Privacy policy

For your own account — your name, email, billing details — Kunshort Inc, a Delaware corporation (“we”) is the data controller.

For the WhatsApp conversations flowing through your numbers, you are the controller and we are your processor. We hold and transmit that content on your instructions. The responsibility for having a lawful basis to message those people is yours, and the acceptable use policy is where we set out what that requires.

• Account data — name, email, hashed password, organisation, role, and the audit trail of significant actions taken in the console. Our own staff are alerted over WhatsApp when one of those actions happens — a number connected, a key created, an account opened — carrying the organisation, the person who acted and the one-line description already in the audit log. Never message content, contact lists or anything else belonging to the people you message.
• WhatsApp session credentials — the linked-device login for each connected number. This is the most sensitive thing in the system: it is a live login to a WhatsApp account.
• Message content and metadata — the text of messages sent and received through your numbers, sender and recipient numbers, timestamps and delivery states.
• Media — images, video, audio, voice notes and documents, in object storage.
• Contacts — numbers, display names and any attributes you attach, together with opt-out state.
• Webhook deliveries — the payload, the response status and body, and every retry, so that “we never received that” is an answerable question.
• Operational logs — request ids, IP addresses, API key usage, and errors.

This is the marketing site, not your console. Opening a page here sends one message to a WhatsApp group our own team watches — through this product, which is the only honest way to sell it. It says which page you opened, roughly where you are (country, and the city if our network resolved one), what you are browsing on (device, operating system, browser, screen size), the language your browser asks for, your time zone, and the site that referred you.

• No cookies, no local storage, and no advertising or analytics company involved. There is no third party to opt out of.
• Your IP address is not stored and never leaves our own servers. It is used in memory for two things — resolving a country, and deriving a short hash so that three pages read as one visitor rather than three — and that hash is salted with a value which changes every time the site restarts, so it cannot be followed from one day to the next or traced back to an address.
• Query strings are discarded apart from campaign parameters, and a referring address is reduced to its host and path. Whatever you searched for to get here is not something we want to hold.
• The device description comes from the user-agent string your browser already sends with every request. Nothing is measured, probed or fingerprinted beyond it, the window size and the time zone your browser reports.
• We honour Global Privacy Control and Do Not Track. With either set, your visit is not recorded at all.

WhatsApp session credentials, bearer tokens for any API your AI agents call, and webhook signing secrets are encrypted at rest with AES, keyed separately from the database, so none of them is readable from a database dump. Passwords are hashed, and API keys are stored only as hashes — which is why a key is shown once and rotated rather than recovered.

Message content is not end-to-end encrypted between you and us. WhatsApp’s end-to-end encryption protects a message in transit between devices; WaveSenda operates as a linked device, so the message is decrypted on our infrastructure by design. Anyone telling you otherwise about any product of this kind is mistaken. Do not route material through WaveSenda that you would not accept a hosting provider being able to read.

• We do not sell personal data. There is no arrangement under which we would.
• We do not use your message content to train models. Content sent to an AI provider for an agent reply is sent under an agreement that prohibits training on it.
• We do not read your conversations. Support staff access customer message content only when you ask us to investigate something specific, and that access is recorded in the audit log.
• We do not advertise to the people you message.

We use third parties to run the service. Each receives the minimum needed to do its job:

• Cloud hosting and object storage, for the application and media.
• An AI provider, for agent replies, voice-note transcription and image reading.
• A payment processor, for card details we never see or store.
• An email provider, for transactional mail.

The current list with named providers and their locations is at wavesenda.com/legal/sub-processors. We give 30 days’ notice before adding one.

• Messages and media — for as long as your account is active, unless you set a shorter retention period. Deleting a conversation deletes it.
• Webhook deliveries and logs — a rolling window sufficient for debugging and dispute resolution.
• Session credentials — until the number is logged out or deleted, at which point they are destroyed and the number must be re-linked from the handset.
• Billing records — as long as tax law requires, which is longer than the rest.

On account closure we delete customer data within 30 days, except what we must keep for legal or accounting reasons. Backups age out on their own schedule.

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to processing, and to complain to a supervisory authority. Write to privacy@wavesenda.com and we will respond within 30 days.

If you are a person who was messaged by one of our customers, we are the processor and not the controller — contact the business that messaged you. If you cannot identify them or they do not respond, write to us and we will pass the request on and follow up.

Data is processed in the United States and the European Union. Where personal data leaves its region of origin we rely on the Standard Contractual Clauses.

If we become aware of a breach affecting your data we will tell you without undue delay and in any case within 72 hours of confirming it, with what we know, what we have done, and what you need to do. We would rather send an early notice that turns out to be less serious than we feared than a late one that was complete.

Material changes are announced by email and in the console before they take effect. The date at the top of this page always reflects the current version.