual whose information appears in Customer Content, such as the recipient of a Customer's WhatsApp message, you should normally direct privacy requests to the business that communicated with you. We will assist our Customers with legally required requests as described in our Data Processing Addendum.
We may collect the following categories of information.
| Category | Examples |
|---|---|
| Account and profile information | Name, business name, email address, phone number, username, account identifiers, preferred language, account settings |
| Billing and transaction information | Billing name and address, tax status, tax identification number, subscription plan, invoices, payment status, transaction identifiers, limited payment-method metadata received from payment processors |
| Payment information handled by processors | Payment-card or bank information entered into a payment processor. Whatsgate generally does not receive the complete card number or card security code when hosted payment processing is used |
| Device and technical information | IP address, browser type, operating system, device information, timestamps, request identifiers, log data, authentication and security events |
| Usage information | API usage, feature usage, session status, errors, performance information, rate-limit events, account activity |
| Support and communications | Support requests, emails, chat messages, feedback, diagnostic information you provide |
| Customer Content | Message text, message metadata, phone numbers, contact names and identifiers, group information, media and files, webhook URLs and payloads, delivery/status events, and other data processed through connected accounts |
| Session and integration data | Session identifiers, authentication state, QR/code authorization data, connected account identifiers, callback/webhook configuration, technical credentials required to maintain a Customer-authorized connection |
| Cookie and analytics information | Consent choices, cookie identifiers, analytics events, attribution information where enabled and lawfully permitted |
Customer Content may incidentally contain sensitive or special-category information depending on what Customers and their recipients send. Customers must not use the Service to process such information unless they have a valid legal basis and have implemented protections required by applicable law.
We collect information:
We use personal information to:
We do not use Customer message content to create advertising profiles for recipients, and we do not sell Customer Content.
Where EEA or UK data-protection law applies and Whatsgate acts as controller, we rely on one or more of the following legal bases:
Where Whatsgate acts as processor, the Customer is responsible for identifying an appropriate legal basis for Customer Content.
We use cookies and similar technologies as described in our Cookie Policy.
Where applicable law requires consent, non-essential cookies are not intended to be activated until the user has provided the required consent.
You can manage choices through the “Cookie Settings” control and, where applicable, the options described on Your Privacy Choices.
Payments may be processed by third-party payment processors.
When you enter payment information on a hosted payment page, the payment processor receives and processes that information under its own terms and privacy policy. We may receive transaction identifiers, payment status, billing details, card brand and last digits, fraud/risk indicators, subscription information, and similar data required to administer your account.
We do not use payment information for unrelated marketing purposes.
We may disclose personal information to:
A current list of material subprocessors used for Customer Personal Data should be maintained at: Subprocessors and Service Providers
We do not disclose Customer Content to data brokers for their own marketing purposes.
We do not sell Customer Content.
We do not sell personal information for monetary consideration.
If we use advertising or analytics technologies in a manner that is legally treated as “sale”, “sharing”, or targeted/cross-context behavioral advertising under an applicable U.S. state privacy law, eligible users may opt out through Your Privacy Choices and supported browser-based opt-out signals such as Global Privacy Control where legally required.
Whatsgate is operated by a U.S. corporation, and personal information may be processed in the United States and other countries where our service providers operate.
Where applicable law requires safeguards for international transfers, we use legally recognized transfer mechanisms appropriate to the circumstances. These may include contractual safeguards such as the European Commission's Standard Contractual Clauses and applicable UK transfer terms.
For Customer Personal Data, additional transfer terms may be set out in our Data Processing Addendum.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, resolving disputes, enforcing agreements, and complying with legal, accounting, and tax obligations.
Typical retention considerations include:
Backups may persist for a limited period after deletion before being overwritten in the ordinary backup cycle.
If law, litigation, an investigation, fraud prevention, a security incident, or a valid preservation request requires longer retention, we may retain relevant information for the required period.
We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.
These measures may include access controls, authentication controls, encrypted network transport, infrastructure isolation, logging, monitoring, backup controls, and vulnerability/security management appropriate to the nature of the Service.
No internet service can guarantee absolute security. You are responsible for protecting your own credentials, API keys, endpoints, connected accounts, and systems.
Depending on your location and applicable law, you may have rights to:
To submit a request concerning information for which Whatsgate acts as controller, contact service@whatsgate.org.
We may need to verify your identity and authority before completing a request. We will respond within the period required by applicable law.
If your request concerns Customer Content controlled by one of our Customers, we may direct you to that Customer and assist the Customer as required.
If GDPR or UK GDPR applies, you may have the rights described above, including the right to object to direct marketing and, in certain circumstances, processing based on legitimate interests.
You may lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred.
If we appoint an EU or UK representative under applicable law, current representative contact details will be published in this Policy or on a dedicated privacy page.
Residents of certain U.S. states may have additional rights, subject to statutory scope, thresholds, exemptions, and verification requirements.
Details and opt-out methods are provided at Your Privacy Choices.
We do not discriminate against you for exercising rights granted by applicable privacy law.
The Service is designed for business and professional users and is not directed to children.
You must be at least 18 years old and legally capable of entering into a binding agreement to create an account.
We do not knowingly collect personal information directly from children through account registration.
Our website and Service may link to or interoperate with third-party services.
Their privacy practices are governed by their own policies. Connecting a third-party account instructs us to exchange information with that service as necessary for the requested integration.
We are not responsible for independent privacy practices of third parties.
We may update this Privacy Policy to reflect changes in law, technology, vendors, or our practices.
We will post the updated version with a new effective date. If a change materially affects how we use information, we will provide additional notice where required by law.
Privacy questions and requests:
Email: service@whatsgate.org