Privacy Policy
Last updated 28 October 2026
This policy explains what personal data WAButton handles, why, and what rights you have over it. It covers our website, our dashboard, and the chat widget our customers embed on their own sites.
Who we are
WAButton provides an embeddable WhatsApp chat and lead capture widget. For questions about this policy or about your data, contact privacy@wabutton.app.
Two different roles
This distinction matters, because it decides who you should contact about what.
- For our own customers, we are the controller. When you create a WAButton account, we decide what account data we hold and why.
- For the people who message our customers, we are a processor. If you filled in a form on a business's website and it was powered by WAButton, that business is the controller of your data. We handle it on their instructions. Please contact them first. If you cannot reach them, write to us and we will help.
What we collect
Account data
Your name, email address, hashed password, and the organisation and team membership you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google. We never receive your Google password.
Website headline measurement
On the English homepage, we record which headline was shown, a broad source category, whether the page was viewed at a mobile or desktop width, and a random reference for that page load. The signup link carries that reference. If you create a new account, we save the reference with your account so we can count signups, created buttons and detected installations for each headline. These records do not include raw campaign tags, referrer addresses, IP addresses or message content. We do not write cookies or browser storage for this measurement. We skip it when your browser sends Do Not Track or Global Privacy Control.
Website and sign-up analytics
We use Google Analytics 4 on our website and on the dashboard pages for signing in, registering and first setup. It tells us which pages people visit, where they came from, and how many go on to create an account. We send it two events of our own: a click on a sign-up link, with the part of the page it was in, and a completed sign-up, with whether it used email or Google. We send no name, email address, account identifier or form content.
In the EEA, the UK and Switzerland its cookies stay off until you accept them in our banner. Elsewhere they are on unless you reject them. While they are off, Google receives a page view without cookies or an identifier from your browser. We have turned off Google signals and ad personalisation for this property. Google Analytics keeps this data for the retention period set in our account, at most 14 months.
Billing data
Your plan, billing period, and subscription status. Payments are processed by Stripe. We do not store card numbers. Card details are entered directly with Stripe and never reach our servers.
Widget configuration
Everything you set up in the editor: agent names and WhatsApp numbers, greetings, business hours, routing rules, form fields, and the domains you have authorised.
Leads captured through widgets
Whatever the widget owner chose to collect before the conversation moves to WhatsApp, which is typically a name, an email address or phone number, and a message. The widget owner decides these fields. We store them so the owner can see and export them.
Technical data
IP address, user agent, and requested page. We use these to apply rate limits, enforce the IP blocking and domain restrictions our customers configure, resolve country for geo targeting, and investigate abuse. IP addresses are not used to build advertising profiles.
Sign-in sessions
When you sign in to the dashboard, we keep a record of that session for security: when it started and was last used, how you signed in, the IP addresses it was used from, and what your browser reports about itself (user agent, preferred languages, device type and time zone). We derive the country and network of each IP address from a database held on our own servers; the address is not sent to a third party for this. Our staff use these records to protect your account and to detect automated or abusive use of the service.
Error and diagnostic data
When something breaks, our error monitoring records the technical context of the failure. This can incidentally include an account identifier.
When a script on our website or dashboard fails in your browser, the page sends us a short report: the error message and where in our code it happened, the page address without its query or fragment, our release version and your browser family. It carries no account identifier, email address or form content, and we mask anything shaped like an email address before storing it. These reports are kept in Google Cloud Logging and Error Reporting.
Why we are allowed to process it
| Data | Lawful basis |
|---|---|
| Account and widget configuration | Performance of our contract with you |
| Billing | Performance of contract, and our legal obligation to keep financial records |
| Leads captured through a widget | Processed on the widget owner's instructions, under their lawful basis |
| Security, rate limiting, abuse prevention | Our legitimate interest in keeping the service available and unabused |
| Error monitoring | Our legitimate interest in a service that works |
| Google Analytics | Consent in the EEA, the UK and Switzerland. Elsewhere, our legitimate interest in knowing how people find and use our website, which you can object to by rejecting analytics cookies |
| Marketing email to customers | Consent, withdrawable at any time |
Who else touches your data
We use a small number of sub-processors. We do not sell personal data to anyone.
| Provider | Purpose | Where |
|---|---|---|
| Google Cloud | Application hosting, databases, logs and error reports | Belgium (europe-west1) |
| Cloudflare | Edge delivery of the widget script | Global edge network |
| Stripe | Payment processing and subscription billing | EU and US |
| Resend | Transactional email | EU and US |
| Sentry | Error monitoring | EU |
| Optional sign-in with Google | EU and US | |
| Google Analytics | Website and sign-up analytics | EU and US |
We may also disclose data where the law requires it, or to establish or defend legal claims.
Where your data lives
Our application servers and databases run in Google Cloud's europe-west1 region in Belgium. Some sub-processors above operate outside the UK and the EEA. Where that happens, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
How long we keep it
- Account and widget data: while your account is open, then deleted within 90 days of closure.
- Leads: until the widget owner deletes them or closes their account.
- Billing records: six years, as UK tax law requires.
- Technical and security logs: up to 90 days.
- Sign-in session records: 90 days after the session expires.
- Headline page-view records: 90 days. The signup reference stays with your account data.
Your rights
Under the UK GDPR and the EU GDPR you can ask us to:
- give you a copy of your data, or send it to another provider
- correct data that is wrong
- delete your data
- restrict or object to how we process it
- withdraw consent you previously gave, without affecting what came before
Write to privacy@wabutton.app and we will respond within one month. You do not have to pay to exercise these rights.
If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.
Cookies
Our dashboard sets cookies to keep you signed in and to protect sign-in. Those cookies are strictly necessary, so they do not require consent. This website does not set advertising cookies. Google Analytics cookies are set only as described above, and you can change your choice on the Cookie Policy page. The embedded widget does not set cookies. It uses your browser's local and session storage, for example to remember that it has already greeted a visitor, to keep a random visitor reference and to hold a form that is being filled in.
Our Cookie Policy lists every cookie and similar storage item we use, and what each one is for.
Security
Data is encrypted in transit. Passwords are hashed, never stored in readable form. Access to production systems is limited to those who need it. No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your rights, we will notify the ICO within 72 hours and tell you where the law requires it.
Children
WAButton is a business tool and is not directed at children under 16. We do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
Changes
We will update this page when our practices change and revise the date at the top. If a change materially affects your rights, we will tell account holders by email.