Privacy Policy

Wabery is operated by Metalance LLC ("Wabery," "we," "us," or "our"). This Privacy Policy explains how Metalance LLC collects, uses, discloses, and safeguards information when you use Wabery, our messaging API and developer platform for WhatsApp Business and related services.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name and email address
• Profile picture (if provided)
• Business name and contact information
• Payment and billing information
• Business location details (address, timezone)

1.2 Third-Party Sign-In Data (Google, Apple, Facebook)

If you choose to sign in with Google, Apple, or Facebook, we access the following information from your account:

• Email address - Used to identify your account and send important notifications
• Name - Used to personalize your experience
• Profile picture (Google only) - Displayed in your account settings

Google Sign-In: We only request basic profile information (OpenID, email, and profile scopes). We do NOT access your Gmail, Google Drive, Google Calendar, contacts, or any other Google services.

Apple Sign-In: We only receive your name and email address. Apple may allow you to use a private relay email address to hide your personal email. We do NOT access your iCloud, Apple Pay, or any other Apple services.

Facebook Sign-In: We only receive your name, email address, and profile picture. We do NOT access your Facebook posts, friends list, or any other Facebook data.

Data from third-party sign-in providers is used solely for authentication and account creation purposes.

1.3 Customer Data

When end users interact with applications you build on our platform via WhatsApp, we process:

• Phone numbers and contact information
• Message content and conversation history
• Structured data submitted through WhatsApp Flows
• Language preferences
• Developer-assigned metadata, tags, and notes

1.4 Usage Data

We automatically collect:

• IP address and device information
• Browser type and settings
• Usage patterns and feature interactions
• Error logs and performance data
• Session recordings capturing page navigation and interactions, with page text, form inputs, and element attributes masked
• Advertising and conversion tracking data
• Error reports including stack traces and user context at the time of the error
• IP addresses and user agent strings recorded in billing and usage audit logs

2. How We Use Your Information

We use the collected information to:

• Provide and maintain our services
• Route messages between channels and your application
• Deliver signed webhooks for events to your endpoints
• Send service and account notifications
• Improve and personalize our services
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Message Processing

Our platform processes messages to:

• Send and receive messages across WhatsApp Business channels
• Deliver inbound messages and events to your application via webhooks
• Process messages in multiple languages
• Handle media sent in conversations (up to 5 images per 24-hour session), including resizing and processing
• Collect structured data through WhatsApp Flows and forward it to the endpoints you configure

Some processing may be performed using third-party providers. Messages, and where applicable images, are sent to these providers for processing. Images are resized and metadata (such as EXIF data) is stripped before being sent to such providers. We retain processing logs to improve service quality and troubleshoot issues. You can request deletion of these logs at any time.

3.1 MCP and AI Clients

Wabery provides a Model Context Protocol ("MCP") server that you can authorize for AI clients such as ChatGPT, Codex, and Claude. Depending on the tools and OAuth scopes you approve, MCP results may include:

• Account and project fields, including organization and project identity, plan limits, configuration, and readiness
• Contact fields, including name, phone number, reference ID, language, tags, metadata, and opt-in records
• Conversation and message fields, including participants, channel, direction, timestamps, message content, status, delivery failures, and retained media links
• WhatsApp Flow fields, including definitions, screen and field schemas, publish status, submissions, and dispatch records
• Operational fields for channels, routing, templates, broadcasts, hosted functions and their invocation logs, webhooks, and Meta Business Agent settings

When you authorize an AI client, you direct Wabery to return the requested tool results to that client so it can display or use them in your session. Select the narrowest scopes needed. You can revoke an MCP connection from Access → Connections in Wabery, through the client's connector settings, or through our OAuth revocation endpoint. Revocation disables the associated access and refresh tokens but does not delete records previously returned to the AI client.

Wabery keeps the OAuth connection record while a grant is active and may retain limited operational request metadata, such as the authenticated account, client name, endpoint or tool operation, time, status, and error category, for security and reliability. Operational metadata is retained only as long as reasonably necessary for security, reliability, support, or legal obligations, then deleted or de-identified under Wabery's retention schedule. Wabery does not keep a separate permanent copy of your ChatGPT or Claude conversation as an MCP tool-call log. Records created or returned by a tool follow the normal retention rules in Section 7.

MCP tools do not return OAuth tokens, API keys, provider credentials, signing secrets, internal service proofs, stack traces, or internal debug-only identifiers. Sensitive credentials must be retrieved or managed through Wabery's dedicated account and dashboard controls rather than through MCP results.

4. Information Sharing

We share your information with:

Metalance LLC does not sell personal information. Phone numbers collected for authentication, security, or service-related messaging are not sold or shared with third parties for their own marketing purposes.

4.1 Service Providers

• Messaging platform providers (Meta), for WhatsApp Business integrations
• Payment processing providers (Stripe), for subscription billing
• Email delivery providers, for transactional emails such as service notifications and account notifications
• Product analytics and session recording providers, for understanding usage patterns and improving our Service, including recording user sessions with page text, form inputs, and element attributes masked
• Error monitoring providers, for detecting and resolving technical issues, which may include user context at the time of an error
• Cloud hosting providers, for data storage, processing, and content delivery across multiple regions
• Message and media processing providers, for delivering messages and processing media
• Content delivery and security providers, for performance optimization and bot protection
• Advertising attribution providers, for measuring marketing effectiveness through conversion tracking
• Structured logging providers, for service reliability monitoring

4.2 Legal Requirements

We may disclose information when required by law, legal process, or government request, or to protect our rights, privacy, safety, or property.

5. Transactional SMS and A2P Messaging

Wabery may send transactional SMS messages, such as one-time passcodes, login verification codes, account security messages, and service-related notifications, only when requested or initiated by the user. Wabery does not use these transactional SMS messages for marketing or promotional campaigns. Users may reply STOP to opt out and HELP for help. Message and data rates may apply.

6. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments
• Encrypted storage of messaging credentials

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Message history and conversation data are retained for the duration of your account. Message processing context is cached for 24 hours for operational purposes and then automatically cleared. After account deletion, we retain certain data as required by law or for legitimate business purposes.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (receive your data in a structured format)
• Withdraw consent at any time

To exercise these rights, contact us at help@wabery.com.

8.1 Revoking Third-Party Sign-In Access

If you signed up using a third-party provider, you can revoke our access to your account data at any time:

For Google Sign-In:

1. Go to yourGoogle Account Security Settings
2. Under "Third-party apps with account access", find Wabery
3. Click on Wabery and select "Remove Access"

For Apple Sign-In:

1. On iPhone/iPad: Go to Settings > [Your Name] > Sign-In & Security > Sign in with Apple
2. On Mac: Go to System Settings > [Your Name] > Sign-In & Security > Sign in with Apple
3. Or visitappleid.apple.com> Sign-In and Security > Sign in with Apple
4. Find Wabery and select "Stop Using Apple ID"

Revoking third-party sign-in access will prevent you from signing in with that provider but will not delete your Wabery account or data. To delete your account entirely, please contact us at help@wabery.com.

9. International Data Transfers

Your data may be stored and processed in the United States and Southeast Asia, where our infrastructure is hosted. Third-party service providers may process data in their own jurisdictions. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.

10. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

Essential Cookies

• Session cookies to keep you signed in (30-day expiry)
• Language preference cookies
• Cross-subdomain cookies for seamless navigation across our platform
• Bot protection cookies

Analytics Cookies

• Product analytics cookies that track feature usage and session recordings to help us improve the Service

Advertising Cookies

• Advertising attribution cookies from third-party providers to measure the effectiveness of our marketing campaigns

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Facebook Data Deletion

If you signed up using Facebook, you may request deletion of your data through Facebook's platform. We provide an automated data deletion callback endpoint that processes requests from Facebook. When a deletion request is received, we remove your account data and provide a confirmation code. You can also request data deletion directly by contacting us at help@wabery.com.

13. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a clear opt-out mechanism
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at help@wabery.com. We will verify your identity before processing your request and respond within 45 days.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: