This Privacy Policy explains how apisapp ("we", "us", the "Service") collects, uses, shares, and protects information when you use our website at api-supp.com and the WhatsApp messaging API it provides. By creating an account or using the Service, you agree to this policy.
Information we collect
- Account information. When you sign up with email, we collect your email address and a password (stored only as a salted hash by our authentication provider). If you sign in with Google, we receive your email address, name, and profile picture from Google — we never receive your Google password.
- WhatsApp connection data. To connect a WhatsApp number you add through the portal, we store a label you choose, the phone number reported by WhatsApp, and credentials that let the Service operate that connection on your behalf. Messages you send and receive pass through our bridge to deliver them to and from WhatsApp.
- Usage and technical data. We keep operational logs (such as timestamps, request paths, and error information) to run and secure the Service. Secrets and tokens are redacted from these logs.
- Cookies. We use strictly necessary cookies to keep you signed in. We do not use advertising or cross-site tracking cookies.
How we use information
- To create and manage your account and authenticate you.
- To provision, display, and operate the WhatsApp numbers you connect, and to send and receive messages through the API.
- To send you essential service emails, such as sign-up confirmation and account notices.
- To maintain security, prevent abuse, debug problems, and keep the Service reliable.
- To comply with legal obligations.
We do not sell your personal information, and we do not use it for advertising.
How we share information
We share information only with service providers that help us run the Service, and only as needed for them to perform their function:
- Supabase — authentication and database.
- Vercel — application hosting.
- Google — sign-in, if you choose "Continue with Google".
- Resend — delivery of transactional email.
- Axiom — operational logging.
- Cloudflare — DNS.
- WhatsApp / Meta — delivery of the messages you send and receive.
We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the Service.
Data retention
We keep account and connection data for as long as your account is active. When you delete a connected number or your account, we remove the associated data from our systems, except where we must retain limited records to meet legal, security, or accounting obligations. Operational logs are retained for a limited period and then deleted or aggregated.
Security
We protect data in transit with encryption (HTTPS). Access to the underlying data is restricted: each account can only reach its own records, administrative credentials are held server-side and never exposed to the browser, and secrets are redacted from logs. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard safeguards.
Your rights
You can access and update your account information while signed in. You may request a copy of your data, correction of inaccurate data, or deletion of your account and associated data by contacting us. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honour valid requests under applicable law.
Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and significant changes may be communicated through the Service.
Contact us
For privacy questions or requests, contact us at yehudashtein@gmail.com.