Privacy policy

1. Controller

EINSZWEIDREI Solutions UG (haftungsbeschränkt)
Hochstraße 2
56242 Ellenhausen
Germany
Email: hello@whazzup.io

The controller within the meaning of Art. 4 No. 7 GDPR decides on the purposes and means of the processing described below.

2. Data we collect

Depending on how you use Whazzup, we collect the following categories of data:

• Account data: name, email address, password (stored only as a cryptographic hash), company name, website and logo.
• Onboarding and settings data: your role, time zone, support hours, widget appearance and configuration choices.
• Usage and log data: IP address, date and time of access, browser type and version, operating system, pages requested and referrer URL.
• Support conversation content: messages, attachments, contact details of your customers and technical context such as the page a visitor was on when starting a conversation.
• Widget data: interactions of website visitors with the chat widget, selected topics and, where enabled, session context such as current page and browser.

3. Visiting our website

When you open our website, your browser automatically transmits technical data (IP address, date and time, browser type, requested page). We process this data to deliver the site securely and reliably and to detect and prevent abuse. Legal basis: our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). Server logs are deleted after a short period unless they are needed to investigate an incident.

4. Account, login and Google sign-in

To create and manage your account we process your email address, password (hash only), name, company and onboarding settings. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).

If you choose to sign in with Google, Google Ireland Limited / Google LLC transfers your name, email address and profile picture to us after you confirm the sign-in on Google's site. We use this data exclusively to create or access your Whazzup account and to authenticate you on later visits. We do not send data back to Google beyond what is technically required for authentication, and we do not receive access to your Google password, emails, files or other Google services. The legal basis is performance of a contract (Art. 6 (1) (b) GDPR); the data transfer by Google itself is governed by Google's privacy policy.

If you reset your password, we send you an email with a recovery link. This email is sent solely to fulfil your request (Art. 6 (1) (b) GDPR).

5. Purposes and legal bases

6. Support conversations, widget and your customers

If you contact us via chat, email or the widget, we process the content of your message, your contact details and technical context such as the page you were on. This is used solely to answer your request.

If you embed the Whazzup widget on your own website, we process your visitors' conversation data on your behalf as a data processor (Art. 28 GDPR). You remain the controller towards your visitors and are responsible for informing them in your own privacy policy. Visitors are not tracked across websites, and we do not build advertising profiles from widget data.

Screen sharing only starts after the visitor explicitly agrees in the moment. Nothing is recorded without a separate notice, and the session can be ended at any time.

7. Recipients and processors

We work with carefully selected service providers who process data on our behalf under a data processing agreement (Art. 28 GDPR), in particular:

• Supabase (database, authentication, file storage)
• Our hosting and content delivery provider (serving the website and app)
• Google, only if you choose Google sign-in (identity provider)

Where data is processed outside the EU/EEA, this takes place on the basis of the EU standard contractual clauses or an adequacy decision. We do not sell personal data and do not share it with third parties for their own marketing purposes.

8. Cookies and local storage

We use technically necessary browser storage only. We do not use advertising, analytics or cross-site tracking cookies. Concretely, your browser stores:

• Session token (keeps you signed in; provided by Supabase Auth)
• Language preference (English or German)
• Interface preferences such as sidebar state, widget configuration and workspace settings

You can delete this data at any time via your browser settings; the app then simply forgets your preferences.

9. Retention

• Account and settings data: stored for as long as your account exists; deleted or anonymized after account deletion, unless statutory retention applies.
• Support conversations: stored for as long as needed to handle the request and as long as the customer account exists.
• Server logs: deleted after a short period (typically a few weeks), unless needed to investigate an incident.
• Billing records: retained according to statutory tax and commercial law periods (in Germany generally 6 to 10 years).

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR).

You also have the right to lodge a complaint with a supervisory authority. Responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany.

To exercise your rights or ask any data protection question, write to hello@whazzup.io.

11. Changes to this policy

We update this privacy policy when our processing changes or when the law requires it. The current version is always available on this page with its date of last update.