Privacy Policy

1. Our role and customer responsibilities

We handle account administration, support, security and website information for our own service operations. When a business or agency uses Wavo to process its contacts, conversations or advertising data, that customer determines the purposes of that processing and Wavo processes the data to provide the configured service on its behalf. The applicable privacy roles depend on the activity and local law.

If you are a customer’s contact, ask that business first about its messages, advertising and privacy practices. We can help route a request when you identify the relevant business. Agencies must have authority to connect each client’s accounts and must give their contacts appropriate notices and obtain any required consent.

2. Information we process

• Account and workspace information: names, email addresses, authentication identifiers, business or workspace names, membership roles, settings, plan and billing status, and communications with support.
• Messaging and CRM data: contact names, phone numbers, email addresses, custom fields, consent and opt-out preferences, conversation content and media handled by enabled features, message IDs, delivery status, timestamps, tags, assignments and CRM records.
• Integration information: authorized account and location identifiers, selected assets, access permissions, encrypted integration credentials, token expiry, connection status and synchronization records. WhatsApp connectivity also requires session information.
• Attribution data: ad referrals supplied with messages or other configured sources, real ad, campaign and ad-set IDs and names when available, click identifiers, source URLs, attribution timestamps and configured conversion events.
• Service and security information: IP addresses, browser or device information, request and error logs, usage records, audit events and abuse-prevention signals.

The information processed depends on the features a customer enables and what connected providers supply. Wavo may store message content and media references to support inbox, bridge, automation and related features; do not assume messages are metadata-only or inaccessible to the service. Avoid uploading passwords, payment-card details or unnecessary sensitive personal information into conversations or custom fields.

3. How we use information

We use information to authenticate users; operate workspaces; deliver and synchronize messages; execute customer-configured automations; maintain consent and suppression preferences; provide authorized attribution and reporting; administer subscriptions; provide support; and detect misuse, troubleshoot and secure the service.

When customers enable AI features, relevant prompts, conversation context or knowledge-base content may be sent to the configured AI provider to generate responses or analysis. Customers should review the provider and settings before enabling these features. Connecting Meta ads does not itself enable an AI feature.

Where privacy law requires a legal basis, we rely, as appropriate, on providing the requested service or contract, legitimate interests in operating and securing our service, consent for activities requiring it, and compliance with legal obligations. Customer-directed processing is also governed by the customer’s instructions and applicable agreement.

4. Meta ads and conversion integrations

Wavo Ads Connect uses Meta authorization to access assets the connecting person is permitted to use. The ads-only connection requests ads_read; basic profile information may also be returned as part of login. It reads the selected ad account’s advertising information to resolve genuine ad, campaign and ad-set identifiers and names for the associated Wavo workspace and GHL sub-account. It does not create or edit ads.

We use Meta data to provide the authorized integration, reporting, support and security—not to sell that data or build unrelated advertising profiles. Credentials are handled server-side and are not exposed in GHL contact fields. Each sub-account must be configured with its own authorized asset selection.

Ads enrichment and Conversions API (CAPI) are separate features. An ads-only connection does not change a WhatsApp session, CAPI ownership, dataset or existing CAPI configuration. If a customer separately enables direct CAPI, configured events and permitted matching data may be sent to Meta. This can include hashed contact identifiers, event IDs, timestamps, event values and genuine click identifiers where supported. Hashing does not make personal information anonymous. If GHL manages CAPI, its configuration and policies govern that delivery.

Attribution depends on genuine source data and provider access. Organic messages or incomplete ad referrals may have no campaign or click identifiers. CAPI sends conversion events; it does not recreate missing original click data.

You can disconnect the ads integration through its Wavo controls or manage access in your Meta account’s integration settings. Revoking a shared Meta grant can affect other workspaces using that grant. Disconnecting access is not the same as deleting previously stored records; see our data-deletion instructions.

5. Sharing and service providers

Workspace owners, administrators, agency operators and other authorized members can access information according to their roles. We share information with connected services when customers enable the corresponding integration, for example GHL, Meta or another CRM, and with infrastructure providers needed to run the service.

Our infrastructure includes hosting, database, authentication, caching and email providers such as Vercel, Railway, Supabase, Upstash and Resend. Enabled AI features may use Anthropic or OpenAI, including customer-configured credentials. Payment and billing providers process transactions where used. Actual processing depends on the deployment and enabled features; contact us for information about providers relevant to your account.

We may disclose information where reasonably necessary to meet legal requirements, protect rights or safety, investigate abuse, or support a business reorganization subject to appropriate protections and required notice. We do not sell personal information.

6. Cookies and similar technologies

Wavo uses cookies or similar mechanisms for authentication, workspace selection, referral attribution where applicable, and service functionality. Connected services may use their own cookies during authorization. Browser controls can restrict cookies, but blocking necessary cookies may prevent sign-in or integrations from working. Customer-configured advertising and conversion tracking is distinct from website cookies and remains subject to applicable consent requirements.

7. Security, retention and international processing

We use safeguards such as access controls, workspace isolation and encrypted storage for integration credentials. No system is completely secure. Message transport encryption does not prevent Wavo or an authorized connected CRM from processing content after it reaches the integration.

We retain information as needed to provide the service and for legitimate security, dispute, accounting and legal obligations. Retention varies by record type, customer instructions and applicable requirements. Expired or revoked access stops authorized API use as applicable, but does not automatically erase historical records. Deleted information may remain in restricted backups until those backups expire through their normal lifecycle; retained copies are not used for ordinary service operations.

Wavo and its providers may process information outside your country. Where required, appropriate transfer arrangements must apply. Contact us to discuss the processing locations, safeguards or contractual terms required for your organization before providing regulated data.

8. Your choices and privacy rights

Depending on your location and our role, you may have rights to access, correct, export or delete personal information, object to or restrict processing, or withdraw consent. You may also have a right to complain to your local data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

Use available account controls or email info@wavohq.com. We may need to verify identity and authority, especially for shared workspaces. Do not send passwords, API tokens or full payment details. We respond within applicable legal time limits and explain any lawful limits on a request. For deletion, follow the step-by-step instructions.

9. Children and policy updates

Wavo is a business service, not directed to children. Do not create an account if you are under 18. If you believe a child provided personal information directly to us, contact us.

We may update this policy as the service changes. The date above identifies the current version. We will provide additional notice of material changes where required. Questions can be sent to info@wavohq.com.