Privacy Policy

Last updated: 19 August 2026 · Effective: 6 August 2026 · Applies to the GDPR (EU 2016/679), the UK GDPR and equivalent laws.

1. Who we are

This policy covers the Wanova browser extension, the wanova.io website, and the api.wanova.io account/licensing API.

Wanova is an independent product. It is not affiliated with, endorsed by, or sponsored by WhatsApp or Meta.

2. Two different relationships — which one you're in

Read this before the tables; it decides which parts apply to you.

• Your account data — we are the controller. Your email, plan, linked numbers and AI counters exist because you have an account with us. §3–§11 are about that.
• Your customers' data — you are the controller. The people you message are your contacts, not ours. For every local feature we are not even a processor: that data never reaches us. For managed AI we act as your processor, on your instructions, for the text you choose to send. The terms for that are in our Data Processing Agreement.

That second line has a consequence worth stating plainly: if you use Wanova to message people in the EU/UK, you need a lawful basis for doing so, you must tell them who you are, and you must honour opt-outs. We can't do that for you.

3. What we collect

This is the complete list of what reaches our servers. It mirrors our database schema exactly — there are no other tables.

4. Why we're allowed to — lawful bases

GDPR Art. 6 requires a lawful basis for each purpose. Ours, in full:

Where we rely on legitimate interests we have weighed them against your rights: the data involved is minimal (a request log, a list of your own linked numbers, a note you chose to send), it is what you would expect from a licensed tool, and none of it is used to profile you or to advertise. You can object to any of it under §11 — email us and say so.

We send no marketing email and run no newsletter. If that ever changes we'll ask for your consent first, and every message will have an unsubscribe link.

5. What we never collect

• Your chat contents. Messages you send or receive are never written to our database or logs — including messages passed through our AI relay (§7). We do record that an AI request happened and what it cost us (§3); we never record what was in it.
• Your contact list. It is never uploaded, exported to us, or synced anywhere.
• Your media. Photos, documents and voice notes never reach us, except a voice note you explicitly ask to transcribe (§7).
• Your broadcast lists and CSVs. They're read in your browser and stay there.
• Analytics on your behaviour. The site has no cookies, no analytics scripts, no advertising pixels and no third-party trackers — see Cookies & local storage.
• Special categories of data (Art. 9). We don't ask for any and we don't want any in the AI relay either — see the warning in §7.

6. What stays on your device

Most of what Wanova does never leaves your machine. Stored in your browser (localStorage, IndexedDB and the extension's own storage), and only there:

• Message templates and any media attached to them
• Customer stages, your hand-written notes, facts, promises and the follow-up list
• Broadcast audiences, imported CSVs and campaign progress
• Scheduled messages and auto-reply rules
• Translation cache (so re-reading a chat costs nothing)
• Messages recovered by the restore-deleted feature, including their media
• Your settings and preferences

We cannot read any of it. Clearing your browser data or removing the extension deletes it, and it is not backed up to us — so it is not synced between your devices either. Because it never reaches us, we also cannot export or delete it for you: the export in §11 covers our servers, and your own copy is yours to clear.

7. AI — exactly what happens

This is the one part of Wanova that sends anything anywhere, so here is the whole of it.

It is off until you turn it on. Nothing below happens on a default install.

Managed AI (using your plan's credits)

• What is sent: only the chat you are working in, and only its recent part — capped at 40 messages and 24,000 characters per request. Not your contact list, not your other chats, not your account. For voice transcription, the single voice note you clicked.
• Where it goes: your browser → our relay at api.wanova.io (Germany) → OpenRouter, the AI gateway we use, a company in the United States → Microsoft Azure's EU endpoint, which runs the model. We pin that endpoint on every request and turn the gateway's fallback off: if it is unavailable your request fails rather than quietly moving to a provider outside the EU. We also tell the gateway, on every request, that it may only use a provider which does not store the text at all — that instruction travels with the request, so it does not depend on a setting in some dashboard. All of them are named on the sub-processors page, which is the page that changes when a provider does.
• What we keep: no part of the request or the reply. Both are forwarded and returned in the moment and neither is written to our database or logs — there is nowhere in our schema they could go. What we do write down is the fact of the call: the counters and the technical record in §3 (when, which feature, how many tokens, which model, what it cost us, whether it worked). That record is what lets us bill your credits correctly and see our own AI costs; it can tell us you translated something on Tuesday, and never what it said.
• Roles: for this processing you are the controller and we are your processor — see the DPA, which also covers our sub-processors' obligations.
• Disclosure in the product: the extension shows you what was sent and to which provider, before and after each call.

No automated decisions about you

Nothing in Wanova makes an automated decision with legal or similarly significant effects about a person (Art. 22). The AI writes drafts, suggests follow-ups and grades your own leads — all of it advisory, all of it shown to you, and you press send. Lead grades are your working notes about your customers, produced on your instruction and stored on your device.

What we won't claim

We won't tell you your chats never leave your device — that stops being true the moment you turn AI on. What we'll tell you is exactly what leaves, when, and to whom. That is this section.

8. Who else is involved

We keep the list short on purpose, and we keep it public: the current sub-processors, what each one gets, where they are and how transfers are covered are on the sub-processors page. It is the authoritative version and it changes with notice (§8 of the DPA).

In summary: a payment provider (only if you subscribe), Google (only if you use Google sign-in), an email delivery provider (only if you ask for an email sign-in code), our AI gateway and its model provider (only if you turn managed AI on), and our hosting provider (which stores the database in §3). We don't sell your data, we don't share it for advertising, and we don't buy data about you.

9. Sending data outside the EEA

Your account data sits in the EEA. The database and its daily backups run on servers operated by Hetzner Online GmbH in Nuremberg, Germany, and our payment provider is in Estonia. Everything we store about you stays there — the sub-processors page gives the location of each one, a row at a time.

Managed AI: the model runs in the EU, the gateway in front of it does not. If you turn it on, the model that reads your text runs at Microsoft Azure in the EU — we pin that endpoint on every request and switch the gateway's fallback off, so a request fails rather than silently moving to a provider outside the EU (§7). What we cannot place in the EEA is the gateway itself: OpenRouter is a United States company, so the routing leg is a transfer, and it rests on the Standard Contractual Clauses below. Nothing from those requests is stored by us either way. If you never turn managed AI on, none of this applies to you — it is off until you switch it on.

Two further things reach outside the EEA, and we would rather name them than let the paragraphs above imply otherwise:

• Us. The people who operate the service — including whoever takes or restores a backup — are not all inside the EEA. So our own access to your account data can be a transfer, even though the servers are not.
• Email sign-in codes. They are sent from Ireland, but the delivery provider's parent company is in the United States and can reach the service from there.

Where a transfer does happen, this is what it rests on:

• Where an adequacy decision applies (Art. 45) we rely on it.
• Otherwise we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c)), plus the UK International Data Transfer Addendum for UK users, concluded with each sub-processor. The sub-processors page names the mechanism per provider.
• Supplementary measures: everything is in transit over TLS; chat content is relayed and never stored; what we do store is the short list in §3; and access to production data is limited to the people who operate the service.
• You can ask for a copy of the safeguards we rely on — email [email protected] and we'll send them.

If you would rather no chat text left your own machine at all, leave AI off; the local features work either way.

10. How long we keep things

11. Your rights

Under the GDPR/UK GDPR you have the rights below. Two of them are buttons rather than requests — we'd rather you didn't have to ask.

We answer requests within one month, free of charge; for an unusually complex request we may extend by two further months and will tell you why (Art. 12(3)). We may ask you to confirm who you are before acting on an emailed request — usually just replying from the account's email address.

You can also unlink a number yourself at any time from your account page. Anything stored on your own device (§6) is yours to clear by removing the extension or clearing your browser data.

12. Complaints

Tell us first if you can — [email protected] — but you don't have to. You may complain to the data protection authority where you live, work, or where you think something went wrong. In the EU/EEA that's your national authority (the list is published by the European Data Protection Board at edpb.europa.eu); in the UK it's the Information Commissioner's Office (ico.org.uk); in Switzerland the FDPIC.

13. How we protect it

Our measures under Art. 32, stated concretely rather than as adjectives:

• Everything travels over HTTPS/TLS; the API accepts nothing else in production.
• Passwords are stored as bcrypt hashes. We cannot read them, and a password can never appear in your data export.
• Licences are signed with Ed25519 and verified offline by the extension; the private key never leaves the server.
• Chat content is never persisted — the strongest protection available is not having the data.
• The extension keeps your settings backup in the browser's own extension storage, not in page storage that any site could reach.
• Administrative access is role-gated and every mutating admin action is written to an audit trail (who, what, when, from where).
• Sessions expire after 30 days; deleting your account destroys its records in a single database transaction.

If a breach happens we will notify the competent supervisory authority within 72 hours of becoming aware where the law requires it (Art. 33), and tell affected users directly without undue delay when the risk to them is high (Art. 34). We'd rather tell you early and awkwardly than late and neatly.

14. Children

Wanova is a business tool and is not directed at children. We don't knowingly collect data from anyone under 16; if we learn we have, we delete it. Don't create an account if you're younger than that.

15. Changes

If we change what we collect or who we send it to, we'll update this page and its date. Material changes — a new AI provider, a new sub-processor — are announced before they take effect: in the product, and on the sub-processors page, which has its own change log.

16. Contact

See also our Terms of Service, the Data Processing Agreement and the cookie statement.