Privacy Policy

Privacy Policy

Last updated: 4 September 2026 · Data controller: WA Link (walinkapi.com) · [email protected]

1. What this covers

This policy explains what we collect when you use walinkapi.com and the WA Link messaging API, why we collect it, who we share it with, and what you can ask us to do about it.

2. What we collect

  • Account data — your name, email address, phone number, country and a hashed password. We never store your password in readable form.
  • Billing data — which plan you bought, the amount, the currency, the method and the payment reference. Card numbers never reach our servers; they are handled entirely by our payment providers.
  • Service data — the WhatsApp number you connect, your instance identifiers, your API token, session status and usage counters.
  • Message data — recipient numbers, message content and media you send through the API, delivery and read receipts, and, if you use the inbox feature, messages sent to your connected number. See section 4.
  • Technical data — IP address, browser and device information, request logs and timestamps.
  • Referral data — if you arrive through an affiliate link, a first-party cookie recording that referral.

3. Why we use it, and on what basis

  • To create your account, run your instances and deliver your messages — performance of our contract with you.
  • To take payment, issue receipts and keep accounting and tax records — legal obligation.
  • To keep the platform secure, investigate abuse and enforce our acceptable use rules — our legitimate interest, and that of message recipients.
  • To answer support requests — contract and legitimate interest.
  • To send product or marketing email — only with your consent, withdrawable at any time from any such email.

4. Your messages

Message content passes through our platform because that is the only way to deliver it. We process it solely to transmit it, to produce the delivery status and logs shown in your dashboard, and to investigate a specific fault when you ask us to.

We do not sell message content, do not share it for advertising, and do not use it to train machine-learning models. Our staff do not read message content except where you specifically ask us to look into an issue, or where we are legally required to.

Messages are necessarily delivered through the WhatsApp platform, which receives them and applies its own privacy terms.

Where you send messages to your own contacts, you are the controller of their personal data and we act as your processor. You are responsible for having a lawful basis to contact them, for honouring opt-outs, and for telling them how you use their data.

5. Who we share data with

  • Payment providers. Card orders are processed by Dodo Payments, which acts as Merchant of Record and receives the details needed to take payment, detect fraud, issue your receipt and handle refunds. Other listed methods are handled by their own providers.
  • The WhatsApp platform, which receives the messages you send, as described above.
  • Infrastructure providers that host our servers and deliver our email. They act on our instructions only.
  • Authorities, where we are legally required to disclose.

We do not sell personal data and we do not share it with advertising networks.

6. How long we keep it

Account data is kept until you delete your account. Message logs are kept only as long as needed to show you recent activity and to resolve disputes, and are then purged. Invoices and payment records are kept for as long as tax and accounting law requires. The referral cookie lasts 30 days.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Email [email protected] from your account address and we will respond within 30 days. You may also close your account from your dashboard, which deletes your profile and disconnects your instances.

8. Security

The site and the API are served over HTTPS. Passwords are stored hashed, API tokens are per-account and revocable, and access to production systems is restricted to the people who need it. No system is perfectly secure, so please use a strong, unique password and keep your API token private.

9. Cookies

We use a strictly necessary session cookie to keep you signed in, a first-party affiliate attribution cookie that lasts 30 days, and a cookie remembering your light or dark theme choice. We do not use advertising cookies or third-party tracking pixels.

10. Children

WA Link is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes and contact

We will post any change to this policy on this page with a new “last updated” date. Questions, requests or complaints: [email protected].