Privacy Policy
Last updated: 12 August 2026 · Applies to whapier.com and the Whapier application
1. Who we are and how to reach us
Whapier ("the Service") is operated by ADDO VISION SOLUTIONS SRL, a limited liability company registered in Romania — VAT RO32203240, Trade Register J40/10973/2013, with its registered seat in Bucharest, Romania ("we", "us", "Whapier"). ADDO VISION SOLUTIONS SRL is a Meta Partner; the Service runs on the official WhatsApp Business Platform (Cloud API).
For any privacy matter — questions, requests, complaints — write to office@addovision.ro. We answer within one month, as Art. 12(3) GDPR requires.
2. The two roles we play
Understanding this policy requires one distinction:
- We are the controller for the data of the people who visit this website and of the people who register and operate Whapier accounts (you and your team). Sections 3–5 describe this processing.
- We are your processor for the data your account brings into the Service: your contact lists and your WhatsApp conversations. There, you decide why and how the data is processed; we act only on your instructions, under the Data Processing Agreement that forms part of our Terms of Service. Section 6 summarises this processing.
3. Data we process as controller, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email address, password (stored as a salted hash), organization name, role, language preference | Creating and operating your account; authentication; support | Art. 6(1)(b) — performance of a contract |
| Company name, billing address, EU VAT number, VIES consultation references, invoices, payment history | Issuing lawful invoices with the correct VAT treatment; accounting | Art. 6(1)(c) — legal obligation; Art. 6(1)(b) |
| WhatsApp Business Account identifiers you connect (WABA ID, phone number ID, display name, quality signals reported by Meta) | Operating your WhatsApp connection: sending, receiving, warm-up, tier awareness | Art. 6(1)(b) |
| Server logs: IP address, timestamp, requested URL, user agent | Security, abuse prevention, troubleshooting | Art. 6(1)(f) — legitimate interest in a secure service |
| Support correspondence and tickets | Answering you; improving the Service | Art. 6(1)(b); Art. 6(1)(f) |
| Cookies and similar technologies | Sessions, security, preferences, aggregate analytics | See the Cookie Policy |
We do not sell personal data. We do not use your data, or your customers' message content, for advertising or to train AI models. Product emails we send you are limited to the operation of the Service (receipts, renewal notices, security and material changes); marketing email is sent only with your consent, which you can withdraw at any time by writing to office@addovision.ro (Art. 6(1)(a)).
4. Recipients: processors and other controllers
We share personal data only with parties the Service needs in order to function:
- Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, Ireland) — operator of the WhatsApp Business Platform. Every WhatsApp message necessarily transits Meta's systems, under Meta's WhatsApp Business Terms. For message transmission Meta acts as your provider, and Meta bills you its message fees directly; that relationship is between you and Meta, as its own controller/processor arrangements describe.
- Payment service providers (e.g. Stripe Payments Europe Ltd, Dublin, Ireland) — for subscription payments. They receive the data needed to process the payment; full card numbers never touch our systems.
- Hosting and infrastructure providers in the European Union — the servers the Service runs on, bound by data processing agreements.
- The European Commission's VIES service — receives the VAT number you provide, for validation; the consultation number returned is stored as audit evidence.
- Public authorities — only where the law obliges us (e.g. fiscal authorities, courts), and only to the extent it obliges us.
The current list of sub-processors used for customer content is maintained in the Data Processing Agreement.
5. International transfers, retention, security
Transfers. The Service is hosted in the EU. Where a provider processes data outside the EEA (Meta and payment providers may, within their own groups), the transfer rests on an adequacy decision or on the European Commission's standard contractual clauses, as their published terms describe.
Retention.
| Category | Kept for |
|---|---|
| Account data | Life of the account + up to 90 days after closure |
| Customer content (contacts, conversations) | Life of the account; deleted or irreversibly anonymised within 90 days of closure |
| Invoices and accounting records | 10 years (Romanian fiscal law) |
| VIES consultation evidence | As long as the related invoices, for audit |
| Server logs | Up to 12 months |
| Support tickets | 3 years after closure of the ticket |
Security. Encryption in transit (TLS) on every connection; passwords stored as salted hashes; API keys stored hashed and revocable individually; role-based access inside your organization; two-factor authentication available on every account; webhook signatures verified; access to production restricted to the personnel who operate it. No method is absolute, which is why we also keep what we store to the minimum the Service needs.
6. Your customers' data (we are the processor)
The contacts you import and the conversations you hold belong to your relationship with your customers: you are their controller. We process this data exclusively to run the Service for you — storing, displaying, sending and receiving, automating, reporting — under the instructions and safeguards of the Data Processing Agreement. We never use it for our own purposes. Your matching obligations to those people (lawful basis, opt-in, opt-out) are described in the Acceptable Use Policy and in our guides.
7. Your rights
Under Articles 15–22 GDPR you can, at any time and free of charge:
- Access the personal data we hold about you, and receive a copy;
- Rectify inaccurate data — most account and billing data you can edit directly in the application;
- Erase data ("right to be forgotten"), where no legal ground requires us to keep it;
- Restrict processing while a dispute about it is resolved;
- Port the data you provided to us, in a structured, machine-readable format — contact and conversation exports are built into the product;
- Object to processing based on legitimate interest, and to direct marketing absolutely;
- Withdraw consent where processing rests on consent, without affecting prior processing.
Write to office@addovision.ro. If you believe we have not treated your data lawfully, you can complain to the Romanian supervisory authority — ANSPDCP, B-dul G-ral Gheorghe Magheru 28-30, Bucharest, dataprotection.ro — or to the supervisory authority of your own member state.
8. What we do not do
No automated decision-making with legal effect within the meaning of Art. 22 GDPR. No profiling of you or of your customers. No sale or rental of personal data. The Service is a business tool and is not directed at children; we do not knowingly process children's data.
9. Changes to this policy
We announce material changes by email to account owners and on this page at least 14 days before they take effect. The date at the top always identifies the current version.