Privacy policy

Last updated: 23 September 2026 (French version updated 17 October 2026)

This English text is a courtesy translation. In case of difference, the French version prevails.

WhatzAI (“we”) provides an AI assistant connected to our business customers' WhatsApp number (“you”, if you are a customer, or one of your contacts if they write to you on WhatsApp). This page explains what data is processed, by whom and why, with full honesty about what exists today and what is still to be built.

Who processes what

  • Your account information (name, email, company): handled by our authentication provider, Clerk.
  • Phone numbers and messages of your WhatsApp contacts: received through Meta's official API and stored in our database (hosted by Neon, United States).
  • Documents and websites you give to your agent: stored on Cloudflare R2, split and turned into mathematical representations (“embeddings”) by OpenAI so the agent can answer from them.
  • Conversation content: sent to OpenAI (the AI model) only to generate each reply; voice recordings are transcribed by OpenAI's Whisper service.
  • Your payments: by mobile money (through an approved payment provider) or by bank card / PayPal. We never see or store your card number: it is entered with the provider. We only keep the amount, date and reference of the payment.
  • If you connect Google Calendar: your access token is encrypted before being stored; we only read your availability and the events we create.

None of this data is sold to a third party, nor used to train an AI model beyond the reply being generated.

Security

Sensitive access tokens (WhatsApp connection, Google connection) are encrypted at rest (AES-256). Communication with our server uses HTTPS. Our WhatsApp webhooks verify a cryptographic signature to reject any message that does not really come from Meta.

Retention and deletion

Data is kept as long as the customer's subscription is active. If a subscription is not renewed, the agent is paused and the data (agents, conversations, contacts, knowledge, files) is kept for 30 days and then permanently deleted; the customer is warned in the dashboard and by email. You can also delete your account and data yourself at any time from the dashboard (Settings → Account), or request it at the address below.

Cookies

The site uses the technical cookies needed for login (set by Clerk, our authentication provider). No advertising cookie is set without your consent.

When we run advertising campaigns (Google, Meta: Facebook and Instagram, TikTok), a banner asks on your first visit whether you accept measurement cookies. If you accept, these services receive information about your browsing on the public pages of the site and certain actions (account creation, trial start, payment) in order to measure the effectiveness of the ads. If you decline, nothing is loaded. These measurements are never active in the administration or in shared reports, and no conversation content is transmitted.

On the public pages of the site (home, pricing, blog) we use Microsoft Clarity to measure audience: page views, clicks and scrolling, to improve the site. This tool sets its own cookies and only loads if you accept them. It is never loaded in the dashboard: your conversations and your customers' data are not recorded there.

Where we stand, honestly

WhatzAI is a project at launch stage. We apply good security and data-minimisation practices, but we have not yet finalised a formal data processing agreement (DPA) or a full GDPR compliance audit. If your activity requires it, contact us before entrusting us with your customers' data.

Contact

You can delete your account and all your data yourself at any time, from Settings → Account → “Delete my account”: erasure is immediate and final (only the accounting records of your past payments are kept, without personal data). For any question about this policy, or to request access to or correction of your data: difisoltech@gmail.com