Privacy policy.

TurbineWeb operates TurbineWhats. This policy explains how we process account, connection, messaging, and technical data when providing the service. Contact support in your workspace for questions or requests about personal data.

Data we process

Account information includes your name, email, password hash, verification status, and optional authenticator secret. Connection information includes linked phone numbers, session identifiers, connection state, and encrypted authentication material. Message data may include recipient phone numbers, message content, media, and delivery events. Technical and security records include request limits, timestamps, audit events, and hashed network identifiers and hashed phone-number claims used to prevent repeated trials.

Why we use it

We use data to authenticate you, operate customer-owned WhatsApp connections, dispatch messages, deliver webhooks, support customers, process billing, prevent abuse, and comply with legal obligations. Customers determine the purpose and lawful basis of their own recipient messaging. You must have permission to provide recipient and conversation information to the service.

Service providers

Infrastructure and object-storage providers support hosting and recovery. Cloudflare may process network and verification data. Resend may process transactional email. Polar processes payments and tax information; we do not store full card numbers. WhatsApp and Meta independently process messages and account information under their own policies. We do not sell message content or use it to train general-purpose AI models.

Retention

Our default application policy clears message and webhook payloads after seven days. Delivery metadata, usage records, abuse-prevention information, and audit events may remain for operational and security purposes. Financial records are retained as required by law. Active connection credentials remain while the session exists; deleting a session instructs the gateway to remove its connection. Backup copies expire according to the configured retention policy and are not selectively edited immediately.

Security

Passwords and API tokens are hashed; integration and message secrets are encrypted. Access checks bind resources to the customer account. Cookies support sign-in and security, rather than advertising. No system can promise absolute security. Protect your own API keys and webhook secrets, restrict access to your applications, and revoke compromised tokens promptly.

Your choices and rights

You can change verified account details, revoke API keys, remove webhook destinations and sessions, and cancel subscription renewal. Contact support to request access, correction, deletion, or export of personal data, subject to identity verification and lawful retention obligations. Depending on your location, you may also have rights to object, restrict processing, or complain to your data-protection authority.

International processing and updates

Service providers may process data outside your country. Appropriate contractual safeguards apply where required. Material privacy changes will be communicated through the service or your account email. This policy applies to TurbineWhats; linked TurbineWeb products have their own policies.