Privacy Policy

Effective date: October 15, 2026

This Privacy Policy explains how The Provider, a New York corporation doing business as Whatsgate (“Whatsgate”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal information in connection with:

• the website whatsgate.org;
• the Whatsgate account dashboard, APIs, webhooks, and related SaaS services;
• customer support, billing, security, and business operations.

This Policy also explains the distinction between personal information we process for our own purposes and information we process on behalf of business Customers.

Controller/business for website, account, billing, and business-operation data:

Privacy contact: service@whatsgate.org

Whatsgate is an independent, unofficial integration and is not affiliated with, endorsed by, sponsored by, or authorized by WhatsApp LLC, Meta Platforms, Inc., or their affiliates.

The Service may programmatically interact with WhatsApp Web or other third-party services through a session authorized by a Customer.

For personal information about account holders, website visitors, prospects, billing contacts, and support contacts, Whatsgate generally determines why and how the information is processed and acts as a controller or business under applicable privacy laws.

For personal information contained in messages, media, contacts, groups, recipient information, webhook payloads, and other Customer Content processed through the Service on a Customer's instructions, the Customer generally determines the purposes and means of processing and acts as the controller/business, while Whatsgate acts as a processor/service provider.

If you are an individual whose information appears in Customer Content, such as the recipient of a Customer's WhatsApp message, you should normally direct privacy requests to the business that communicated with you. We will assist our Customers with legally required requests as described in our Data Processing Addendum.

We may collect the following categories of information.

Customer Content may incidentally contain sensitive or special-category information depending on what Customers and their recipients send. Customers must not use the Service to process such information unless they have a valid legal basis and have implemented protections required by applicable law.

We collect information:

• directly from you when you create or manage an account, contact us, purchase a plan, or configure the Service;
• automatically when you use our website, APIs, dashboard, and infrastructure;
• from payment processors, fraud/security providers, analytics providers, and other service providers;
• from third-party accounts and services that you intentionally connect or authorize;
• from your organization or account administrator if they create or administer your account.

We use personal information to:

• provide, operate, authenticate, maintain, and support the Service;
• establish and maintain Customer-authorized sessions and integrations;
• transmit messages, media, webhook events, and API responses as instructed by Customers;
• create and administer accounts and subscriptions;
• process payments, invoices, taxes, renewals, refunds, and payment failures;
• provide customer support and troubleshoot technical issues;
• detect, investigate, and prevent fraud, spam, abuse, security incidents, and violations of our Terms;
• protect recipients, Customers, our infrastructure, third parties, and legal rights;
• monitor performance, reliability, and product usage;
• improve and develop the Service using information that we are permitted to use for that purpose;
• send operational messages about accounts, billing, security, incidents, and Service changes;
• send marketing communications where permitted by law and subject to applicable opt-out or consent requirements;
• comply with legal, tax, accounting, sanctions, regulatory, and law-enforcement obligations;
• establish, exercise, or defend legal claims.

We do not use Customer message content to create advertising profiles for recipients, and we do not sell Customer Content.

Where EEA or UK data-protection law applies and Whatsgate acts as controller, we rely on one or more of the following legal bases:

• Contract: processing necessary to enter into or perform our agreement with you.
• Legitimate interests: operating and securing the Service, preventing abuse, improving reliability, supporting Customers, and protecting our business and users, where those interests are not overridden by your rights.
• Legal obligation: processing required to comply with law, accounting, tax, sanctions, regulatory, or lawful disclosure obligations.
• Consent: where required, including for certain non-essential cookies, analytics, advertising technologies, or marketing communications.

Where Whatsgate acts as processor, the Customer is responsible for identifying an appropriate legal basis for Customer Content.

We use cookies and similar technologies as described in our Cookie Policy.

Where applicable law requires consent, non-essential cookies are not intended to be activated until the user has provided the required consent.

You can manage choices through the “Cookie Settings” control and, where applicable, the options described on Your Privacy Choices.

Payments may be processed by third-party payment processors.

When you enter payment information on a hosted payment page, the payment processor receives and processes that information under its own terms and privacy policy. We may receive transaction identifiers, payment status, billing details, card brand and last digits, fraud/risk indicators, subscription information, and similar data required to administer your account.

We do not use payment information for unrelated marketing purposes.

We may disclose personal information to:

• hosting, infrastructure, database, monitoring, email, support, security, and other vendors that process information to provide services to us;
• payment, billing, tax, and fraud providers for transactions and related compliance;
• Customer-directed recipients and integrations, including webhook endpoints and systems that the Customer configures;
• professional advisers, including attorneys, accountants, auditors, and insurers;
• government authorities, regulators, courts, or law enforcement where required or lawfully necessary;
• a buyer, investor, successor, or other transaction party in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections;
• other parties when you direct us to disclose information or provide valid consent.

A current list of material subprocessors used for Customer Personal Data should be maintained at: Subprocessors and Service Providers

We do not disclose Customer Content to data brokers for their own marketing purposes.

We do not sell Customer Content.

We do not sell personal information for monetary consideration.

If we use advertising or analytics technologies in a manner that is legally treated as “sale”, “sharing”, or targeted/cross-context behavioral advertising under an applicable U.S. state privacy law, eligible users may opt out through Your Privacy Choices and supported browser-based opt-out signals such as Global Privacy Control where legally required.

Whatsgate is operated by a U.S. corporation, and personal information may be processed in the United States and other countries where our service providers operate.

Where applicable law requires safeguards for international transfers, we use legally recognized transfer mechanisms appropriate to the circumstances. These may include contractual safeguards such as the European Commission's Standard Contractual Clauses and applicable UK transfer terms.

For Customer Personal Data, additional transfer terms may be set out in our Data Processing Addendum.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, resolving disputes, enforcing agreements, and complying with legal, accounting, and tax obligations.

Typical retention considerations include:

• account/profile information — while the account is active and for a reasonable period after closure;
• billing, invoice, transaction, and tax records — for the period required by applicable accounting, tax, and legal rules;
• security and technical logs — for periods reasonably necessary to investigate incidents, maintain reliability, and prevent abuse;
• support communications — for as long as reasonably needed to resolve issues and maintain business records;
• Customer Content, message-related data, media, and session data — Message content and webhook payloads may be retained for up to 7 days where necessary for delivery, retries, synchronization, troubleshooting, security, and service reliability. Media files may be temporarily cached for up to 24 hours where necessary for message delivery, processing, retries, or synchronization. Message delivery, status, and related operational metadata may be retained for up to 30 days for troubleshooting, abuse prevention, security, and service reliability. Connected-account session data, authentication data, and credentials required to maintain the integration are retained while the applicable integration remains active and may be retained for up to 7 days after the integration is disconnected, after which they are deleted or invalidated. Upon account termination, Customer Content remaining in active production systems is deleted according to the retention periods described above. Residual copies may remain in encrypted backups for up to 30 additional days before being overwritten in the ordinary backup cycle. Backup copies are not restored except where necessary for disaster recovery, security, or legal compliance..

Backups may persist for a limited period after deletion before being overwritten in the ordinary backup cycle.

If law, litigation, an investigation, fraud prevention, a security incident, or a valid preservation request requires longer retention, we may retain relevant information for the required period.

We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include access controls, authentication controls, encrypted network transport, infrastructure isolation, logging, monitoring, backup controls, and vulnerability/security management appropriate to the nature of the Service.

No internet service can guarantee absolute security. You are responsible for protecting your own credentials, API keys, endpoints, connected accounts, and systems.

Depending on your location and applicable law, you may have rights to:

• access or obtain a copy of personal information;
• correct inaccurate information;
• request deletion;
• restrict or object to certain processing;
• receive portable data where applicable;
• withdraw consent where processing is based on consent;
• opt out of certain sale/sharing or targeted advertising where applicable;
• appeal certain privacy-request decisions where applicable;
• lodge a complaint with a competent privacy or data-protection authority.

To submit a request concerning information for which Whatsgate acts as controller, contact service@whatsgate.org.

We may need to verify your identity and authority before completing a request. We will respond within the period required by applicable law.

If your request concerns Customer Content controlled by one of our Customers, we may direct you to that Customer and assist the Customer as required.

If GDPR or UK GDPR applies, you may have the rights described above, including the right to object to direct marketing and, in certain circumstances, processing based on legitimate interests.

You may lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred.

If we appoint an EU or UK representative under applicable law, current representative contact details will be published in this Policy or on a dedicated privacy page.

Residents of certain U.S. states may have additional rights, subject to statutory scope, thresholds, exemptions, and verification requirements.

Details and opt-out methods are provided at Your Privacy Choices.

We do not discriminate against you for exercising rights granted by applicable privacy law.

The Service is designed for business and professional users and is not directed to children.

You must be at least 18 years old and legally capable of entering into a binding agreement to create an account.

We do not knowingly collect personal information directly from children through account registration.

Our website and Service may link to or interoperate with third-party services.

Their privacy practices are governed by their own policies. Connecting a third-party account instructs us to exchange information with that service as necessary for the requested integration.

We are not responsible for independent privacy practices of third parties.

We may update this Privacy Policy to reflect changes in law, technology, vendors, or our practices.

We will post the updated version with a new effective date. If a change materially affects how we use information, we will provide additional notice where required by law.

Privacy questions and requests:
Email: service@whatsgate.org