What we collect, and what we never touch.

1. Overview

WABridges ("we", "our", "us") operates a WhatsApp bridge hosting service. This policy describes what data we collect, how we use it, and your rights.

2. How We Use Google Sign-In

WABridges uses Google OAuth 2.0 as the sole method to create and access your account. When you sign in with Google, we request the following scopes:

• email - to identify your account and contact you about billing or service events
• profile - to display your name and profile picture in the dashboard

We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service. We do not use your Google data for advertising, profiling, or any purpose beyond operating your account. Google user data is never sold or shared with third parties except as described in §5.

3. Data We Collect

Account data

• Name and email address from your Google account
• Profile picture URL (from Google, if provided)

Billing data

• Stripe customer and subscription identifiers
• Payment status (e.g., active or past due)
• We do not store card numbers - payment details are held by Stripe

Bridge data

• Customer reference, webhook URL, and bridge state per instance
• Container identifier and API credentials for running bridges
• Phone number (masked in our UI and logs) for paired accounts

Usage data

• Server logs including IP address, request path, and timestamps
• Error and diagnostic logs for operational purposes

4. Message Content

Message payloads pass through our infrastructure in real time to deliver the API service. We do not persist message bodies to long-term storage. Logs may capture metadata (e.g., message IDs, timestamps) but not message text or media content.

5. How We Use Your Data

• To provision, operate, and monitor your bridges
• To process payments and manage your subscription via Stripe
• To communicate service updates, billing events, and security notices
• To investigate abuse or policy violations
• To comply with legal obligations

We do not sell your personal data or use it for advertising.

6. Third-Party Services

• Google OAuth - used exclusively for authentication. We receive your name, email, and profile picture. We do not receive or store your Google password, and we do not access any other Google services. Governed by Google's Privacy Policy.
• Stripe - processes payments and stores card data on our behalf. We never see or store your card number. Governed by Stripe's Privacy Policy.
• Supabase - hosts our PostgreSQL database in a SOC 2 compliant environment.

We do not share your data with any other third parties except as required by law.

7. Data Retention

Account and bridge data is retained for as long as your account is active. On account deletion, your data is removed within 30 days except where retention is required by law or for fraud prevention. Server logs are retained for up to 90 days.

8. Security

We use industry-standard practices to protect your data: encrypted connections (TLS), hashed secrets, and access controls on infrastructure. No system is completely secure; if you suspect a breach, contact us immediately.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To exercise these rights, email us at hello@wabridges.com. We will respond within 30 days.

10. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this policy from time to time. Material changes will be communicated via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

13. Contact

Questions about this policy? Email us at hello@wabridges.com.