Privacy Policy

1. Roles and responsibilities

Responsibility for organizing the processing of website data, inquiries and account services lies with Wacallio — referred to below as “we” or “the service.”

The organization connecting business WhatsApp accounts determines the purposes of customer communication, its users, employee access and rules for handling conversation content. For this data, Wacallio provides the technical environment and acts within the authority granted to it. The parties’ specific responsibilities depend on the nature of the processing, the service terms and applicable law.

This policy supplements Wacallio’s service terms. Use of WhatsApp and other external services is also governed by the respective providers’ documents.

2. Data we process

• Inquiries and requests: name, company, preferred contact details, approximate number of accounts, hosting option, message and consent record.
• Website accounts: name, company details, email address and information used for login, account recovery and verification of authority.
• Business accounts: phone numbers, WhatsApp identifiers, account names, contacts and information about connected employees and supervisors.
• Communication content: chats, attachments, voice messages and other materials shared through connected accounts. Where the relevant features are used, this also includes call information and audio recordings.
• Service information: call times and statuses, participant details, connection events, recording consent, access settings, balance information and service transactions.
• Technical information: network address, browser and device parameters, request times, error details and security events generated when using the website, infrastructure and service.

The data involved depends on the features you use. Do not include passwords, access codes, full payment card details or other information unnecessary for your request in inquiry messages.

3. Why we process data

• Responding to inquiries, choosing hosting and arranging Wacallio setup.
• Creating accounts, login, account recovery and managing team permissions.
• Delivering messages and materials, enabling calls, conferences and employee support.
• Recording and reviewing conversations when these features are enabled and the necessary legal basis exists.
• Tracking service usage, managing balances and fulfilling contractual obligations.
• Diagnosing errors, preventing unauthorized access and maintaining service availability.

Inquiry data is used to respond to your request and assist with setup. Consent to process an inquiry does not, by itself, constitute consent to marketing emails.

4. Legal bases for processing

The legal basis depends on the purpose of processing and applicable law. Depending on the situation, it may be user consent, responding to a pre-contract request, performing a contract, a legal obligation or a permitted legitimate interest in service security and operation.

Where consent is required, it is confirmed through a separate action, such as selecting a checkbox or confirming a notice. Visiting the website alone is not treated as consent to every possible form of processing. The customer organization is responsible for establishing the necessary legal bases to process employee and conversation participant data.

5. Chats, calls and recordings

To provide chats and calls, a Wacallio account connects as a linked WhatsApp device. The workspace receives and processes the data available to that device to display it in the interface and provide features to authorized team members.

When recording is enabled, employees confirm consent before making calls. Confirmation is linked to the account and number, with the date and time saved. Participants hear an audible notice when recording starts and when new participants join. Video calls are saved as audio; the employee’s and the other party’s audio channels are recorded separately.

Employees can see recording activity and supervisor connections in the interface. The customer organization decides who may listen to, download and use recordings. An audible notice and employee consent do not replace the necessary notices and legal bases for processing other participants’ data.

The application’s current recording terms cover internal employee conversations. Recording customer conversations requires separate agreement and updates to the relevant terms.

6. Website forms and authentication

Form fields are validated in the browser before submission. Inquiry submission, signup, login and account recovery use the corresponding server-side handler when it is connected. If it is not connected, the interface reports this and does not display a successful submission or login.

Required fields are needed to perform the selected action. Optional information helps clarify your needs and is provided at your discretion.

7. Cookies and external resources

During login, the website server uses a technical cookie containing a session identifier to keep you signed in. Your password is not stored in this cookie. Sessions last up to 12 hours without Remember me, or 30 days with it. Changing your password ends previous website sessions. Blocking cookies may affect login functionality.

Your selected website language is saved in your browser’s localStorage until you change it or clear website data. This interface preference is not used for advertising tracking. Your account language is also saved on the server so transactional emails can use your selected language.

Transactional emails are used to verify signup, recover account access and respond to inquiries. They do not subscribe you to marketing. The email provider processes the recipient address and email content for delivery. Verification links are single-use and valid for 24 hours; password reset links are valid for 30 minutes. An inquiry receipt is sent if the visitor provides an email address.

When Cloudflare Turnstile protection is enabled, the browser sends technical information to this service to check requests. The website server also verifies the result. See the Cloudflare Privacy Policyfor details. Website forms use this check to help prevent automated requests.

The current website does not include separate advertising analytics systems, advertising pixels or profiling scripts. Field validation and interface preferences are handled directly in the browser.

The website uses Google Fonts to display its typeface. When an external resource loads, its provider receives the network information needed to respond to the request. This processing is also governed by the Google Privacy Policy.

8. Who can access data

• Authorized members of the customer’s team: employees, supervisors and administrators within their granted permissions. A personal link opens the relevant business account and must only be shared with authorized users.
• Platform administrators: administrative access to customer infrastructure and data is retained to operate and maintain the system.
• Infrastructure and connected service providers: hosting, secure access, authentication and other providers, to the extent necessary for their services.
• WhatsApp and other conversation participants: data is shared as part of the messenger’s operation and actions chosen by the user. WhatsApp has its own Privacy Policy.
• Other recipients: where an independent legal basis, required consent or binding legal requirement exists.

9. Retention and deletion

Data is retained for as long as needed for its purpose: responding to an inquiry, maintaining an account, providing a service, meeting mandatory requirements and resolving service-related matters. There is no single retention period for every data category.

The customer organization determines retention periods for business chats and recordings according to its needs and obligations. Deleting an account or disconnecting a server does not automatically delete all recordings: call recordings and the consent log may remain in an archive. Deletion requires a separate action by an authorized party or a request through the established procedure.

Withdrawal of consent applies to processing based on that consent. It does not affect the lawfulness of earlier processing or require deletion of data retained under another applicable legal basis.

Where backups are used, their content and retention periods follow the rules of the chosen infrastructure. Removing information from backups takes their actual storage and recovery cycles into account.

10. Data locations and international transfers

Chats and recordings are stored in the infrastructure of the connected accounts. Server locations depend on the selected cloud hosting or the customer’s infrastructure. Using external network services may involve processing data in other countries.

Hosting choices take into account restrictions applicable to the organization and data category. Where international transfers require additional legal bases, safeguards or contractual terms, these are established before the transfer. Data localization requirements are assessed for the organization and type of data, taking the selected infrastructure into account.

11. Security measures

External access through the secure tunnel uses HTTPS/TLS. Connections between the dashboard and account servers are encrypted with SSH-2; keys and saved server key verification are used for authentication. WhatsApp’s message and media protection mechanisms apply on the WhatsApp segment.

The administrator’s password uses PBKDF2-SHA256 with a unique random salt. Team access is limited by assigned permissions, and login attempts are restricted to resist brute-force attacks.

These mechanisms protect the relevant connections and operations. Stored databases and recordings are protected by access permissions; separate encryption of these files is not implemented in the current version. The system processes business account content for display, recording and use by authorized users.

When an incident is identified, measures are taken to contain and resolve it. Notification of affected parties and competent authorities depends on the incident and applicable requirements. Users are responsible for protecting their devices, passwords and personal links.

12. Your rights

To the extent provided by applicable law, you may:

• Obtain information about processing and access data relating to you.
• Ask for inaccurate information to be corrected and incomplete data to be completed.
• Request deletion or restriction of processing where the relevant grounds exist.
• Withdraw consent and object to processing in the circumstances provided by law.
• Receive data in a portable format where this right applies.
• Submit a complaint to a competent data protection authority.

Requests are assessed with regard to the applicant’s authority, other participants’ rights and any grounds requiring specific information to be retained.

13. Contact and requests

For workspace data, contact your organization’s administrator first: your organization determines the purposes of communication and team access. For personal data and service questions, contact Wacallio at [email protected]. For setup and partnership inquiries: [email protected].

Describe your request and provide information that helps identify the relevant account or inquiry. Do not send your password, one-time codes or a complete identity document unless necessary. Only information needed in the specific situation may be requested to verify your authority.

Requests are reviewed within the periods required by applicable law. If a request cannot be fully fulfilled, we explain the reasons and the available next steps.

14. Policy updates

The current version is published on this page with its update date. Significant changes to processing purposes or conditions are explained separately, and fresh consent is requested where necessary.

Changes to this policy do not replace separate service terms, access settings or notices to participants in business communication.