Privacy Policy

W2A GLOBAL TECH ("W2A", "we", "us") is the business name used for our technology consulting and W2A Tech software services. Contact us about privacy at info@w2aglobal.com.

This policy covers information we handle about business customers, authorized platform users, people who contact us, and people whose communications are processed through our services. When a business uses W2A Tech to communicate with you, that business determines the purposes of its customer relationship and the information it provides to us. We process those records on its behalf. Its privacy notice also applies. We handle our own account administration, service operations and direct business inquiries for our own purposes.

Account and business information includes names, email addresses, organization details, user roles, invitations, password hashes, session records and password-reset records. We use an authentication cookie when you sign in. The public legal pages do not require an account or an authentication cookie.

Customer records may include names, phone numbers, email addresses, channel identifiers, preferences, consent or opt-out records, notes, tags, sales opportunities and financial records entered by the business. The information present depends on how that business uses the service.

Communications include incoming and outgoing message text, supported attachments, sender and recipient identifiers, timestamps, delivery and read status when provided by the channel, and human support or automated response records. We also process knowledge-base material that businesses provide for their assistants.

Operational information includes audit records, usage and performance measurements, errors, user-agent information and hashed IP information in application security records. Hosting and communications providers may separately process connection information, including IP addresses, to deliver and secure their services.

We use information to provide consulting and software services, administer accounts and permissions, route customer conversations, assist support teams, generate authorized AI responses, maintain customer and business records, and provide reporting. We also use information to troubleshoot, prevent misuse, protect accounts, handle requests and meet applicable legal obligations.

Where a law requires a legal basis, the basis depends on the activity and our role. It may include performing a contract or requested pre-contract steps, legitimate interests in operating and securing a business service where permitted, compliance with a legal obligation, or consent where required. Businesses using the platform are responsible for identifying the appropriate basis for the information and messaging they direct us to process. Availability of a messaging feature does not itself establish consent to contact a person.

When a business connects WhatsApp Business Platform, W2A Tech receives messages and related metadata through the authorized integration and sends messages on that business's behalf. Authorized staff can review conversations and handle them directly. Channel identifiers and delivery events help associate messages with the correct business and conversation.

Meta and WhatsApp operate their own services under their applicable terms and privacy notices. W2A does not control all copies or processing performed independently by those services. Deleting a W2A record does not automatically delete information retained independently by Meta, WhatsApp, a business customer or a message recipient.

When an AI feature is enabled, relevant conversation text, instructions, customer context and knowledge-base excerpts may be sent to an AI provider to generate replies, summaries, classifications or extracted information. The current production integration uses OpenAI. The software also supports an alternative Anthropic integration when separately configured; this does not mean every conversation is sent to both providers.

AI outputs can be incomplete or inaccurate and may be reviewed or corrected by authorized people. Provider processing and retention depend on the applicable service terms, agreements and account settings. We do not promise that an AI provider never processes or retains submitted information. Do not submit information that is unnecessary for the service or that you are not authorized to share.

Service providers involved in current operations include Netlify for application hosting, managed database and attachment storage; Meta/WhatsApp for connected WhatsApp communications; OpenAI for enabled AI processing; and Resend for service emails such as password-reset messages. They receive the information needed for the functions they provide. We can provide further information about the providers relevant to your use of the service on request.

Information in a business workspace is available to users authorized by that business according to their permissions. We may also disclose information when required by applicable law or a valid legal process, or where necessary and permitted to protect people, investigate abuse or defend legal rights.

The application uses organization-scoped access controls, role-based permissions, hashed passwords and session tokens, credential redaction and audit records. Public legal pages do not provide access to private workspace records. These controls reduce risk but cannot guarantee absolute security. Customers are responsible for protecting their accounts and assigning appropriate access to their users.

Retention depends on the record, the business relationship, the customer's instructions, applicable agreements and legal or operational requirements. The current platform does not apply a universal automatic deletion period to all conversations and customer records. Removing a record from an interface or closing access does not necessarily permanently erase all related information.

Deletion requests are reviewed manually. Some information may need to be retained for legal obligations, security, fraud prevention, disputes or the rights of others. Where backups or provider-held copies are relevant, their treatment must be considered separately. We do not promise immediate deletion from every system. Ask us about the records and retention applicable to your request using the Data Deletion Instructions.

Depending on your location and the law applicable to the processing, you may have rights to access, correct, delete or obtain a copy of personal information, restrict or object to processing, withdraw consent, or appeal a decision about a privacy request. Withdrawal does not invalidate processing that was lawful before withdrawal. Where applicable, you may complain to your local data protection authority and exercise rights without unlawful discrimination.

Send requests to info@w2aglobal.com. Tell us which business or W2A account is involved and what you are requesting. We may need proportionate information to verify identity or authority. If we process the records on behalf of a business customer, we may need to coordinate with that business. You may also contact the business directly. Applicable exceptions and legal response requirements depend on the request and jurisdiction.

Our services and providers may process information in the United States or other countries, including countries with different data protection laws from your own. Requirements for international transfers depend on the parties and jurisdictions involved. Contact us for information about the locations and arrangements applicable to your service. This policy does not assert participation in a certification scheme or a particular transfer framework.

We may update this policy as our services or applicable requirements change. The published version will identify its effective date. Material changes will be communicated as required by applicable law. For questions about this policy, providers, retention or your information, contact W2A GLOBAL TECH at info@w2aglobal.com.