Legal

Privacy notice

Last updated: October 16, 2026.

At WaMan ("WaMan", "we", "our") we handle your personal data transparently and in accordance with applicable law. This notice explains what data we process when you use the platform, connect Meta or Google Calendar, or manage appointments; how we use, disclose and manage it; and how you can exercise your rights.

Data controller

WaMan acts as the data controller for the personal data we receive in the context of the platform. You can contact us at any time at hola@waman.mx to resolve questions or exercise your rights.

Purpose of processing

We process your personal data for the following purposes:

To provide and administer the WaMan platform, including setting up official WhatsApp channels through the Meta Tech Provider flow.
To provide support, address requests and follow up on our customers' accounts.
To comply with applicable legal, accounting and tax obligations.
To prevent fraud and ensure the security, integrity and availability of the platform.
To comply with Meta's applicable terms and policies when the Tech Provider flow is used to connect the WhatsApp Cloud API.

What data we process

We only process the data necessary to operate the platform, which may include:

Account data: name, email address and access credentials of administrators.
Organization data: company name, tax information and the WhatsApp numbers connected to the platform.
Technical identifiers for the Meta integration (Phone Number ID, WhatsApp Business Account ID) and encrypted access tokens, kept only on the server.
Usage and technical log data needed for operation, diagnostics and security of the service.

Platform usage analytics

If you allow it, we use PostHog (PostHog Inc., United States) to understand how the WaMan dashboard is used and to improve it. It is off until you accept it in the notice shown after you sign in, and you can withdraw it at any time in Settings → Preferences → Usage analytics.

What we record: pages visited, clicks, scrolling and, on some setup screens (home, onboarding, connections, bots and broadcasts), session recordings with all text and fields masked.
What we do not record: the content of your conversations, your contacts’ data or what you type into forms. The conversations, contacts, CRM, invoicing and payments screens are never recorded.
How we identify you: only with internal user and organization identifiers. We do not send your name, email or phone number.
Retention: recordings are kept for up to 1 month and usage events for up to 1 year.
If your browser sends a privacy signal (Global Privacy Control or Do Not Track), analytics stays off.

Processing in the Meta Tech Provider flow

When you connect the official WhatsApp Cloud API through the Tech Provider flow, the one-time authorization code is sent to our API, which exchanges it with Meta and stores the returned access token encrypted. Credentials are never exposed in the dashboard.

Meta uses the privacy policy we publish to understand how we use, disclose and manage user data. We do not sell personal data and do not share it with third parties for direct marketing without your consent.

Google Calendar and appointments

Access and use: The Google Calendar permission WaMan requests can see, edit, share and permanently delete every calendar accessible to the connected Google account. WaMan uses it to identify the account, check calendars and availability, create and share collaborator calendars, and create, read, reschedule or cancel appointment events. The organization chooses the services, collaborators and customers involved. Events may contain appointment titles, times, descriptions and attendee details.
Stored data: We store the connected Google account identifier and email, and, when returned, profile name, picture, locale and email verification status, along with granted permissions, token expiry, calendar identifiers and encrypted access and refresh tokens. Appointment details obtained through Google may also remain in bot execution records and operational logs to provide the service, diagnose failures and maintain security; the Google Calendar content of bot execution records is removed after 30 days. We do not sell this data or use it for advertising.
Sharing: WaMan sends calendar requests and appointment changes to Google. If the organization provides a collaborator's email, WaMan may grant that person write access to their assigned calendar. The organization controls collaborator access and is responsible for informing customers and staff about its appointment practices.
AI processing: To answer a customer and manage a booking, the bot sends only the calendar data that conversation needs (free time slots and the title and times of that customer's appointments) to an AI model at the moment of the request. Event descriptions and attendee lists are not sent. Calendar features only run on AI providers and plans whose terms exclude this data from model training: the Google Gemini API on a paid plan operated by WaMan, the OpenAI API and the Anthropic API, called directly without aggregators or gateways. When an organization uses a provider or key that does not offer that guarantee, its bot cannot use Google Calendar. WaMan does not use self-hosted models. Google user data, including aggregated, anonymized or derived data, is never used to create, train or improve AI or machine-learning models, by WaMan or by these providers.
Disconnecting: Disconnecting Google in WaMan attempts to revoke access and removes the local connection and its tokens. It also removes the Google Calendar content from the organization's bot execution records. It does not automatically delete calendars or events already created in Google, or WaMan-held collaborator emails and calendar identifiers. Deleting a collaborator in WaMan can delete that person's Google calendar and events. For access or deletion requests concerning WaMan-held records, contact us using the details below; manage remaining Google data in the connected Google account.
Google API data policy: WaMan's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. WaMan does not use, transfer or sell Google user data to create, train or improve generalized AI or machine-learning models.

Who we share information with

We do not sell your personal data. We may share information only in the following cases:

With service providers that support our operations (hosting, infrastructure, support and analytics), under contract and confidentiality.
With Meta, only as needed to operate the WhatsApp Cloud API integration you choose to enable.
With Google, to provide the calendar integration you choose to enable.
With the AI provider the organization configures (Google Gemini, OpenAI, Anthropic or DeepSeek), only as needed to answer customers and manage appointments through the bot. Google Calendar data is only sent to the providers and plans described in the AI processing section.
With authorities, when required by a legal obligation or a valid order.

For any international transfer, we ensure adequate safeguards or a valid legal basis exist.

Security and management

We implement reasonable technical, administrative and organizational measures to protect your data: encryption in transit and at rest, role-based access control, and periodic review of our practices. We keep your data only for as long as necessary to fulfill the purposes of this notice or as required by law.

Data retention

We keep your personal data as long as needed for the purposes described, for the performance of the relationship with the platform, or to comply with legal obligations. When it is no longer needed, we delete or anonymize it securely.

Your rights

Subject to applicable law, you have the right to request access, rectification, cancellation or opposition regarding the processing of your personal data. To exercise them, contact us with your request and proof of identity:

Access: know what data we process and why.
Rectification: correct inaccurate or incomplete data.
Cancellation: request deletion of your data when no longer needed.
Opposition: object to processing for specific purposes.

Changes to this notice

We may update this privacy notice to reflect changes in our practices or in regulation. We will publish the current version at this same URL and indicate the date of the last update.

Contact

For any question, comment or request about how we process your personal data, write to hola@waman.mx or use the contact channel available in the platform.