Privacy Policy

Updated

About this policy

This Privacy Policy explains how personal data is handled when you visit watification.com, join the Watification waitlist, create or use a Watification account, or otherwise interact with us. Watification is a product of CarryCodes Ltd, a company registered in England and Wales under company number 17112048, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("CarryCodes", "we", "us", "our").

Watification is currently offered as an early-access service. The service, the data we process and this policy will evolve as the product develops. Where this policy changes, the updated version is published on this page with a new "updated" date.

Two roles: controller and processor

We act as a controller for personal data we collect for our own purposes, such as website visitors, waitlist members, account users and billing contacts. This policy mainly describes that processing.

Businesses that use Watification ("customers") connect their WhatsApp Business accounts and use the service to communicate with their own customers and contacts. For the messages, contacts, media, orders, form responses and similar data that customers process through Watification ("Customer Data"), the customer is the controller and we act as a processor on the customer's behalf under our Terms of Service. If you are an end customer of a business that uses Watification, please contact that business about your data. We will support the business in responding to your request.

Personal data we collect

Website visitors

  • Technical data such as IP address, browser and device type, pages requested and timestamps, which are processed by our servers and infrastructure providers when you load a page or call our API.
  • Visit-source information: the website that referred you (host name only), the first page you landed on, and campaign parameters included in the link you used (such as utm_source or utm_campaign).
  • A one-way, hashed form of your IP address, held for a short period to limit abuse of our public forms.

Waitlist members

  • Your name, email address, company website or social profile URL, and WhatsApp number.
  • Optional answers you choose to give about your expected use of Watification, such as message volume, team size, intended features and your role.
  • Visit-source information associated with your sign-up, and records of confirmation and invitation emails sent to you.

Account users

  • Your email address and, where you add one, your phone number.
  • If you sign in with Google or GitHub, the identifier and email address that provider shares with us.
  • Workspace membership, roles and permissions, settings and preferences.
  • Session and security records, including sign-in method, session identifiers, and records used to detect and prevent misuse.
  • Content you create in the service (for example saved replies, labels, notes, templates and settings) and records of your activity in the service.
  • Communications with us, including support requests and feedback.

Billing contacts

  • Billing name and email address, country, and subscription, invoice and payment status records. Payments are processed by our payment provider, Lemon Squeezy, which acts as merchant of record. We do not receive or store full card details.

Service and usage data

  • Information about how the service is used and how it performs, such as feature usage, API requests, errors, delivery outcomes, logs and diagnostic data. This data may include identifiers and limited content needed to understand and fix a problem.

Product analytics

We use PostHog, a product analytics service, on the website and in the service to understand how they are used and to improve them. PostHog may collect:

  • pages and screens viewed, clicks, form interactions (without the values typed into form fields), feature usage and the time and order of these actions;
  • browser, device, operating system, screen size, referring site and campaign parameters;
  • approximate location derived from your IP address;
  • an analytics identifier stored in your browser and, only if you allow it in the dashboard, your account, workspace and role identifiers so that activity can be linked to your account;
  • session recordings that show how pages are used, only if you accept them. We configure recordings to mask text you type and to mask message content and contact details shown in the dashboard.

Separately, our website servers count page views without storing or reading anything on your device. Each count records only the page address (without query details other than campaign parameters), the referring site's name, campaign parameters and a coarse device type (mobile, tablet or desktop), with a random identifier that is never reused. It does not include your IP address, and we do not count visits from browsers that send a Global Privacy Control signal.

How we use personal data

We use personal data to:

  • provide, operate and maintain the website and the service, including authentication, messaging delivery, notifications and billing;
  • manage the waitlist, including confirming your email, deciding the order of invitations and sending invitations;
  • understand which channels and campaigns bring visitors and sign-ups;
  • understand how visitors and users use the website and the service, including through product analytics, funnels and session recordings, to find problems and decide what to build and improve;
  • provide support, investigate and resolve problems, and respond to your requests;
  • monitor, analyse, test, develop and improve the website, the service and new features, including during early access, when real usage is an important part of how the product is built;
  • keep the website and service secure, prevent fraud, spam and abuse, and enforce our terms;
  • send service, security, account, billing and administrative messages;
  • send occasional updates about Watification to waitlist members and account users, which you can opt out of at any time using the link or instructions in the message;
  • comply with legal obligations, and establish, exercise or defend legal claims;
  • carry out business operations such as audits, financing, and a merger, acquisition or reorganisation.

We may also create aggregated or de-identified information that no longer identifies any individual and use it for any lawful purpose, including product development, analytics and reporting.

Legal bases

Under UK data protection law we rely on:

  • contract, where processing is needed to provide the service you or your organisation signed up for, or to take steps you requested before doing so (such as joining the waitlist);
  • legitimate interests, including operating, securing, analysing and improving our services, understanding where interest comes from, prioritising invitations, preventing misuse, and communicating with business contacts, balanced against your rights and interests;
  • legal obligation, where we must keep or disclose information under applicable law;
  • consent, where required by law, which you may withdraw at any time without affecting earlier processing.

For website analytics in the United Kingdom we rely on legitimate interests for the personal data and on the statistical-purposes exception in the Privacy and Electronic Communications Regulations for the browser storage, and you can object at any time as described in "Browser storage and cookies".

How we share personal data

We share personal data with:

  • service providers that host, store, secure, transmit or process data for us, including cloud hosting, database, storage and message-queue providers, Amazon Web Services for storage and encryption key management, and email delivery providers;
  • PostHog, which provides our product analytics and session recording;
  • Meta Platforms, when you connect a WhatsApp Business account or send and receive WhatsApp messages through the service, under Meta's own terms and policies;
  • Google and GitHub, when you choose to sign in with them;
  • Lemon Squeezy, for payments, subscriptions, invoicing and tax;
  • professional advisers, such as lawyers, accountants and auditors;
  • companies under common ownership or control with CarryCodes;
  • a buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business;
  • regulators, courts, law enforcement or other parties where required by law, or where reasonably necessary to protect rights, property or safety.

We do not sell your personal data.

International transfers

Our service providers may process personal data outside the United Kingdom, including in the European Economic Area and the United States. Where data is transferred to a country without UK adequacy regulations, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

Browser storage and cookies

We use the following types of browser storage:

  • Strictly necessary: the dashboard uses cookies to keep you signed in and protect your session: identity_access, identity_refresh, identity_csrf and, during Google or GitHub sign-in, a temporary identity_oauth cookie. These may appear with a __Host- prefix. The dashboard may also store interface preferences, such as recently used emoji, in local storage.
  • Visit source: the website stores watification.attribution.v1 in local storage, recording how you first arrived (referring site, first page, campaign parameters) for up to 90 days so that this can be included if you join the waitlist.
  • Analytics: PostHog stores an identifier and settings in cookies or local storage whose names begin with ph_, typically for up to one year, to recognise repeat visits and link activity across pages.

We use the visit-source and analytics storage only to produce statistics about how the website and the service are used so that we can improve them. PostHog processes this data on our behalf and does not use it for its own purposes or for advertising, and on the website we do not use it to identify you.

How we ask depends on where you are:

  • In the United Kingdom and most other countries, analytics such as pages viewed and clicks is on when you first visit and we show a notice explaining it. You can opt out at any time, free of charge, using "Opt out of all analytics" on that notice or "Privacy choices" at the bottom of every page. After you opt out, no further analytics data is collected from your browser and the visit-source item is removed.
  • In the European Economic Area, and where your browser sends a Global Privacy Control signal, we ask for your consent first and analytics only starts if you accept.
  • Everywhere, session recordings only start if you accept them. If you reject, or make no choice, your visit is not recorded.
  • In the dashboard, the same rules apply. Analytics linked to your account and session recordings only start if you allow them, and you can turn analytics and recordings on or off at any time in your settings.

You can change any of these choices at any time through "Privacy choices" on the website or the privacy settings in the dashboard. We remember a refusal for six months before asking you once more, and we ask you to confirm an acceptance after twelve months. An opt-out stays in place until you change it.

If you would like analytics data already collected from your browsing to be deleted, email privacy@watification.com or support@watification.com and we will delete it. You can also clear these items through your browser settings at any time.

Retention

We keep personal data for as long as needed for the purposes described in this policy, including providing the service, meeting legal, tax and accounting requirements, resolving disputes and enforcing agreements. For example:

  • unconfirmed waitlist sign-ups are deleted automatically about 7 days after the last confirmation email;
  • confirmed waitlist entries are kept while the waitlist and invitation process continues, or until you ask us to remove them;
  • the visit-source item in your browser expires after 90 days;
  • analytics events and session recordings are kept for the periods set in our analytics configuration and then deleted, and session recordings are kept for a shorter period than other analytics data;
  • account data is kept for as long as the account is active and for a reasonable period afterwards;
  • logs, diagnostic and backup data are kept for limited periods and then deleted or overwritten on a rolling basis.

Customer Data is retained in accordance with our Terms of Service and the customer's instructions.

Security

We use technical and organisational measures appropriate to the nature of the data, including encryption in transit, encryption of provider credentials, hashing of sign-in codes and tokens, access controls and separation of workspace data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights

Depending on the circumstances, you have the right to request access to your personal data, correction, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests or for direct marketing. You may withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@watification.com. We may need to verify your identity before responding.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office at https://ico.org.uk. We would appreciate the chance to address your concerns first.

Children

Watification is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.

Third-party services

The website and service link to or integrate with services operated by others, including Meta, Google, GitHub and Lemon Squeezy. Their handling of your data is governed by their own policies.

Changes to this policy

We may update this policy from time to time, including as the service develops. The current version is always published on this page with its "updated" date. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to let you know.

Contact

CarryCodes Ltd, 128 City Road, London, EC1V 2NX, United Kingdom. Email: privacy@watification.com.