Privacy Policy

This privacy policy applies to the website wid.chat, the application at app.wid.chat including its onboarding pages (together “Widchat”), and our communication with customers and prospects.

1. Controller

Widchat, owner Kilian Hauber
Am Rosengarten 18B, 79183 Waldkirch, Germany
Email: [email protected]
Phone: +49 15679 833562

We are not legally required to appoint a data protection officer and have not done so. For privacy questions, contact us at the email address above.

2. Our role: controller or processor

Widchat is software for businesses and agencies to automate and answer messages on WhatsApp and other channels. We act in two roles:

• As controller, we process data of visitors to our website, of users of the application (account, sign-in, billing, support) and of contact persons at our customers and prospects. This privacy policy covers that processing.
• As processor, we process data that our customers exchange with their own contacts through Widchat, such as WhatsApp messages, phone numbers and conversation histories. The business you are messaging with is responsible for that data. We process it only on that business’s instructions and under our Data Processing Agreement. Please contact that business for information about the processing. Requests that reach us are forwarded to it (see section 11).

3. Visiting the website

3.1 Hosting

The website and application run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. We have a data processing agreement with Hetzner.

3.2 Cloudflare

Access to the website and application goes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (reverse proxy, encryption, protection against attacks and overload). Cloudflare processes technically necessary connection data such as your IP address. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses are also in place. We have a data processing agreement with Cloudflare.

3.3 Server log files

Each request processes technically necessary data: IP address, date and time, requested URL, HTTP status code, amount of data transferred, browser type and referrer. This serves delivery, error analysis and security (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless needed longer to investigate a security incident.

3.4 No tracking, self-hosted fonts

We use no analytics or tracking tools and no advertising cookies. Fonts and all other content are served from our own servers; no third-party content is loaded into your browser.

3.5 Cookies and local storage

• lang (website): stores your language choice (en or de) for one year. On your first visit to the home page, the language is chosen from your browser settings.
• Session cookie (application): keeps you signed in and protects against request forgery. It is deleted when you sign out or the session expires.
• Local storage: your colour scheme (light or dark) and view settings are stored only in your browser and are not sent to us.

These are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). No consent is required.

4. Contact

If you contact us by email or phone, we process your details (such as name, email address, company and the content of your request) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the data once the request is settled and no retention obligations apply.

5. User account and use of the application

5.1 Account and organisation

To use Widchat you create an account. We process:

• name, email address and sign-in data (passwords only as a cryptographic hash)
• organisation (for example the name of the agency or business), role and workspace memberships
• settings and branding (logo, colours, texts) you provide
• invitations to other users (name and email address of the invited person)

The legal basis is performance of the contract with you or your employer (Art. 6(1)(b) GDPR). If you act for a business, we process your data as its employee based on our legitimate interest in performing the contract (Art. 6(1)(f) GDPR).

5.2 Security and activity logs

For security, error analysis and traceability of changes, we log sign-ins, IP addresses, important actions (such as connecting a WhatsApp number or activating a flow) and technical errors (Art. 6(1)(f) GDPR). These logs are deleted after 90 days.

5.3 Service emails

We send emails needed for the service, such as sign-in links, invitations, security notices, status updates (for example “WhatsApp number connected”) and invoices (Art. 6(1)(b) GDPR). We use an email service provider as processor, listed in the list of sub-processors. We send newsletters only with your consent.

5.4 Billing

For billing we process company name, billing address, VAT ID, contact person, contract data and payment information (Art. 6(1)(b) and (c) GDPR). Payment details such as card numbers are processed by the payment provider; we receive only the information needed to match payments. Invoices and accounting records are kept for the periods required by commercial and tax law (up to ten years).

5.5 Support

If you contact support, we process your request and, where needed to solve it and requested by you, access the affected data in your workspace (Art. 6(1)(b) GDPR).

6. WhatsApp connection through Meta

6.1 Connecting a WhatsApp account (Embedded Signup)

To connect a WhatsApp number to Widchat, you sign in with your Facebook or Meta account in a window provided by Meta (“Facebook Login for Business”) and select your business account and number. This sign-in happens directly at Meta; we never receive your Meta password. Meta then sends us:

• an access token that allows Widchat to send and receive messages and manage templates on behalf of your business
• the IDs of your business portfolio, your WhatsApp Business Account (WABA) and your phone number
• display name, phone number, quality rating and status of the number

We store the access token encrypted. The legal basis is Art. 6(1)(b) GDPR. You can disconnect at any time in Widchat or revoke access in the settings of your Meta business portfolio.

6.2 Onboarding links

Agencies can send their clients a link to connect WhatsApp. When you open such a link, we process the details prefilled by the sender (for example company name, contact person, email address, website) and the time the link was opened and completed, to assign the connection to the right workspace and to inform the sender about its status (Art. 6(1)(b) and (f) GDPR). Unused links expire after seven days; the related data is deleted no later than 30 days after that.

6.3 Meta as the provider of WhatsApp

WhatsApp messages are transmitted through the WhatsApp Business Platform (Cloud API) of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. This processing is governed by the agreements between the respective business and Meta, in particular the WhatsApp Business Terms of Service, and by the WhatsApp Privacy Policy. Meta may also transfer data to the USA; Meta is certified under the EU-U.S. Data Privacy Framework.

7. Data of our customers’ contacts

Through Widchat our customers process data of their own contacts, such as WhatsApp phone number, profile name, message content and media, timestamps, delivery status, answers given in flows and attributes stored by the customer. We process this data solely as a processor (see section 2). The customer decides how long it is kept; after the contract ends we delete it as set out in the Data Processing Agreement.

8. Recipients

Your data is only disclosed to parties that need it for the purposes above:

• our processors (hosting, network, email delivery, payment processing), listed in the list of sub-processors
• Meta, if you connect WhatsApp or other Meta channels (section 6)
• the organisation your account belongs to: owners and admins of an organisation can see its members, their roles and their activity in shared workspaces. In workspaces an agency manages for a client, both the agency and the client have access to the extent shared.
• tax advisors and authorities where we are legally required

We do not sell personal data and do not use our customers’ content for advertising or to train AI models.

9. Transfers to third countries

We generally process data in Germany or the EU. Transfers to third countries only take place with Cloudflare and Meta as described above and are based on an adequacy decision (EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses.

10. Retention

We keep personal data only as long as needed for the respective purpose:

• account data: for the term of the contract; after termination, the account, workspaces and content are deleted within 30 days
• log files: 14 days; security and activity logs: 90 days
• backups: overwritten on a rolling basis after 30 days at most
• invoices and accounting records: up to ten years (statutory retention); during this period the data is restricted from other use

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). The Data Deletion page explains how to request erasure.

Right to object: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

If your request concerns messages you exchanged with a business through Widchat, please contact that business. If you contact us, we forward your request and support the business in handling it.

12. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

13. Obligation to provide data, automated decisions

You must provide the data needed for the account and contract; otherwise we cannot provide the service. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. Automated replies that customers set up with flows are functions of those customers.

14. Changes

We update this privacy policy when our service or the law changes. The version published on this page applies.