עברית

Privacy Policy

Last updated: October 21, 2026

Wazza ("Wazza", "we", "us") provides a no-code platform that lets businesses build automated WhatsApp conversations, manage a team inbox, and send broadcasts using the official WhatsApp Business Platform by Meta. This policy explains what data we collect, why we collect it, how we protect it, and the choices you have. It applies to our website (wazza.co.il), the Wazza web app (app.wazza.co.il), the Wazza mobile app for Android and iOS, and the services around them (together, the "Service").

1. Data we collect

Account data. When you create an account we collect your name, email address and phone number, and a password (stored only as a salted hash). If you sign in with Facebook or Google, we receive your name, email address and an account ID from that provider - never your password.

Data received from Meta Platforms. When you connect Facebook or WhatsApp we receive, through Meta's official APIs:

• From Facebook Login for Business: your app-scoped Facebook user ID and, where available, your name. We use these solely to create and authenticate your Wazza account.
• From the WhatsApp Business Platform: your WhatsApp Business Account (WABA) ID, phone number ID, display phone number, verified business name, and the access token required to operate your number on your behalf.

Your customers' data. The messages exchanged between your business and your customers on WhatsApp reach us through Meta's WhatsApp Cloud API - including media (photos, videos, voice notes and documents) and your customers' contact details, such as name and phone number, as well as contacts you import. We process this data on behalf of the business that uses Wazza, only to run its inbox, bots, broadcasts and analytics. The business decides what it collects from its customers and is responsible for having a lawful basis to message them.

Content you create. The scenarios, templates, broadcasts, knowledge base and business description you set up in Wazza.

Data from the mobile app. A push notification token and an app install identifier and, only when you use the feature that needs it, your location, phone contacts, contact photos, and the photos, videos, voice notes and files you send. Section 10 explains each one.

Usage and technical data. Standard log data (IP address, browser or device type, app version, pages viewed) and the cookies needed to keep you signed in on the web.

Billing data. Payments are processed by our payment provider; we do not store full card numbers.

2. How we use data

• To provide, operate, and secure the Service.
• To power the features you configure: chatbots, AI agents, team inbox, broadcasts, templates, and analytics.
• To send the notifications you asked for, and to communicate with you about your account (verification emails, security notices, service updates).
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we do not use your customers' message content for advertising. Data received from Meta's platforms is used only to provide the Service to you, in accordance with the Meta Platform Terms and the WhatsApp Business Terms of Service.

3. How data is stored and protected

• WhatsApp and Facebook access tokens are encrypted at rest (AES-256-GCM) and are never exposed to browsers, the mobile app, or third parties.
• Passwords are stored as salted bcrypt hashes; we never store them in plain text.
• All traffic between your browser or the app, our servers, and Meta's APIs is encrypted in transit (TLS).
• Webhook traffic from Meta is verified with cryptographic signatures before it is processed.
• On your phone, the app keeps its sign-in token in the device's secure storage (the iOS Keychain or the Android Keystore).
• Access to production data is restricted to authorized personnel who need it to operate the Service.

4. Sharing and sub-processors

We share data only with service providers that help us run the Service. They process it on our instructions and only for that purpose:

• Meta Platforms - the WhatsApp Business Platform (Cloud API), which carries your WhatsApp messages, and Facebook Login. Signing in with Facebook never gives us your Facebook password.
• Google - Gemini AI models for the AI features you use: drafting scenarios, importing knowledge, and AI agent replies. Google receives the text you enter, your business description and knowledge content and, while an AI agent is active, the customer messages it answers. Google also provides Google sign-in and Google Workspace, which we use to send account emails.
• Cloudinary - storage and delivery of message media (photos, videos, voice notes and documents) and contact photos.
• Push notification services - Expo, Google Firebase Cloud Messaging and the Apple Push Notification service deliver notifications to your device.
• Our cloud hosting and database providers, and our payment provider.

We may disclose data if required by law. We do not sell personal data, and there is no advertising in the Service.

5. Data retention

We keep your data for as long as your account is active. When you delete your account, in the app or on the web (see section 6), the deletion is immediate and permanent:

• Your account details, sessions and your devices' push registrations are erased.
• Every organization you are the sole owner of is deleted with everything in it, including your customers' contacts, conversations, messages and media. Contact photos and media files are removed from storage as part of the deletion.
• An organization that has another owner is not deleted; only your membership in it is removed.
• WhatsApp messages already delivered to your customers stay on their devices and on Meta's servers, outside our control.
• Billing records are kept where the law requires it (for example, tax and accounting rules).

The full details are on the account deletion page.

6. Your rights and data deletion

You may access, correct, export, or delete your personal data. Businesses on Wazza can also delete individual customer contacts and their conversation history from within the product, and export contact data for GDPR requests.

To delete your data, use any of the following:

• In the app: Settings → Delete account. On the web: sign in at app.wazza.co.il → Settings → Privacy & data → Delete account. Both perform the same permanent deletion; step-by-step instructions are at app.wazza.co.il/account-deletion.
• By email: send a deletion request to privacy@wazza.co.il from the email address on your account. We confirm completion within 30 days.
• If you used Facebook Login: you can also remove Wazza from your Facebook settings (Settings & privacy → Settings → Apps and websites → Wazza → Remove). Removing the app revokes our access; to have the data we already hold deleted as well, use one of the options above.
• If you are a customer of a business that uses Wazza: that business controls your data, so please contact it first. You can also write to us and we will pass your request on.

Instructions for Facebook users are also on our data deletion page.

7. Cookies

We use strictly necessary cookies to keep you signed in on the web (session cookies) and to protect against cross-site request forgery. We do not use advertising or analytics cookies.

8. Children

The Service is intended for businesses and their staff aged 18 or over, and is not directed to children. We do not knowingly collect personal data from children.

9. International transfers

Our infrastructure providers may process data in the European Union, the United States, and Israel. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses provided by our sub-processors.

10. The Wazza app

The Wazza mobile app for Android and iOS gives you the same inbox as the web app. It asks for each device permission only when you use the feature that needs it, and every permission is optional: declining one only turns that feature off.

• Notifications. If you allow notifications, the app registers a push token and an install identifier with our servers so we can tell you about new messages. If you decline, no token is created.
• Location. The app reads your precise location only when you choose to share a location in a chat, and only while the app is open - never in the background. The location is sent to your customer as a WhatsApp message and saved with that conversation.
• Contacts. Apart from the contact-photo option below, the app reads your phone's contacts only while you import contacts or add broadcast recipients from your phone, and only the contacts you select are sent to Wazza. If you choose to save a customer to your phone, the app adds that one contact to your address book.
• Contact photos. Only if you agree (the app asks once): when a customer who messages your business is also saved in your phone's contacts with a photo, the app uploads that photo so your whole team sees it in the inbox, on the web too. You can switch this off at any time in Settings → App → Customer photos from contacts. A photo removed in Wazza is removed for the whole team and is not synced back from phone contacts.
• Camera, microphone, photos and files. Used only when you take a photo or video, record a voice note, or attach a file to send in a chat. Only what you send is uploaded.
• No ads, no tracking. The app contains no advertising, analytics or tracking SDKs and does not collect your device's advertising ID, and we never sell your data.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with an updated "Last updated" date, and where appropriate by email.

12. Contact

Wazza Ltd · Israel · privacy@wazza.co.il

For help with the Service, visit our support page or email hello@wazza.co.il.