Back to home

Privacy Policy

October 9, 2026

1. Who we are

Wazapi is a WhatsApp automation and support platform operated by Oryn Labs LLC. For privacy inquiries, contact us at [email protected].

2. Data we collect

  • Registration data: name, email, phone number, and encrypted password.
  • Company data: business name, tax ID (optional), and domain.
  • Usage data: flows created, contacts managed, messages sent/received via WhatsApp API, and metadata of connected business assets (WABA, Facebook Page, Instagram professional account) when authorized by the user.
  • Technical data: IP address, user agent, access logs, and error logs for diagnostics.
  • Payment data: processed directly by the payment gateway — we do not store card numbers.

3. How we use your data

  • Provide and improve platform services.
  • Send transactional notifications (account confirmation, password reset).
  • Comply with legal and regulatory obligations.
  • Prevent fraud and ensure platform security.
  • Communicate relevant product updates (with opt-out option).

We do not sell your personal data. Browsing data only reaches Google, for measurement and advertising, if you accept the optional cookies (section 7).

4. Data sharing

We share data only with:

  • Meta (Facebook/WhatsApp): for integration with WhatsApp Cloud API, Messenger, and Instagram, pursuant to Meta's platform terms. Access to business assets only occurs upon the user's explicit authorization.
  • Infrastructure providers: cloud hosting (Railway/AWS), PostgreSQL database, transactional email service (Domailo).
  • Competent authorities: when required by law or court order.
  • Google (Analytics and Ads): measurement of the site (Google Analytics) and of our ads (Google Ads), through Tagelo's measurement server, only if you accept the optional cookies (section 7).

5. Data retention

We retain your data while the account is active. After cancellation, data is kept for up to 90 days for support and audit purposes, then permanently deleted — unless otherwise required by law.

6. Your rights (LGPD)

You have the right to:

  • Access the data we hold about you.
  • Correct incomplete or inaccurate data.
  • Request deletion of your personal data.
  • Withdraw consent and disconnect business channels (WhatsApp, Messenger, Instagram) at any time.
  • Data portability, upon request.

To exercise these rights, email [email protected]. We respond within 15 days.

7. Cookies and tracking

We use necessary cookies, which are always on, and optional measurement and advertising cookies, which load only after you accept them in the site's cookie notice. Until you choose, the site does not load Google tags and no optional cookie is set. The legal basis for optional cookies is your consent (LGPD art. 7, I).

  • Necessary (always on): session, authentication, CSRF protection and wz_consent, which stores your choice about optional cookies and its date for 12 months — after that, we ask again.
  • Attribution (first-party): wz_attr, our own cookie that keeps the source of your first visit (campaign, ad click identifiers such as gclid and fbclid, referring site and landing page) for 90 days so we can attribute your signup. It stays with Wazapi and is not sent to third parties. The legal basis is our legitimate interest in knowing which channels bring customers (LGPD art. 7, IX); you can delete it in your browser at any time.
  • Measurement (optional): Google Analytics cookies (_ga and _ga_*), which count visits and show how the site is used: page views, traffic source and signups. They last up to 2 years.
  • Advertising (optional): Google Ads cookies (_gcl_*), which measure whether one of our ads led to a visit or a signup and let us show Wazapi ads to people who visited the site. They last up to 90 days.

Measurement and advertising data goes through a measurement server in São Paulo, operated by Tagelo, also part of Oryn Labs, and then to Google, which processes it outside Brazil, mainly in the United States. This international transfer relies on your specific consent (LGPD art. 33, VIII): the cookie notice says, before you accept, that this data goes to Google outside Brazil, and without your acceptance nothing is sent.

You can change your choice at any time under “Cookie preferences” in the site footer, or by deleting cookies in your browser. Withdrawing consent stops collection from then on; it does not reach what was already sent.

8. Security

We employ in-transit (TLS 1.2+) and at-rest encryption, role-based access control, and continuous threat monitoring. No system is 100% secure — in the event of an incident, we will notify affected users as required by LGPD.

9. Changes to this policy

We may update this policy periodically. We will notify you of material changes by email or in-app notice. Continued use after notification constitutes acceptance of the changes.

10. Contact

Questions, complaints, or requests: [email protected]