WATI (Clare.AI Limited) maintains a comprehensive Privacy Policy and Data Processing Agreement (DPA) to ensure compliance with global regulations like GDPR.
Below is a breakdown of the key privacy data and data handling practices as of 2026:
1. Data Collection & Sources
Account Data: WATI collects your name, email address, phone number, and billing details (including Tax IDs for regulatory compliance) when you register.
Customer-Provided Data: As a business, when you upload contacts or sync your WhatsApp history, WATI receives phone numbers, names, and message content.
Technical Data: They record log data, IP addresses, and use session-based and persistent cookies to improve platform navigation and security.
2. Data Processing Roles
You (The Business): Act as the Data Controller. You are responsible for ensuring that your customers have opted-in and consented to being messaged on WhatsApp.
WATI: Acts as the Data Processor. They only process your customers' personal data based on your instructions (e.g., sending a broadcast or running a chatbot).
3. Data Storage & Security
Encryption: WATI uses industry-standard encryption for personally identifiable information (PII) both at rest and during transmission.
Server Location: Data is primarily stored on secure cloud servers (AWS/Google Cloud). While based in Hong Kong, they utilize global infrastructure to ensure low latency and high availability.
WhatsApp Cloud API: Messages sent via the Cloud API are temporarily stored for transmission and are typically deleted from the intermediary API layer within 30 days.
4. Retention and Deletion Policy
Permanent Deletion: Upon the termination of your subscription, WATI’s policy is to permanently delete all your data (contacts, chat logs, and templates) from their database.
Manual Request: You can request the immediate deletion of specific account data at any time by contacting hello@wati.io.
De-identified Data: WATI may retain "aggregated or de-identified" data (which cannot be linked back to an individual) for internal analytics and service improvement.
5. Sharing & Third Parties
Service Partners: WATI shares data with partners (like Meta/WhatsApp) and payment processors (like Stripe) to facilitate the service.
No Selling of Data: They explicitly state that they do not sell or rent your personal data to third parties for their own marketing purposes.
Legal Compliance: Data may be disclosed if required by law (e.g., subpoenas or government requests) to protect safety or investigate fraud.
6. Global Compliance
GDPR: WATI is fully GDPR-compliant, offering a Standard Contractual Clauses (SCCs) framework for data transfers outside the European Economic Area (EEA).
Child Privacy: The service is not directed at children under the age of 16.
For the most current and full text, you can visit the official WATI Privacy Policy or their Trust Center.
