whatconnector Privacy Policy
DRAFT. A lawyer qualified in Chile must review this before it goes into production. Text in [BRACKETS] is a placeholder. This draft follows Chilean Law 19,628 on the Protection of Private Life, as amended by Law 21,719 (in force from December 1, 2026, unless postponed by law [VERIFY BEFORE PUBLISHING]), and the basic principles of the EU General Data Protection Regulation (GDPR).
Last updated: [DATE]
1. Controller
[LEGAL NAME], RUT [RUT], located at [ADDRESS], Chile. Privacy contact: [PRIVACY EMAIL]. [If required under the GDPR: EU representative: [NAME/ADDRESS]. LAWYER TO REVIEW whether this is required.]
2. Two different roles
- Your account data (sign-up, billing, use of the Service): we are the controller.
- Your WhatsApp chat content (messages, media, names and numbers of your contacts): you decide which chats to connect and which AI Agents can access them. For that content we act as a processor: we process it only on your behalf and according to your instructions (your permission settings and plan), and you are responsible to your contacts (see section 8). [LAWYER TO REVIEW the role allocation under Law 21,719 and the GDPR.]
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | name, email, password (hashed), time zone | You |
| Billing | plan, subscription status, country, last 4 card digits (full payment details are handled by the payment provider and we do not store them) | You / [PAYMENT PROCESSOR] |
| WhatsApp session | linked-device cryptographic keys, account identifier, phone number | Your phone, when you link it |
| Chat content | text messages, metadata (time, sender, chat), media (Pro plan only), contact and group names and numbers | WhatsApp, through your account |
| Integrations | connected AI Agents, MCP/API tokens (encrypted or hashed), per-chat permissions | You |
| Technical | IP address, access and error logs, user agent | Automatic |
We do not seek to process sensitive data. However, your chats may contain it (health, political opinions, etc.) because of what you or your contacts share. We process it only to provide the Service, with the same security measures.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service: syncing and storing chats and making them available to your AI Agents according to your permissions | Performance of contract |
| Billing, invoicing and tax obligations | Contract / legal obligation |
| Security, abuse prevention (spam, fraud) and enforcing the Acceptable Use Policy | Legitimate interest / legal obligation |
| Service communications (notices of changes, incidents, billing) | Contract |
| Marketing communications | Consent (you can withdraw it at any time) |
We do not sell your data. We do not use it to train AI models or for advertising. We do not read your chats except when strictly necessary for support you request, for security, or because the law requires it, and in those cases access is logged.
5. Retention and automatic deletion
| Plan | Text | Media |
|---|---|---|
| Free | 7 days | Not stored |
| Basic | 30 days | Not stored |
| Pro | 1 year | 30 days |
| "Unlimited history" add-on | While the add-on is active | Per plan |
- Content is automatically deleted when its period expires, in cycles of up to [24 hours].
- When you cancel or close your account, chats, session data and tokens are deleted within [30] days, and encrypted backups within a further [30] days.
- Billing records are kept for as long as tax law requires (in Chile, generally up to [6] years [VERIFY WITH ACCOUNTANT]).
- Technical logs are kept for up to [90] days.
- You can unlink the device from WhatsApp (Linked devices) or from your dashboard at any time. From that moment we stop receiving new messages.
6. Who we share data with
- AI Agents you connect and their providers (for example, language model providers): they receive only the chats and actions you authorize. They are independent third parties governed by their own policies, and sharing with them is your choice.
- Infrastructure providers (processors): hosting/VPS [PROVIDER, SERVER COUNTRY/REGION], backups [PROVIDER], transactional email [PROVIDER].
- Payment processor / Merchant of Record: [NAME, COUNTRY], acting as an independent controller for payment data.
- Authorities, when the law or a court order requires it.
- WhatsApp/Meta: because of how the Service works, your linked client communicates with WhatsApp's servers like any other linked device.
We will keep an up-to-date list of sub-processors at [URL].
7. International transfers
Our servers are located in [COUNTRY], and some providers may be outside Chile or your country. When we transfer data to countries without an adequate level of protection, we will use the safeguards required by applicable law, such as standard contractual clauses [LAWYER TO REVIEW under Law 21,719 and the GDPR].
8. Your contacts (third parties)
Your contacts' messages are their personal data. You are responsible for informing them and, where required, obtaining their consent before you connect their chats to the Service or to AI Agents. If a contact asks us to exercise their rights, we will refer them to you and help you respond. Where necessary, we may delete or restrict that content.
9. Security
Encryption in transit (TLS), encryption at rest for session keys and tokens, least-privilege access control, administrative access logs, encrypted backups and per-user isolation [ADJUST TO ACTUAL IMPLEMENTATION]. No system is 100% secure. If a breach affects your data, we will notify you and, where required, the Chilean Personal Data Protection Agency (Agencia de Protección de Datos Personales) or the competent authority, within the legal deadlines.
10. Your rights
Under Law 19,628 as amended by Law 21,719 and, if you are in the EU/EEA or the UK, the GDPR, you have the rights of access, rectification, erasure, objection, portability and blocking (restriction), and the right not to be subject to decisions based solely on automated processing that significantly affect you. Where processing is based on consent, you may withdraw it.
Write to [PRIVACY EMAIL]. We will respond within [30] calendar days [VERIFY the statutory deadline under Law 21,719]. You can do many of these things yourself from the dashboard (export or delete data, unlink).
If you are not satisfied, you may complain to Chile's Personal Data Protection Agency or to the supervisory authority in your country (in the EU, the authority of your Member State).
11. Children
The Service is not directed to anyone under 18, and we do not knowingly collect their data.
12. Cookies
We use only strictly necessary cookies for sessions and security. [If analytics are added: name the tool and the consent mechanism.]
13. Changes
We will give at least [15] days' notice of material changes by email or in the dashboard.
14. Contact
[LEGAL NAME] · RUT [RUT] · [ADDRESS] · [PRIVACY EMAIL]
whatconnector is not affiliated with WhatsApp LLC or Meta Platforms, Inc.