Privacy Policy

• Sign-up: name, e-mail, contact phone and password (stored hashed, never in plain text).
• Security: two-step verification data, when enabled.
• Payment: plan, subscription status and billing history. Card details are handled by Stripe and are not kept by Wppfy.
• Service use: connected numbers, instance status, settings, campaign lists and results, and CRM leads.
• Visit source: landing page, referring site and campaign parameters (UTM), so we know where our customers come from.
• Technical data: IP address and browser information, used for security, abuse prevention and bot checks.

Messages and contacts you send or receive through your numbers are processed to run the service on your behalf. In that case you are the controller of that data and Wppfy acts as a processor. We do not use that content for any other purpose.

• to provide the service, connect numbers and run campaigns and integrations (performance of contract);
• to bill the subscription and prevent fraud (performance of contract and legitimate interest);
• to send notices about the account, payments and changes to the service;
• to provide support when you contact us;
• to measure where sign-ups come from and how well our ads work, with your consent to advertising cookies;
• to comply with legal obligations.

We do not sell personal data. We only share it with providers needed to run the service:

• Stripe: payment processing;
• Resend: platform e-mails;
• Cloudflare: security, site delivery and bot checks;
• Google: ad measurement, only with your consent;
• the WhatsApp connection infrastructure provider and the server hosting provider.

Some of these providers process data outside Brazil, with the safeguards required by the LGPD. We may also share data when required by law or court order.

• Essential: keep you signed in and store preferences such as language and theme. They cannot be turned off.
• Visit source: a first-party cookie stores the landing page and campaign parameters for 30 days to attribute the sign-up correctly.
• Advertising (Google Ads): only enabled if you accept the cookie notice. You can decline without losing any feature.

• Account data: while the account exists.
• Instances of unpaid subscriptions: deleted 7 days after the payment failure.
• After an account deletion request: data is deleted within 30 days, except records the law requires us to keep, such as financial records, for the legal period.

We use encrypted connections (HTTPS), hashed passwords, optional two-step verification and an individual token per instance. No system is completely immune to failures. If an incident poses a relevant risk to you, we will notify you as required by the LGPD.

Under the LGPD you may request at any time: confirmation that we process your data, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent. Write to the contact e-mail below. We reply within 15 days.

You may also file a complaint with the Brazilian Data Protection Authority (ANPD).

Wppfy is not intended for people under 18 and does not knowingly collect data from minors.

This Policy may be updated. The last update date is shown at the top of the page, and relevant changes will be announced by e-mail or in the dashboard.