This Privacy Policy has been structured to comply with Brazil’s General Data Protection Law (LGPD), the European Union’s General Data Protection Regulation (GDPR), the UK GDPR, and, where applicable, privacy laws of other jurisdictions such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), Colombia’s Law 1581 of 2012, Argentina’s Law 25.326, Chile’s Law 19.628, and Uruguay’s Law 18.331.
The specific application of each law depends on factors such as the data subject's place of residence, the location of collection, the purpose of processing, Whatsplaid's role in the operation, and the contractual relationship with our clients.
1. Overview
This Policy explains how Whatsplaid handles personal data on its website, platform, applications, APIs, integrations, forms, support channels, business activities, marketing communications, and services related to customer support, sales, automation, and artificial intelligence for WhatsApp.
Personal data are information that identify or may identify a natural person, directly or indirectly. Depending on applicable law, they may also include online identifiers, browsing data, device information, geolocation, and inferences associated with a person or consumer.
By using our services, hiring Whatsplaid, accessing our channels or interacting with our forms, you acknowledge that your personal data may be processed in accordance with this Policy and with the applicable contracts, terms of use, specific notices and consent preferences.
2. Who we are
We are Whatsplaid, a platform that provides solutions for customer support, sales, lead capture, shared inbox, tickets, CRM, automations, AI agents, knowledge base, reporting, and integrations with third-party systems, especially connected to WhatsApp.
IN2, LLC
7345 W Sand Lake RD,
STE 210 Office 4761
Orlando, FL 32819 US
You can contact us by email at support@whatsplaid.com. For data protection matters, please use the contacts provided in the “Contact and Data Protection Officer” section.
3. Whatsplaid Roles
Whatsplaid may act in different roles depending on the processing context.
3.1. Whatsplaid as controller
Whatsplaid acts as a controller when it determines the purposes and means of processing, for example in activities such as its own marketing, sales, commercial service, support, billing, customer relationship management, website security, administrative management, compliance with legal obligations, and analysis of the use of our channels.
3.2. Whatsplaid as operator or processor
Whatsplaid acts as a data controller, processor, or service provider when it processes personal data on behalf of a client company that uses the platform to operate support, sales, automations, campaigns, messages, tickets, CRM, AI agents, knowledge base, integrations, and communications with end consumers.
In such cases, the client company is generally the data controller for its end customers. Whatsplaid processes that data according to the client's contractual instructions and in accordance with the features configured on the platform.
3.3. Customer responsibilities
Whatsplaid customers must inform their end consumers about the use of the platform, obtain necessary legal bases or consents, maintain their own privacy policies, configure campaign rules lawfully, and respond to data subject requests when they are data controllers.
4. Processed Data
The data processed varies depending on platform usage, the channels used, the customer's settings, and the applicable legislation.
4.1. Identification and contact details
- First name, last name, email, phone, WhatsApp, tax ID when required, and professional contact details.
- Company, position, industry, business address, country, language and information required for commercial service.
4.2. Account, contract and billing data
- Registration data, credentials, user permissions, access logs, subscribed plan, support history and contractual information.
- Payment data, billing, invoices, refunds, fraud prevention, and compliance with tax and accounting obligations.
4.3. End-customer data processed on the platform
- End-customer data submitted or imported by client companies, such as name, email, phone number, identifiers, conversations, messages, purchases, orders, tickets, leads, preferences, customer service history and interactions.
- Data coming from integrations with WhatsApp, e‑commerce, CRM, ERP, APIs, widgets, spreadsheets, documents, imports and communication channels configured by the customer.
4.4. Technical data, navigation and device
- IP address, device identifiers, browser, operating system, pages visited, traffic source, usage events, security logs and cookies.
- Approximate or precise geolocation when enabled by the user, by the client, or required for a specific feature based on applicable legal grounds.
4.5. Sensitive data
Whatsplaid does not generally request sensitive personal data. If a customer enters sensitive data on the platform or configures processing that involves such data, they must ensure an appropriate legal basis and provide instructions that comply with applicable law.
5. Purposes and legal bases
We process personal data for specific purposes and on an appropriate legal basis in accordance with applicable law.
5.1. Marketing and prospecting
We may process data to respond to forms, send communications, display products, segment campaigns, measure ad performance, and provide content related to Whatsplaid.
Possible legal bases: consent, legitimate interest, performance of pre-contractual measures, or equivalent bases under applicable jurisdiction. Where required, promotional communications will rely on consent or an opt-out mechanism.
5.2. Commercial support and contracting
We process data to respond to inquiries, prepare proposals, execute contracts, grant access to the platform, manage plans, carry out billing, collections, refunds, support, and customer relationship management.
Possible legal bases: performance of a contract or pre-contractual measures, legitimate interest, legal obligation, and the regular exercise of rights.
5.3. Platform operation for customers
We process end-customer data to provide features configured by clients, such as registration, support, inbox, tickets, CRM, lead capture, automations, AI agents, knowledge base, reports, communications, and integrations.
When we act as an operator/processor, the legal basis is determined by the controller client. Whatsplaid processes the data according to the contract, the client’s instructions, and applicable security measures.
5.4. Security, fraud prevention and improvement
We may process technical data and logs to protect accounts, detect unauthorized access, prevent abuse, maintain platform integrity, monitor availability, fix issues, improve features, and generate aggregated metrics.
Possible legal bases: legitimate interest, legal obligation, contract performance, protection of rights and, when required, consent.
5.5. Legal and Regulatory Obligations
We may process and retain data to comply with tax, accounting, and regulatory laws, court orders, requests from authorities, audits, the prevention of unlawful acts, and the defense of administrative, judicial, or arbitral proceedings.
6. Cookies and similar technologies
We use cookies and similar technologies for site functionality, security, preferences, usage analytics, campaign measurement and, where applicable, advertising.
6.1. What are cookies?
Cookies are small files stored in the browser or on the device. They can identify a session, remember preferences, measure interactions, or enable essential features.
6.2. Cookie categories
- Essentials: necessary for the website's functioning, security, session, and correct display.
- Preferences: used to remember the user's language, region, and choices.
- Analytics: used to understand navigation, performance, and usage of the services.
- Marketing: used for measuring campaigns, remarketing, and ad personalization, when applicable.
6.3. Examples of cookies
- PHPSESSID: used for session and basic website functionality.
- _ga used by Google tools for analytics and measurement when enabled.
- _fbp: used by Meta/Facebook tools for measurement and advertising, when enabled.
6.4. Consent and preferences
In regions where the law requires prior consent for non-essential cookies, Whatsplaid will seek to obtain consent before enabling analytical or marketing cookies. You can also manage cookies in your browser, block cookies, or delete existing cookies.
7. Sharing and subprocessors
We may share personal data with vendors, processors, subprocessors, and partners when necessary to provide, protect, operate, measure, or improve the services.
7.1. Recipient categories
- Infrastructure, hosting, cloud computing, storage, backup and security providers.
- Communication tools, email, WhatsApp, customer service, CRM, automation, artificial intelligence and support.
- Payment providers, billing, tax issuance, accounting and legal.
- Analytics tools, ad measurement, fraud prevention and uptime monitoring.
- Integrations configured by the customer, such as e-commerce, CRM, ERP, spreadsheets, documents, gateways, third‑party APIs, and messaging providers.
- Public authorities, courts or regulators when required by law or necessary to defend rights.
7.2. End-customer data
When Whatsplaid acts as a processor/handler, disclosures related to end consumer data follow the controller customer's instructions, the platform settings, and the applicable contracts.
7.3. Sale or sharing for behavioral advertising
Whatsplaid does not sell personal data in the ordinary sense of selling it for money. Some laws, such as the California CCPA/CPRA, may define “sale” or “sharing” broadly to include certain uses of cookies, pixels, and behavioral advertising. Where applicable, Whatsplaid will provide mechanisms for choice, opt-out, or preference management.
8. International transfers
Whatsplaid may process, store, or transfer personal data to countries different from the one where the data subject is located, including due to cloud infrastructure, support tools, analytics, communications, payments, integrations, and international vendors.
When required by applicable law, we will adopt appropriate mechanisms for international transfers, such as standard contractual clauses, contracts with processors/subprocessors, adequacy decisions, technical and organizational safeguards, or other mechanisms recognized by the applicable law.
Customers using the platform to process end consumers' data should assess their own obligations regarding international transfer, especially when configuring integrations, imports, exports, automations, AI agents, or their own subprocessors.
9. Retention and security
9.1.
We will retain personal data for as long as necessary to fulfill the purposes described in this Policy, provide services, perform contracts, meet legal obligations, resolve disputes, protect rights, maintain security, prevent fraud, and comply with tax, accounting, or regulatory requirements.
When we act as the operator/processor, data retention on the platform may depend on the controller client's settings, the applicable contract, backups, technical logs, and legal obligations.
Anonymized or aggregated data, without a reasonable possibility of identifying an individual, may be retained for an indefinite period.
9.2. Security
We have implemented technical and organizational measures designed to protect personal data against unauthorized access, destruction, loss, alteration, disclosure or improper processing. These measures may include access controls, logs, incident management, backups, environment segregation, monitoring, encryption where applicable, and internal security procedures.
No system is absolutely secure. If a security incident occurs that may cause a relevant risk or harm, we will evaluate the notification obligations to data subjects, customers, competent authorities and other affected parties in accordance with applicable law.
10. Rights of data subjects
Depending on applicable law and Whatsplaid’s role in processing, you may exercise rights related to your personal data, such as:
- Confirm whether we process your personal data.
- Access the personal data processed.
- Correct incomplete, inaccurate, or outdated data.
- Request anonymization, blocking, or deletion of unnecessary, excessive, or improperly processed data.
- Request portability, when applicable.
- Withdraw consent and obtain information about the consequences of refusal.
- Object to certain treatments, where applicable.
- Request restriction of processing, when applicable.
- Request information about sharing and recipients.
- Submit a complaint to the competent authority.
When Whatsplaid acts as an operator/processor on behalf of a client, we may forward your request to the client controller or assist you in responding, in accordance with the contract and applicable law.
11. Rights by region
11.1. Brazil - LGPD
If the LGPD applies, you may exercise the rights provided for in Law No. 13,709/2018, including confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, information about the consequences of refusing consent, withdrawal of consent, and filing a petition with the National Data Protection Authority (ANPD).
11.2. European Economic Area and United Kingdom - GDPR and UK GDPR
If the GDPR or UK GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and to lodge a complaint with the competent supervisory authority.
When Whatsplaid is subject to the GDPR or UK GDPR in relation to a specific processing activity, we will inform you of the applicable legal bases, the recipients or categories of recipients, the retention criteria, relevant international transfers and the applicable safeguards.
11.3. California - CCPA/CPRA
If California law applies to you and the activity in question, you may have the right to know which categories of personal data we collect, the sources, purposes, categories of third parties, the right to access, correct, delete, limit the use of sensitive personal information, opt out of sale or sharing, and not be discriminated against for exercising these rights.
Whatsplaid does not sell personal data for money. If cookies, pixels, or similar technologies are deemed “sharing” or “sale” under applicable law, we will provide appropriate opt-out mechanisms when required.
11.4. Mexico - LFPDPPP
If the Ley Federal de Protección de Datos Personales en Posesión de los Particulares of Mexico (LFPDPPP) applies, you may exercise rights of access, rectification, cancellation and objection to the processing of your personal data, as well as revoke consent, limit the use or disclosure of the data and file a complaint with the competent authority, in accordance with applicable law.
11.5. Colombia - Law 1581 of 2012
If Colombia’s Ley 1581 de 2012 applies, you may have the rights to know, update, rectify, request proof of authorization, be informed about the use of the data, revoke authorization, request deletion where applicable, access your data free of charge, and file a complaint with the competent authority.
11.6. Argentina - Law 25.326
If Argentina’s Law 25.326 applies, you may exercise rights of access, rectification, updating, deletion, confidentiality and actions for the protection of personal data or habeas data, in accordance with applicable law.
11.7. Chile - Law 19.628
If Chile's Law 19.628 applies, you may request information about your personal data, its origin, recipients and purpose, as well as request modification, cancellation, deletion or blocking where applicable, in accordance with applicable law.
11.8. Uruguay - Law 18.331
If Uruguay's Law 18.331 applies, you may exercise rights of access, rectification, updating, inclusion, deletion, challenge of personal valuations, information on data disclosures, and habeas data actions, in accordance with applicable law.
11.9. Other jurisdictions
Users in other regions may have additional rights under local privacy and data protection laws. Whatsplaid will evaluate requests in accordance with the laws applicable to the specific processing.
12. Children and teenagers
Whatsplaid’s services are not directed at children. We do not knowingly seek to collect children’s personal data for our own marketing purposes.
When Whatsplaid customers set up programs, campaigns, or registrations that involve minors, the controller customer must ensure an appropriate legal basis, obtain parental/guardian consent where required, and comply with applicable law.
13. Automation, profile, and AI
The Whatsplaid platform can enable automations, segmentations, communication workflows, automated support, lead qualification, AI agents, knowledge-based responses, conversation routing, tickets, profile-based campaigns, and client-configured reports.
These features may use transactional data, messages, conversation history, purchasing behavior, engagement, preferences, documents, knowledge bases, and operational events to generate communications, responses, reports, or automated actions.
When Whatsplaid acts as a data controller/processor, the client company is responsible for configuring these automations in a manner compliant with applicable law, including providing information to data subjects, identifying legal bases, offering opt-out options, and conducting a data protection impact assessment when necessary.
Whatsplaid may also use aggregated, anonymized, or operational data to improve products, security, support, abuse detection, platform quality, and business intelligence.
14. Contact and data protection officer
For questions, requests, or to exercise rights related to personal data, please contact us.
Support: support@whatsplaid.com
Data Controller: Josué Felipe Garcia
Data protection officer email: lgpd@josuegarcia.com.br
When you submit a request, we may ask for additional information to verify your identity, locate the data, identify the applicable controller, and prevent unauthorized access to third-party data.
15. Updates
We may update this Privacy Policy periodically to reflect legal, regulatory, operational, technical, contractual, or product changes.
When a change is material, we may communicate it via the website, platform, email, in-account notice, or another appropriate channel. The most recent version will be available on this page.