Privacy Policy

Definitions

“Waply,” “we,” “us,” and “our” refer to Efece Systems. “Customer” means the business or person that contracts or configures Waply. “Authorized User” means a person permitted by a Customer to use the service.

“Customer Data” means information submitted to, accessed through, generated by, or synchronized with Waply on a Customer's behalf. “Personal Information” means information relating to an identified or identifiable person. “Processing” includes collecting, using, storing, transmitting, disclosing, and deleting information.

Information we process

The categories processed depend on the features selected, the Customer's configuration, and the connected services. They may include:

• Account and integration data, such as names, business contact details, Kommo account and user identifiers, WhatsApp Business Account and phone-number identifiers, permissions, authentication status, and configuration metadata.
• Customer Data from CRM and messaging workflows, including contacts, leads, conversations, message content, attachments and media, templates, reactions, delivery statuses, tags, notes, exports, and webhook events.
• Calling data, including phone numbers, call metadata, recordings, transcripts, summaries, and outcomes when those features are enabled.
• Artificial intelligence data, including agent settings, instructions, prompts, knowledge sources, conversation context, model inputs and outputs, evaluation data, and human feedback.
• Billing and transaction data processed with Polar, such as plan, subscription status, invoices, billing contact, and payment status. Waply does not receive or store full payment-card numbers.
• Technical, security, and support data, such as IP address, device and browser information, timestamps, diagnostic logs, error reports, audit events, usage metrics, and support communications.

We receive this information from Customers and Authorized Users, connected platforms, service providers, and automatically when the service is used. Customers determine which integrations and data sources they connect.

How we use information

We process information to provide, secure, maintain, and improve Waply. This includes authenticating users, synchronizing authorized data, sending and receiving communications, operating automations and calls, generating requested AI outputs, providing support, administering subscriptions, preventing abuse, diagnosing failures, enforcing terms, and complying with law.

We may use aggregated or de-identified information to understand service performance and improve reliability, provided it is not used to identify an individual. We do not sell Personal Information.

Product analytics and session replay

When the Waply widget is used inside Kommo, Microsoft Clarity may record the entire Kommo session in which the widget is active so we can understand product usage, improve usability, and diagnose errors. Text and input content are masked. Standard technical metadata, including the Kommo host and path, device and browser details, and interaction timing, may still be processed.

Waply sends PostHog only pseudonymous, allowlisted product milestones through our own backend. These explicit events describe fixed actions and outcomes; they do not include message content, prompts, knowledge-source content, phone numbers, API keys, provider responses, or customer-defined names and identifiers.

Explicit PostHog product events are retained for no more than 12 months. Standard Microsoft Clarity session playback is retained for 30 days; favorited or sampled recordings and aggregate Clarity data may remain for up to 9 months.

For questions or to exercise privacy rights related to this processing, contact support@waply.online

Optional website analytics and advertising

On the public Waply website, optional measurement is off until you choose it in Cookie preferences. You can reject optional cookies, choose analytics and advertising separately, and change or withdraw your choice from the website footer. Global Privacy Control keeps advertising tracking disabled.

With analytics consent, Google Tag Manager loads Google Analytics 4 to measure visits, installation-button clicks, documentation navigation, selected product options and Core Web Vitals. Microsoft Clarity provides heatmaps and session replay to help us understand usability. Form fields and documentation search inputs are masked. We do not send search text, OAuth credentials, CRM records, messages, phone numbers or email addresses as measurement event parameters.

With advertising consent, Meta Pixel measures page visits and clicks on installation buttons, using browser identifiers to help assess campaigns. A button click is an expression of interest, not proof of an installation, trial or payment. Automatic advanced matching is disabled. Any later server-side conversion measurement through Meta Conversions API or Google Analytics requires a verified association and the corresponding consent; customer milestones are not inferred from website clicks.

Google, Microsoft and Meta receive technical information when their respective tags are enabled, including browser and device information and the network information needed to receive the request. Optional first-party cookies may include _ga, _clck, _clsk, _fbp and _fbc. We store your category preferences in your browser. Withdrawal prevents subsequent measurement on this site; it does not automatically erase previously received provider data. Contact support@waply.online for questions or deletion requests.

Legal grounds

Depending on the context and applicable law, processing is based on performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests such as service security and improvement, consent where required, or another lawful basis available under applicable data-protection law.

Where consent is the basis, it may be withdrawn prospectively. Withdrawal does not affect processing already carried out lawfully or processing supported by another legal ground.

Customer responsibilities and processing roles

For Customer Data, the Customer generally decides why and how personal information is processed and acts as controller or equivalent responsible party; Efece Systems generally processes that data on the Customer's instructions as processor or service provider. Efece Systems acts as controller for limited purposes such as account administration, billing, service security, legal compliance, and its own business communications.

Customers must provide appropriate notices, obtain required permissions and consents, honor data-subject requests, configure retention and access appropriately, and ensure their use of Kommo, Meta/WhatsApp, calls, recordings, artificial intelligence, and messaging complies with applicable law and platform rules. Customers must not submit data they lack authority to process.

Disclosures, integrations, and service providers

We disclose information only as needed to operate the service, follow Customer instructions, protect rights and security, or comply with law. Recipients may include:

• Kommo for CRM and account integration; Meta/WhatsApp for business messaging and calling capabilities selected by the Customer.
• Cloudflare and other infrastructure, hosting, database, object-storage, queue, monitoring, and security providers.
• Voice, telephony, transcription, and artificial intelligence providers when the relevant features are enabled.
• Polar and related payment infrastructure for subscriptions, invoices, and transactions.
• Professional advisers, authorities, courts, counterparties in a corporate transaction, or others when disclosure is legally required or reasonably necessary to protect the service, users, or third parties.

Providers may process information only for the services they supply to us or as otherwise permitted by their own direct relationship with a Customer or user. The specific provider set can change as Waply evolves.

International transfers

Efece Systems is based in Argentina, while Waply and its providers may process information in other countries. Those countries may have different data-protection rules. Where required, we use contractual, organizational, or other lawful safeguards for cross-border transfers, considering the roles of the Customer and Efece Systems.

Retention and deletion

We retain information only as long as reasonably necessary for the feature used, Customer instructions and configuration, contractual obligations, security, dispute resolution, backup cycles, and legal requirements. Different categories therefore have different retention periods; there is no single period for all Waply data.

When information is no longer required, we delete, anonymize, or isolate it until deletion is feasible. Residual copies may remain temporarily in backups or logs. Customers should export or delete Customer Data before closing an account and may contact us for account-deletion assistance.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, environment separation, encryption in transit where supported, logging, monitoring, and limited provider access. Customers are responsible for protecting their credentials and managing Authorized Users.

No service or transmission method is completely secure. We cannot guarantee absolute security, but we investigate suspected incidents and provide notices when required by applicable law or contract.

Privacy rights

Subject to applicable law, individuals may request access, correction, updating, deletion, restriction, objection, portability, withdrawal of consent, or information about processing. They may also have the right to complain to a competent data-protection authority.

When a request concerns Customer Data, the relevant Customer is usually best placed to respond, and we will assist the Customer as required. We may verify identity, authority, and scope before acting and may retain information where the law permits or requires it.

To exercise privacy rights relating directly to Efece Systems, contact support@waply.online

Third-party services

Waply connects with services controlled by third parties, including Kommo, Meta/WhatsApp, and payment, voice, and AI providers. Their collection and use of information under their own relationship with a Customer or user is governed by their terms and privacy notices. Customers should review those notices and configure each service appropriately.

Minors

Waply is a business service and is not directed to people under 18. We do not knowingly request that minors create Waply accounts. Customers must apply any additional protections required when their own communications involve minors.

Changes to this policy

We may update this Policy to reflect changes in Waply, providers, law, or processing practices. We will publish the revised version with a new last-updated date and, when appropriate, provide additional notice. Continued use after the effective date is subject to the revised Policy, to the extent permitted by law.

Contact

Efece Systems, Argentina, is responsible for this Privacy Policy.

For privacy questions, requests, or complaints, email support@waply.online