Privacy

Wabi is run by Meter. This page explains what the site, the dashboard, the API, the MCP server and the CLI process, for whom, and what happens to it. Wabi is a working name and this policy is a draft for the product's early access; we will email customers before material changes take effect.

Two roles

• For your customers' data, you are the controller and we are your processor. When you connect a WhatsApp Business Account, Wabi receives, stores and sends WhatsApp messages (text, media, locations, Flow answers), contact data (phone numbers, WhatsApp ids, profile names, attributes, consent records and opt-outs) and metadata (timestamps, delivery and read statuses, Meta's pricing and error codes) on your behalf and only on your instructions. You decide what to collect, are responsible for having a lawful basis and the consents Meta's policies require, and answer your customers' requests; we help you do so with export and deletion.
• For your own account, we are the controller. That is the data about you and your team set out below: sign-in details, billing, usage of the product and messages you send us.

Enterprise customers can sign a data processing agreement with us; email jonathan@getwabi.dev.

Meta and the WhatsApp Business Platform

Messages to and from WhatsApp users go through Meta's WhatsApp Business Platform. Meta processes them under its own terms and policies, which you accepted when you created your WhatsApp Business Account; Meta's handling of that data is governed by Meta, not by this policy. The sandbox number is simulated: messages sent there never leave Wabi.

AI processing

When you use an AI agent or AI localization, the relevant conversation, contact context, knowledge sources and template text are sent to the model that runs it: Anthropic's Claude by default, under terms that do not allow Anthropic to train its models on that data. If you bring your own model key, that provider processes it under your agreement with them. Every agent session is recorded as a trace (inputs, sources, tool calls, outputs, tokens) in your organization so you can audit it.

Your account and team

We store your email address, name and organization memberships so you can sign in with an emailed code or Google and work with your team. With Google sign-in, Google shares your name, email and profile picture; we ask for nothing else. We email you about your account and, occasionally, short product notes; each such email has a one-click unsubscribe. We record which operation each dashboard action, API, MCP or CLI call ran, from which surface and by which member or key, in your organization's activity and audit logs.

Payments

Stripe handles payment through Stripe Checkout and its billing portal. We store your Stripe customer and subscription identifiers and your plan. Card details go to Stripe and never reach us. Meta's message fees are billed by Meta to your WhatsApp Business Account; we do not process those payments.

Cookies and analytics

We use cookies that are needed to keep you signed in and to record which link brought you here (a first-party referral cookie kept 90 days at most); your light or dark theme is kept in your browser's storage. The site and dashboard use Google Analytics, with advertising features, ad personalization and Google signals off, to count visits, sign-ups and purchases. It sets first-party cookies and receives your IP address and browser details, never message content or your customers' data. Analytics loads only after you accept it in the cookie banner (you can change your mind by clearing the wabi_consent cookie), and never when your browser sends Do Not Track or Global Privacy Control.

Subprocessors

We will update this list before adding a subprocessor that handles your customers' data.

How long we keep it

• Messages, conversations and agent traces: 30 days on Free, one year on Starter, Growth and Scale, and as agreed on Enterprise. Older history is deleted on a rolling basis.
• Contacts, templates, agents and settings: while your organization exists, or until you delete them.
• Account, billing and audit records: while your account is active and afterwards for as long as tax and legal obligations require.
• Server and error logs: a few weeks.

Export and deletion

You can export your organization's data (self-serve through the data export API on Scale and up; on other plans, ask us and we will send it), disconnect a WhatsApp Business Account at any time (history stays until you delete it), delete individual contacts and conversations, and delete your organization, which removes its data from our systems within 30 days, except records we must keep by law. To exercise your own rights (access, correction, deletion, objection), or to report a concern, email us. A customer's end user who contacts us about a business's WhatsApp messages will be referred to that business.

Security

Data is encrypted in transit and at rest; WhatsApp access tokens are additionally encrypted with a key held outside the database. Every organization's data is isolated and only ever shown to its members and API keys.

What we don't do

We don't sell data, use your customers' messages for advertising, or train AI models on them, and we don't share data beyond the subprocessors above or where the law requires it.

Contact

Meter, jonathan@getwabi.dev.