← Weappi · Pricing · Terms

Privacy Policy

Weappi (weappi.com) is provided by CREAIT LTDA (CNPJ 48.356.022/0001-15, Brazil), which is the controller of account data. For the conversations of your customers, you are the controller and Weappi processes them on your behalf. We process personal data in accordance with Brazil's LGPD and, where applicable, the European GDPR, the UK GDPR and the privacy laws of US states such as the CCPA. This policy describes what we collect and how we use it for the chatbot, CRM and AI orchestrator for WhatsApp Business.

1. Data we collect

• Account registration (name, email, phone/WhatsApp).
• Platform usage data (flows, settings, technical logs).
• Conversation content and the knowledge base you publish in your scope.
• Data needed for integrations you turn on (e.g. Google Calendar, CRM via webhook).
• AI usage metrics (tokens/calls), for plan limits and billing.
• Payment data handled by the payment provider (Stripe outside Brazil, Asaas in Brazil); we do not store full card numbers.

2. How we use it and legal bases

Providing and improving the service; support; security; legal compliance; and, with authorization, communications about the product. Conversation and knowledge base content is used to run customer service and, with AI on, to generate replies through the orchestrator. Our legal bases are contract performance, legitimate interest, legal obligation and, where required, consent.

3. Artificial intelligence and subprocessors

With AI on, the excerpts needed for a reply may be sent to model providers (e.g. OpenAI, Anthropic, Google), under contracts and settings of the Weappi orchestrator. We may also use cloud infrastructure, the WhatsApp/Meta platform for message delivery, and Stripe and Asaas for payments. We do not sell personal data.

4. Google and Microsoft data (Calendar, Gmail and Outlook)

These integrations are only on when you connect your account in the panel. Weappi uses only what is needed for the feature you turned on:

• Google Calendar / Outlook Calendar: Weappi reads events (start, end, title, description and whether the time is "busy" or "free") from the calendar you choose, and from those you mark just to block time, so it does not offer your customers a time when you are busy and can recognize an appointment booked directly in the calendar (when the customer's WhatsApp is in the event). Weappi creates, changes and deletes in the chosen calendar only the events of appointments booked by Weappi. We keep the start, end, title and identifier of these events to keep both calendars matched and to notify the customer when an appointment changes.
• Email (Gmail, Outlook and others): Weappi reads emails arriving in the inbox after the connection, to show them in the conversations panel and for customer service (your team or the virtual assistant you set up) to reply; and it sends the emails you or your service send. The content is kept as conversation history. Weappi does not delete or change emails in your mailbox. Gmail is connected via IMAP, with an app password you create in your Google account and can revoke at any time; Weappi does not use Gmail APIs. The app password is stored encrypted.

The use and transfer of information received from Google APIs follow the Google API Services User Data Policy, including the Limited Use requirements. In particular, your Google account data:

• is used only to provide and improve the features you see in Weappi (calendar);
• is not sold, not used for advertising and not used to train general artificial intelligence models;
• is sent to third parties only when needed for the feature you use (for example, the text of an email to the AI provider you set up to reply), by legal obligation or with your consent;
• when it goes to an AI provider, goes through the provider's paid API, whose terms do not allow using this data to train its models; Weappi does not use it to train its own models either;
• is not read by Weappi staff, except with your consent, for security (such as investigating abuse) or by legal obligation.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Protection: Google data travels only over secure connections (HTTPS/TLS) and stays on restricted-access servers; access authorizations (tokens) are stored encrypted (AES-256); each account sees only its own data, after login. Retention and deletion: we keep Google data while the integration is on. On disconnecting, Weappi stops accessing the account; for the calendar, it immediately deletes the authorization (tokens) and the busy times that came from it. Email history is deleted within 30 days of a request to contato@weappi.com or of account closure.

You can disconnect at any time: in the Calendar (Resources → the calendar → Disconnect), in Channels (the mailbox), or in your account at myaccount.google.com/permissions, account.microsoft.com. To also delete the history, write to contato@weappi.com.

5. Sharing

Only when needed for operation (infrastructure, Meta/WhatsApp, AI providers, payment providers, integrations chosen by the user), by legal obligation or with consent.

6. International transfers

Weappi is run from Brazil, and data may be processed in Brazil, the United States and other countries where our providers operate. When data comes from the European Economic Area or the United Kingdom, we rely on the safeguards the law allows, such as standard contractual clauses, where applicable.

7. Cookies and measurement

On the site (weappi.com and blog) we use cookies and similar technologies to measure visits and the effectiveness of our campaigns: Google Analytics (Google) and Meta Pixel (Meta Platforms). These tools record data such as pages visited, device, browser, source of access and events such as completing registration, and may link it to cookie identifiers. We use this information in aggregate to understand site use and to show more relevant ads on Facebook, Instagram and WhatsApp. You can block or delete cookies in your browser settings and adjust your ad preferences in your Meta account and at Google (myadcenter.google.com). Blocking measurement cookies does not prevent use of the platform.

8. Security and retention

Reasonable technical and organizational measures. Data is kept for as long as the service is provided and as legal obligations require; deletion on request where applicable.

9. Your rights

You have the right to access, correct, delete and port your data, to information about the processing, and, depending on where you live, to object to or restrict processing and to withdraw consent. People in the EEA and the UK may also complain to their data protection authority, and California residents may ask what data we hold; we do not sell personal data and we will not discriminate against you for exercising your rights. To exercise any right: contato@weappi.com.

10. Changes

We may update this policy. Relevant changes will be announced on the platform or by email. If there is a difference between versions, the Portuguese version prevails, unless mandatory law says otherwise.

Back to the site · Terms · Create account