Privacy Policy

https://wapliss.com/privacy-policy

Last updated: November 10, 2026•Version 3.2 (GDPR, CCPA & Google OAuth User Data Policy Compliance)
Privacy Commitment

At Wapliss (accessible at https://wapliss.com), we fundamentally respect your privacy. Wapliss connects AI assistants (such as Anthropic’s Claude, OpenAI’s ChatGPT and Google’s Gemini, via the Model Context Protocol - MCP) to your WhatsApp account. So that you can read and search your conversations from your assistant, we store your account’s message history privately, as explained in section 3. We never sell your messages or use them for advertising or to train models.

1. Data Controller

The data controller responsible for the processing of personal data collected through this application is the administration and engineering team of Wapliss.

• Official website: https://wapliss.com

• Legal and Privacy Contact Email: proteuscrypto@gmail.com

• Compliance: General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Google API User Data Policy.

2. Personal Data We Collect

We only collect the absolute minimum information required to deliver gateway and authentication services:

  • Registration & Identification Data: Email address, optional account name, and passwords hashed with high-cost salt derivation (bcrypt).
  • Google Authentication Data (Google Sign-In / OAuth): When authenticating via Google on https://wapliss.com, we receive your Google unique ID, verified email address, public profile name, and avatar picture. We never request access to Google Drive, Gmail, Google Contacts, or unrelated scopes.
  • Billing Data: Monetary payments are handled directly by Stripe, Inc. under Level 1 PCI-DSS certification. Wapliss never sees or stores full payment card numbers; we only store Stripe customer identifiers (cus_...) and subscription tokens (sub_...).
  • Technical Metadata: Anonymized IP addresses for rate limiting and DDoS prevention, as well as timestamps of API access.

3. WhatsApp Messages: What We Store and Who Can Access It

When you link your phone, WhatsApp syncs your history to Wapliss. We store it so your AI assistant can read it when you ask:

  • What we store: chats and groups (name, description, participants and admins), contacts, and messages (text, date, sender, type and the caption that accompanies files).
  • Where: in our server database on Google Cloud (us-west1 region) and in a compressed backup in private Google Cloud Storage that only the Wapliss service can access. Replaced backups are kept for at most 7 days.
  • Media files: received photos, audio and documents are stored temporarily on the server and deleted on every restart. They are not included in backups and are not handed to the AI assistant, which only receives their type, name and caption.
  • Messages you send: they go through your account’s send queue until they are dispatched to WhatsApp.
  • How long: while your account is active. If you request deletion, we delete your account, your message history and your WhatsApp credentials.
  • AI assistant access: only after you authorize it via OAuth or with a personal API key that you create and can revoke (for example, for DeepSeek Harness), only to your own account, and only when you ask it something. Content the assistant reads is sent to that assistant’s provider (for example, Anthropic for Claude, OpenAI for ChatGPT, Google for Gemini or DeepSeek for DeepSeek models) and handled under that provider’s privacy policy. We log which chat was read and when, without storing the content.
  • What we don’t do: we don’t sell your messages, we don’t share them with third parties other than the AI providers you connect, and we don’t use them for advertising or to train models.

4. Google API User Data Disclosure

• Wapliss’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used solely to authenticate the user's identity and initiate a secure session on https://wapliss.com.

• We do not sell, rent, or transfer Google user data to any third parties.

• We do not use Google user data for advertising, retargeting, or to train generalized machine learning or artificial intelligence models.

5. Security Measures & Credential Encryption (N-1)

  • Encryption in Transit: All communications occur exclusively over HTTPS and TLS 1.3 with active HSTS enforcement.
  • Encryption at Rest (N-1): Instance credentials and webhook secrets are encrypted with AES-256-GCM using derived server keys. Secrets never leak to frontend browsers or public logs.
  • OAuth 2.1 with PKCE: AI assistant authorizations (Claude, ChatGPT, Gemini and other MCP clients) enforce S256 cryptographic challenge verification.
  • Secure Cookie Architecture: Sessions are secured with HttpOnly, SameSite=Lax, and Secure flags.

6. Your Rights (Access, Rectification, Erasure)

  • Access & Portability: Request a full copy of your registered personal information.
  • Rectification: Modify and update your account details at any time in your control panel.
  • Revocation: Revoke the access of any connected AI assistant (Claude, ChatGPT, Gemini, DeepSeek or another MCP client) at any time from your dashboard, and revoke any API key instantly.
  • Erasure & Right to Be Forgotten: Request complete deletion of your account, credentials and stored message history by emailing proteuscrypto@gmail.com.

7. Legal Contact & Queries

If you have questions regarding this Privacy Policy or wish to exercise your legal rights, please contact our team at:

proteuscrypto@gmail.com