Skip to content
layer

Legal

Privacy Policy

What we process, why, how long we keep it, and your rights over it.

Last updated 21 August 2026

1. Scope

This policy explains how Applyform LLC handles personal data in connection with WALayer. It covers data about you as a customer, and data you send through the Service about the people you message.

For customer data we are the controller. For the message data you process through the Service, you are the controller and we are your processor. See the Data Processing Addendum.

2. What we collect

  • Account data: name, work email, company, password hash, and multi-factor enrolment.
  • Billing data: plan, subscription status, invoices. Card details go to our payment processor and are never stored by us.
  • Session metadata: the connected number, its status, warmup stage, trust score, allocated IP, and connection events.
  • Message metadata: sender, recipient, direction, type, timestamps, delivery status and error codes.
  • Message content: stored only where your settings require it, and minimised by default.
  • Technical data: IP address, user agent and request logs, kept for security and abuse detection.

3. What we deliberately do not do

  • We do not sell personal data, and we never have.
  • We do not use your message content to train models.
  • We do not log message payloads, session credentials or API keys in our operational logs.
  • We do not share your data with other customers; tenant isolation is enforced in code.

4. Why we process it

  • To provide the Service: connecting numbers, sending and receiving messages, delivering webhooks.
  • To bill you and to keep the records tax law requires.
  • To keep the platform safe: abuse detection, rate limiting, fraud prevention.
  • To support you when you ask for help.
  • To meet legal obligations.

5. Cookies and analytics

We use Google Analytics to understand how the site and the dashboard are used. It sets cookies in your browser and sends Google the page you visited, the actions you took, and technical details such as your device, browser and approximate location.

We do not use it for advertising. Advertising storage, advertising user data and ad personalisation are switched off in our configuration, not merely left unused, so no advertising signal is collected and none of this data is sold or shared with advertisers.

Analytics is not essential to the Service. Blocking it with your browser's controls or an extension changes nothing about how WALayer works for you.

  • We record which page was viewed, never which record was on it. A page showing one of your contacts is recorded as "/app/contacts/:contactId", so no contact, phone number, session or account identifier is ever sent to Google.
  • Message content, message metadata, API keys and session credentials are never sent to any analytics provider.
  • Query strings are removed before reporting, except campaign parameters (utm_*, gclid, ref).
  • Google receives an IP address in order to derive approximate location. In Google Analytics 4 it is not written to logs or stored.
  • Analytics data is retained by Google for 14 months, then deleted automatically.
  • Strictly necessary cookies, such as the one that keeps you signed in, are set regardless. The Service cannot work without them.

6. How long we keep it

  • Account and billing records: for the life of the account, then as long as tax and accounting law requires.
  • Message metadata: 90 days by default.
  • Message content, where stored: 30 days by default, or less if you configure it.
  • Technical and security logs: 30 days.
  • After account closure: 30 days for export, then deletion.

7. Who we share it with

We use a small number of subprocessors to run the Service. Each is bound by contract to protect the data and to process it only on our instructions.

  • Cloud hosting and storage (infrastructure).
  • Network and connectivity providers (the egress each session connects through).
  • Our payment processor (billing).
  • Email delivery (transactional email).
  • Error and performance monitoring.
  • Google Analytics (product and site usage; see 'Cookies and analytics' above for what is and is not sent).

8. International transfers

The Service runs in cloud regions that may be outside your country. Where we transfer personal data internationally we rely on appropriate safeguards, including standard contractual clauses.

9. Security

  • Session credentials are encrypted and are not readable by our API tier.
  • Per-tenant isolation is enforced in code, not by convention, and is covered by automated tests.
  • Webhook deliveries are HMAC-signed so you can verify they came from us.
  • Access to production is restricted, authenticated and logged.
  • We support multi-factor authentication on dashboard accounts, and require it for administrative access.

10. Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. You can exercise most of these directly in the dashboard, and we will help with the rest.

Write to [email protected] and we will respond within 30 days. If you are unhappy with our response you may complain to your local data protection authority.

11. Children

The Service is not for anyone under 18, and we do not knowingly collect their data.

12. Changes

We will post changes here and update the date above. For material changes we will notify you by email or in the dashboard.

WALayer is a product of Applyform LLC, and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc.