1. Who we are
Watzup is a WhatsApp Business messaging platform operated by Muhammad Hassaan Sarfraz, a sole trader (enskild firma) established in Uppsala, Sweden. In this policy "we", "us" and "Watzup" mean Muhammad Hassaan Sarfraz, and "you" means the people whose personal data we handle. For any privacy question or to exercise your rights, contact us at info@watzup.se.
2. Scope — the two roles we play
We act in two capacities under the EU General Data Protection Regulation (GDPR):
- As a controller — for the account and identity data of our own customers and their team members (the people who sign up to and use Watzup). This policy governs that processing.
- As a processor — for the personal data our business customers put through the platform about their own end-customers (WhatsApp contacts and message content). For that data, our customer is the controller and decides how it is used; our handling of it is governed by our Data Processing Agreement (DPA), not this policy.
3. Personal data we collect
Data you give us (account & company)
- Identity & contact: name, email address, password (stored hashed), profile avatar, and — if you enable it — two-factor authentication secrets and recovery codes (stored encrypted).
- Company / billing details: company name, business email, phone, website, address, city, country, organisation number and VAT number.
Data we generate from your use
- Security & login records: IP address, browser/user-agent and timestamps of sign-ins; an activity/audit log of sensitive actions (e.g. team, role and billing changes).
- Sign-up source: the plan and billing period you picked on our website and, if the link you used carried them, the campaign tags (UTM parameters), the referring page and the page you landed on.
- Support and correspondence you send us.
Payment data
Subscription payments are handled by Stripe. We do not store full card numbers — only limited metadata (card brand, last four digits, expiry) and Stripe identifiers needed to manage your subscription.
End-customer data (processed on our customers’ behalf)
When our business customers use Watzup to message their own customers, the platform stores WhatsApp contact phone numbers and names, and the content of conversations. We process this only on our customer’s documented instructions, as their processor.
4. Why we use your data, and our legal bases
Swipe sideways to see the whole table →
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide, operate and secure the service; authenticate you | Performance of a contract |
| Billing, invoicing and collecting payment | Performance of a contract |
| Security, fraud prevention, audit logging and abuse detection | Legitimate interests |
| Service emails (verification, invitations, important notices) | Performance of a contract / legitimate interests |
| Understanding which pages and campaigns bring sign-ups | Legitimate interests |
| Answering messages you send us (for example by email) | Legitimate interests |
| Complying with tax, accounting and other legal obligations | Legal obligation |
| Optional product communications, where applicable | Consent (withdrawable at any time) |
5. Who we share data with (sub-processors)
We do not sell your personal data. We share it only with vetted service providers ("sub-processors") who help us run the platform, each bound by a data-processing contract. Our current sub-processors include Meta (WhatsApp delivery), Stripe (payments), Anthropic (AI replies), Resend (email) and our hosting provider. The full, current list — with purpose, data categories and safeguards — is maintained in our Sub-processor List at watzup.se/subprocessors. We may also disclose data where legally required, or to protect our rights and users.
6. International data transfers
Our servers are located in Frankfurt, Germany (EU), so your data is stored in the EU. Some sub-processors (e.g. Anthropic, Resend, and parts of Stripe and Meta) may process data in the United States. Where that happens, the transfer is protected by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with additional safeguards.
7. How long we keep your data
- Account and company data: for as long as your account is active.
- Account deletion: when you delete your account we schedule permanent erasure after a 30-day grace period (so it can be undone), after which the tenant and all associated personal data are permanently purged by an automated job.
- Conversations moved to Trash or marked Spam are permanently removed after 30 days.
- Records we must keep for legal reasons (e.g. invoices) are retained for the period the law requires.
8. Your rights
Subject to GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent where we rely on it. Watzup provides several of these directly in the app:
- Access / portability: download your personal data, and (for account owners) a full account export, from Settings.
- Rectification: edit your profile and company details at any time.
- Erasure: account owners can schedule account deletion (30-day grace, then permanent purge).
To exercise any right, use the in-app tools or email info@watzup.se. You also have the right to lodge a complaint with your data protection authority — in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY — imy.se).
9. How we protect your data
We apply appropriate technical and organisational measures, including: encryption in transit (TLS); hashed passwords and encrypted two-factor secrets; strict tenant isolation so one customer cannot access another’s data; role-based access control and optional two-factor authentication; an audit trail of sensitive actions; and EU-based hosting. No system is perfectly secure, but we work to protect your data and to notify you and regulators of any breach as required by law.
10. Cookies, and visitors to our website
The app (app.watzup.se) uses only strictly necessary cookies / local storage needed to keep you signed in and to operate it.
Our website (watzup.se) sets no cookies of its own and uses no analytics, advertising or cross-site tracking. If you email us, we use your name, email address and message only to reply, and keep them only as long as needed to handle your request. Like any web server, our hosting provider processes your IP address and browser details in short-lived server logs to deliver and secure the site.
If this changes — for example if we add analytics or advertising measurement — we will update this policy and ask for your consent first where the law requires it.
11. Children
Watzup is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified in-app or by email, and the "Effective" date above will be updated.
13. Contact
Questions or requests: info@watzup.se. Controller: Muhammad Hassaan Sarfraz (enskild firma), Uppsala, Sweden.