Privacy Policy

Last updated: October 30, 2026

Waslo is a project of Tec-ads LTD, Mersin, Türkiye. Waslo ("we", "us", or "our") operates the Waslo platform at waslo.io and the website chat widget served from waslo.org. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Account Information

When you create an account we collect your name, email address, and password (hashed). If you sign in with Google OAuth we receive your Google profile name, email, and profile image.

Channel Data

Waslo connects to multiple messaging channels — WhatsApp (QR or Cloud API), Telegram, Instagram, Messenger, Outlook email, and the website chat widget. Gmail is in early access and not generally available. When you connect a channel, we store the encrypted authentication state (OAuth tokens, bot tokens, or session credentials, depending on channel) required to maintain the connection. We process incoming and outgoing messages on connected channels to provide AI responses, lead classification, and conversation history. Message content is stored securely to power conversation features and is associated with your organization. Channel-specific scopes are limited to messaging permissions only — for example, we do not request post or publish permissions on Instagram or Facebook.

Telegram Business. If you connect your own Telegram account to Waslo as a chatbot (Telegram Premium → Settings → Telegram Business → Chatbots), Telegram sends us the messages of the chats you choose there. We use them only to answer those customers on your behalf, which includes sending the message text to our AI service provider to generate the reply (Section 5), and we never use them for any other purpose or share them with anyone else. Messages you type yourself in those chats are stored so the agent steps back in that conversation. You can stop at any time by removing the chatbot in Telegram or disconnecting it in Waslo.

Lead Data

We store lead information including phone numbers, names, conversation history, classification status, and any data imported via CSV import or CRM integrations.

Usage Data

We automatically collect information about how you interact with the platform, including pages visited, features used, and timestamps.

Mobile App

If you use the Waslo app for iPhone, we store a notification token for your device, along with the device name iOS reports (normally just "iPhone"), the app version, the app's language and whether it is a test or App Store build, so we can send you the alerts you turn on. Your notification choices (which alerts, quiet hours) are stored with your account. We stop using the token when you sign out of the app or when Apple reports it is no longer valid, and it is deleted with your account. If you sign in with Apple or Google in the app, we receive an account identifier and email address from that provider and use them to find your Waslo account, or to create one when you choose to. Purchases in the app (credit packs and the Growth plan) are made with Apple's In-App Purchase: Apple processes the payment, and we receive, through RevenueCat, the product, price, date and status of each purchase for your workspace — never your payment details. To learn which of our ads bring people to the app, the app uses Singular. It asks once for permission to track (Apple's App Tracking Transparency), and uses your device's advertising identifier only if you allow it; without permission, Apple reports results in aggregate, not linked to you. Your answer never changes what the app does.

2. How We Use Your Information

• Provide, maintain, and improve the Waslo platform
• Generate AI-powered responses to customer messages on connected channels
• Classify leads and trigger automated follow-ups
• Send notifications via Telegram when configured
• Support CSV import/export of your lead data and configurable inbound/outbound webhooks, including optional CRM sync integrations, as configured
• Process billing and manage your subscription
• Send service-related communications
• Detect and prevent fraud or abuse
• Run the website chat widget on the websites you list, and import public pages from your own website into your knowledge base when you ask us to

3. Website Chat Visitors

When a business that uses Waslo adds the website chat widget to its website, Waslo processes data about the people who chat on that website ("visitors"). For this data, the business is the controller and Waslo is its processor: the business decides whether to offer the chat, which details to ask for, and how long anonymous conversations are kept.

• Nothing is stored before the chat is opened. The widget is served from a separate domain (waslo.org) in a frame on the business's website. It stores nothing until the visitor opens the chat.
• Bot check. On first open, a Cloudflare Turnstile check runs to keep automated abuse out. Cloudflare receives the visitor's IP address and browser signals for that check.
• Visitor token. An opaque, random visitor token is stored in the browser's local storage. It expires 30 days after the visitor's last activity, and each visit extends it. It is used only to reconnect the visitor to their own conversation.
• Contact details. The business may ask for a name, email address or phone number, as an optional or required field — the business's choice.
• Conversation. Messages, replies and satisfaction ratings are stored. Replies are generated by AI, as described in Section 5. When a team member answers, the visitor sees that team member's display name.
• AI disclosure. The widget always shows the visitor that replies come from an AI agent.
• Linking to other channels. Waslo never merges a website visitor with a contact from another channel on its own. A possible match is only ever a suggestion that a team member confirms.
• CRM sync. If the business connects HubSpot, a website visitor is sent to HubSpot only after they share an email address or phone number.

Visitors who want to access, correct or delete their data should contact the business that runs the website. Waslo assists that business in answering the request. If a visitor contacts us directly, we refer the request to the business and help it respond.

4. Website Content You Import

You can ask Waslo to scan your own website and import its pages into your knowledge base. Our crawler:

• identifies itself with the user agent WasloSiteBot/1.0;
• reads only public HTTPS pages on the same site you enter;
• follows the site's robots.txt rules;
• refuses private network addresses;
• runs up to 3 scans per workspace per day.

You review the pages found before anything is imported. Imported content stays in your knowledge base until you delete it. Scan results are deleted after 30 days.

5. Third-Party Services and Sub-processors

We share limited data with the service providers that help us operate the platform. Each provider receives only the data it needs for its function and has its own privacy policy.

Integrations you enable. Services you connect yourself — such as HubSpot, Shopify and other stores, Google Calendar or Telegram notifications — receive data only after you enable them, and only the data that integration needs.

AI replies. Replies and lead classifications are generated by our AI service provider. To produce a reply, Waslo sends the provider the message text (and any image, voice note or file the agent needs to understand) together with the context the agent needs, such as relevant passages from your knowledge base. The provider processes this content to generate the reply and may process it outside the European Union. Our Data Processing Agreement describes the safeguards that apply to these transfers.

AI disclosure. Replies sent by Waslo are written by an AI agent unless a team member answers personally. On the website chat widget this is always shown to the visitor.

6. Google API Services — Limited Use

Waslo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, when you choose to connect Google Calendar, Waslo requests only the calendar.events scope — used to read your availability and to create, update, or cancel appointment events on your behalf. Information obtained from Google Calendar is used solely to provide the in-product scheduling and booking features you enable. We do not:

• transfer this data to others, except as necessary to provide or improve the booking feature, to comply with applicable law, or as part of a merger or acquisition;
• use this data for serving advertisements; or
• allow humans to read this data, unless we have your affirmative agreement for specific items, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized.

7. Meta Platform Data

Waslo's use of data received from Meta Platforms (Facebook Messenger and Instagram) complies with the Meta Platform Terms and Developer Policies.

When you connect a Facebook Page or Instagram professional account, Waslo requests only messaging-related permissions — such as receiving and sending messages and reading the basic Page or account profile needed to route conversations. We do not request permission to publish or post content. Information received from Meta — including message content and the page-scoped IDs (PSIDs) of people who message you — is used solely to provide the AI messaging, lead management, and conversation features you enable. We do not sell this data, use it for advertising, or transfer it to third parties except as necessary to provide the service or comply with applicable law.

You can request deletion of your Meta-sourced data at any time through our Data Deletion page or via Meta's data deletion callback.

8. Data Storage and Security

Your data is stored in the European Union (the Netherlands), in encrypted databases hosted by our cloud infrastructure provider. AI replies are generated as described in Section 5, which may involve processing outside the EU. Channel authentication credentials (WhatsApp sessions, OAuth refresh tokens for Outlook and Meta, Telegram bot tokens, etc.) are encrypted at rest using industry-standard authenticated encryption. All data is transmitted over HTTPS/TLS. We implement rate limiting, security headers, and token-based authentication to protect access.

9. Data Retention

• Account and conversation data is kept for as long as your account is active.
• Photos, voice notes and files in conversations (sent by your customers, or by you from the mobile app) are deleted 90 days after they are received; the message text stays. When an account is deleted, they are deleted with it, within the same 30 days.
• Website chat — anonymous visitors. Visitors who gave no name, email or phone number, and whom the business has not marked as qualified or booked, are deleted, together with their conversations and ratings, 30, 90, 180 or 365 days after their last message, as the business chooses (180 days by default). The business may instead choose to keep them ("never").
• Website chat — visitors who shared contact details are kept as leads while the business's account is active.
• Empty website chat sessions (opened but no message sent) are deleted a day after they expire.
• Website scan results are deleted after 30 days. Content you import stays in your knowledge base until you delete it.
• Account deletion. If you delete your account, we delete your personal data and conversation history within 30 days, except where we are required to retain it by law.

10. Data Isolation

Waslo is a multi-tenant platform. Each organization's data is strictly isolated — you can only access data belonging to your own organization. All queries are scoped by organization to prevent cross-tenant data access.

11. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your lead and conversation data
• Withdraw consent for data processing

To exercise any of these rights, contact us at hello@waslo.io.

12. Cookies and Similar Technologies

On waslo.io. We use essential cookies and local storage for sign-in, session, language and theme. These are needed for the site to work and are always on.

Analytics and advertising tags — Google Tag Manager, Google Analytics 4, Google Ads, Meta Pixel, TikTok Pixel, X Pixel and Snap Pixel — and the matching server-side conversion events load or are sent only after you accept them in the cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer.

In the website chat widget. The widget sets no advertising or analytics cookies. When a visitor opens the chat, it stores the visitor token described in Section 3 in the browser's local storage, and Cloudflare Turnstile runs its bot check.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at: hello@waslo.io