Privacy Policy

1. Who we are

WapFlow is a SaaS virtual receptionist platform via WhatsApp for small and medium service businesses (barbershops, beauty salons, clinics, wellness studios and others), developed and operated by SYS INFORMATION TECHNOLOGY LTDA (Brazilian tax ID / CNPJ 49.780.808/0001-28), registered in Ribeirão Preto/SP, Brazil ("we", "our" or "Data Controller").

For the purposes of the General Data Protection Regulation (GDPR — EU 2016/679), WapFlow acts as data controller in relation to data of Plan Holders (businesses/merchants) and, in certain contexts, as data processor in relation to information about end clients of those businesses.

2. What data we collect

2.1 Plan Holder data (contracting businesses)

• Full name of the responsible person and business name
• Email address and business phone number
• Payment data (processed by Stripe — we do not store card details)
• WhatsApp Business phone number linked to the platform
• Usage and interaction data with the admin dashboard
• Opening hours, offered services and business settings

2.2 End client data (of contracting businesses)

• Name and WhatsApp phone number
• Appointment history (service, date, time, responsible staff member)
• Service preferences declared in conversations
• WhatsApp communication opt-out status

The textual content of WhatsApp conversations is not stored on our servers beyond what is necessary to process the message intent in real time. We do not store message logs containing PII (personally identifiable information).

2.3 Technical and usage data

• IP addresses and HTTP headers (for security and rate limiting)
• System event logs (without message content)
• Performance metrics and technical errors

3. Purposes and legal bases for processing

4. Sharing data with third parties

We do not sell or rent personal data. We share data only with the following sub-processors, strictly necessary for the provision of the service:

5. International data transfers

Some of our sub-processors are located outside the European Economic Area (EEA). In these cases, we ensure that transfers are carried out with appropriate safeguards, in particular through Standard Contractual Clauses (SCCs) approved by the European Commission, or other equivalent legal mechanisms recognised under GDPR.

6. Data retention

7. Your rights

Under the GDPR, data subjects have the following rights, exercisable by contacting us as indicated in section 1:

We respond to rights requests within 30 days (extendable by a further 60 days in complex cases, with prior notification).

8. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, including:

• Encryption in transit (TLS 1.2+) and at rest for sensitive data
• API tokens and authentication keys stored encrypted in the database
• Two-factor authentication (2FA) available for all users
• HMAC-SHA256 signature validation on all incoming webhooks
• Rate limiting to prevent brute-force attacks
• Tenant data isolation — each business accesses only its own data
• Regular backups with secure retention

In the event of a data breach posing a risk to the rights and freedoms of data subjects, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by the GDPR.

9. Cookies and tracking technologies

WapFlow uses strictly necessary cookies for the operation of the admin dashboard (authentication session, CSRF protection). We do not use third-party tracking cookies, behavioural advertising or analytics tools that individually identify users.

10. Minors

WapFlow is a service intended exclusively for businesses and professionals. We do not intentionally collect personal data from individuals under 18 years of age. If you believe data from a minor has been provided, please contact us immediately so we can arrange deletion.

11. WhatsApp Business API integration (Meta)

WapFlow uses Meta's WhatsApp Business API to send and receive messages on behalf of contracting businesses. By using our service, businesses confirm that they:

• Have obtained appropriate consent from their clients for WhatsApp communication
• Comply with WhatsApp Business Policies
• Honour opt-out requests (STOP) from their clients
• Do not use the platform to send spam or unsolicited messages

Messages sent through the Meta platform are processed by Meta in accordance with its own data policy. WapFlow does not have access to the content of end-to-end encrypted messages.

12. Changes to this policy

We may update this Privacy Policy periodically. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email for any substantial changes. We recommend reviewing this policy regularly.

13. Contact and complaints

To exercise your rights or submit questions or complaints about the processing of your personal data, contact us:

You also have the right to lodge a complaint directly with the competent data protection authority:

• European Union: The data protection authority of your EU member state of residence
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk