← Back

Privacy Policy

Last updated: 4 August 2026

1. Who we are

WA Inbox ("the Service") is a dashboard that connects to the WhatsApp Business Platform (Cloud API) so a business owner can read and reply to messages sent to their own WhatsApp Business number, optionally with AI assistance.

2. Information we process

  • Account data: your email address and encrypted password.
  • WhatsApp configuration you provide: access token, phone number ID and webhook verify token.
  • Message data received through your webhook: sender phone number, WhatsApp profile name, message text, and media (images, voice notes, video, documents).
  • AI configuration: your OpenRouter API key, chosen model and system prompt.

3. How we use it

Message data is used only to display your conversations and to send replies on your behalf. When auto-reply is enabled, the message content (including image or audio content when relevant) is sent to OpenRouter using your own API key so a reply can be generated. We do not sell data, use it for advertising, or use it to train models.

4. Third parties

We rely on Meta Platforms (WhatsApp Business Platform) to receive and send messages, OpenRouter (and the model provider you select) for AI replies, and our cloud hosting and database provider for storage. Each processes data under its own terms.

5. Storage and security

Data is stored in an access-controlled database where every row is restricted to the account that owns it. Media files are kept in a private storage bucket reachable only through short-lived signed links. Transport is encrypted with HTTPS.

6. Retention and deletion

Conversations and media are retained until you delete them or delete your account. Deleting your account removes your settings, conversations, messages and stored media. To request deletion, contact us at the address below and we will action it within 30 days.

7. Your rights

You may request access to, correction of, export of, or deletion of your data at any time. You can also disconnect the WhatsApp integration at any time by removing your access token in Settings, which immediately stops all message processing.

8. Children

The Service is intended for businesses and is not directed to children under 13.

9. Changes

We may update this policy. Material changes will be reflected by a new "last updated" date on this page.

10. Contact

Questions or data requests: support@your-domain.com (replace with your real support email before submitting this URL to Meta).