Privacy Policy

Last updated: 17 October 2026

This policy explains what personal information WhatsHook LTD (“WhatsHook”, “we”, “us”) collects when you use WhatsHook, or when your messages are in a chat that a WhatsHook user has picked, and what we do with it. We are the controller of this information under UK data protection law (the UK GDPR and the Data Protection Act 2018) and, where it applies, the EU General Data Protection Regulation. See also our Terms of Service.

In short

Only messages from the chats you pick (all your one-to-one chats, if you turn on All chats) reach our database and the AI apps you allow, and only their last 90 days. Our database also holds your chat list (names only), so you can pick. Your reader server keeps 90 days of your other chats, so a chat you pick later comes with its history.
We never send messages, sell your data, use it for advertising or use it to train AI.
Our staff tools don't show message content, and we don't read your messages.
You can delete your WhatsApp data at any time from your dashboard.

1. Who we are

WhatsHook LTD, a company registered in England and Wales (company number [company number]), registered office [registered office address]. For anything about your personal information, email hello@whatshook.com with “Privacy” in the subject line.

2. What we collect about you as a user

Account: your email address. If you sign in with Google, Google also shares your name, profile picture and Google account ID with us.
Sign-in and security: when you sign in, your IP address and browser details, kept by our sign-in provider to keep your account secure.
Your agreement: when you accepted our Terms of Service.
Your WhatsApp connection: your WhatsApp phone number; your linked-device login, encrypted; and connection details, such as when your reader last connected and when your phone was last online.
Your chat list: the names and WhatsApp IDs of your chats and groups, as WhatsApp shows them to you (which can include saved contact names, business names and phone numbers), and when each last had a message, so that you can pick which to share. This covers all your chats, but only their names, not their messages.
Messages from the chats you pick (every one-to-one chat, new ones included, while All chats is on): the text and captions, and details such as who sent each message, their WhatsApp name and ID, when it was sent, and a file's name or type. We don't download photos, videos, voice notes, documents or other files.
On your reader's own server only: the last 90 days of messages in your other chats (and any Status updates or channel posts WhatsApp sends it), so that a chat you pick later arrives with its recent history. These never reach our database or your AI apps unless you pick the chat.
Connected AI apps: which apps you allowed, when, and when they last used WhatsHook. We store only scrambled (hashed) versions of their access tokens.
Usage counts: for example, how many messages we stored for you and when your AI apps last used WhatsHook. These are counts, never content.
Payments: your Stripe customer number, your subscription status and dates, and whether a payment has failed. Stripe, our payment provider, holds your card details; we never see your full card number.
Free-trial check: a scrambled code made from your WhatsApp number, so that each number gets one free trial. It can be matched back to the number, so we protect it like the number.
Waitlist: if sign-ups are paused and you join the waitlist, when you joined, so we can email you when there's room.
Messages you send us: if you email us, your email address and what you tell us.
Technical logs: our hosting providers record technical information, such as IP addresses and the times of requests, to run and protect WhatsHook. Our logs don't contain message content.
Visit counts: when you open a page on our website, we count it: the page, the website or link tag that sent you, your country (from your IP address) and whether you use a phone, tablet or computer. We don't keep your IP address or use cookies for this; a code that changes every day lets us count visitors without recognising you from one day to the next.
Advertising (only if you accept cookies): if you press Accept on our cookie banner, Meta's Pixel runs on our website and sets Meta's cookies (_fbp, and _fbc if you came from a Meta ad). Meta then learns which pages you open. When you create an account, start checkout, start a free trial or make your first payment, we also tell Meta from our server, sending a scrambled (hashed) copy of your email address and account number, those cookies, your IP address and browser details, and for payments the amount. We keep those cookies, your IP address and browser details with your account, and with your checkout at Stripe, for this. We never send Meta anything about your WhatsApp or your chats. If you press Reject, or don't answer, none of this happens.

3. If you're in a chat with a WhatsHook user

If you chat with a WhatsHook user, their reader server keeps the last 90 days of that chat on its own disk, whether or not they pick it, so that it can be picked later. Its messages never reach our database or their AI app unless they pick it. If they do:

we store the messages you send in that chat, your WhatsApp name, your WhatsApp ID (which can include your phone number) and when you sent each message, for at most 90 days;
if you have a chat with them, your name (as they saved it, or your WhatsApp name) and your WhatsApp ID are kept in their chat list in our database until they stop using WhatsHook or delete their data; and
your messages are passed to the AI app the user has allowed, when they ask it about their chats. The AI provider handles what it reads under its own terms and, depending on the user's settings, may keep it or use it to improve its models.

If you delete a message for everyone, WhatsHook deletes it too, and if you edit one, it keeps only the new text. Messages from chats with disappearing messages switched on are kept for up to 90 days, even after they disappear in WhatsApp.

We get this information from the user's WhatsApp account, because they asked us to. We process it in their legitimate interests and ours: letting people read and search their own conversations with an AI app they choose. Only picked chats reach our database or the user's AI app; we keep it read-only, delete it after 90 days, don't let our staff see it, and never sell it, use it for advertising or use it to train AI.

We have no way to tell everyone in our users' chats individually, so we publish this section instead. You have the rights in section 10. You can ask the person who picked the chat to un-pick it, or email us with your phone number and the chat or group concerned, and we will deal with your request as the law requires, for example by deleting your messages from our systems.

4. How we use information, and our legal reasons

To provide WhatsHook: link your WhatsApp, show your chat list, store messages from the chats you pick and give them to the AI apps you allow. Legal reason: our contract with you. For other people's information in your chats: legitimate interests (yours, in using your own conversations with an AI app you choose, and ours, in providing WhatsHook).
Sensitive information: messages can contain sensitive information, for example about someone's health, religion, politics or sex life. We don't look for it or use it to learn anything about anyone; it is only stored and passed to your AI app as part of the messages you asked us to share. Where the law treats this as processing sensitive information about you, we rely on your explicit consent, which you give by ticking the box that says so on your dashboard before you link WhatsApp, and can withdraw at any time with “Stop and delete my data”.
To run your account: sign you in, keep your account secure and send you service emails, for example about your trial, payments, changes to our terms or a problem with your WhatsApp link. Legal reasons: our contract with you, and legitimate interests (keeping WhatsHook and accounts secure).
To take payments and keep accounts: legal reasons: our contract with you, and legal obligations (tax and accounting law).
To give each WhatsApp number one free trial: using the scrambled code made from your number. Legal reason: legitimate interests (preventing abuse of free trials).
To keep WhatsHook working: diagnose problems, prevent abuse and plan capacity, using technical logs and counts (including visit counts), never message content. Legal reason: legitimate interests.
To follow the law and protect our rights: respond to lawful requests from authorities, and establish, exercise or defend legal claims. Legal reasons: legal obligations and legitimate interests.
To measure our ads: learn which Meta ads bring people who sign up and pay, and show our ads to similar people (see Advertising above). Legal reason: your consent, which you can withdraw at any time with Cookie settings at the bottom of every page.
We don't send marketing emails unless you have agreed to them, and you can always unsubscribe.

We don't sell personal information, share it for advertising except with Meta as described above when you accept cookies, use message content for advertising, analytics or profiling, or use it to train AI models. We don't make decisions about you by purely automated means that have legal or similarly significant effects.

AI apps you allow. When you ask, your AI app (for example Claude, by Anthropic, or ChatGPT, by OpenAI) receives the messages it reads. Its provider handles them under its own terms and privacy policy, as a separate controller.
WhatsApp (Meta). Your reader connects to WhatsApp's servers as a linked device, so WhatsApp receives information about that connection, such as the server's internet address and device details, under its own privacy policy.
Our service providers, who process information for us under contract and only on our instructions: Supabase (database and sign-in, in Frankfurt, Germany); Vercel (website and app hosting: our server code runs in Frankfurt, and its global network delivers our web pages); DigitalOcean (reader servers, in Frankfurt); Stripe (payments); Cloudflare (the "prove you're human" check on the sign-in page, which looks at your browser and connection to tell people from bots); and our email providers (sign-in, service and alert emails).
Stripe also uses payment information for its own fraud prevention and legal compliance, as a separate controller, under its own privacy policy.
Google, if you choose to sign in with Google, under Google's own privacy policy.
Meta (Meta Platforms Ireland), only if you accept cookies: what's described under Advertising above. We and Meta are joint controllers for collecting it and sending it to Meta; Meta then uses it as a separate controller under its own privacy policy, and may transfer it to the United States.
Professional advisers, such as lawyers and accountants, where needed.
Authorities, courts and regulators, where the law requires it. We check that requests are lawful and, where we are allowed to, we tell you.
A buyer or successor, if WhatsHook or our company is sold or reorganised. This policy will continue to protect your information.

6. Where it is stored

We store your information in the European Union, in Frankfurt, Germany; the UK recognises the EU as giving adequate protection. Some of our providers are US companies and may access information from outside the UK and EEA, for example to give support, and the AI app you choose may process messages in the United States or elsewhere. When information goes to a country without adequate protection, we rely on safeguards the law recognises, such as adequacy decisions (including the EU-US Data Privacy Framework and its UK Extension) or standard contractual clauses. Email us for details.

7. How long we keep it

Messages from picked chats: until they are 90 days old, they are deleted for everyone, you un-pick the chat, you choose “Disconnect and delete my data”, or your account is closed, whichever comes first.
Your reader's own copy: until messages are 90 days old or deleted for everyone, or WhatsHook is unlinked or stopped.
Chat list: until you choose “Disconnect and delete my data” or your account is closed.
WhatsApp login: until WhatsHook is unlinked or stopped.
When reading stops (a 14-day trial or a subscription you cancelled ends, or a payment fails and stays unpaid): we unlink WhatsHook and delete your WhatsApp data 7 days later.
Connected AI apps: until you disconnect them or the connection ends, then for up to 30 days.
Account details: while your account is open. When you ask us to close it, we delete them within 30 days.
Payment records: as long as tax and accounting law requires (in the UK, usually 6 years).
Free-trial check: as long as we offer free trials, even after you delete your data or close your account, for that reason only.
Waitlist: until you get a place or ask us to remove you.
Advertising details (Meta's cookies, your IP address and browser details, if you accepted cookies): 60 days with your account, or until you press Reject in Cookie settings; with your checkout at Stripe, as long as Stripe keeps your payment records. Meta keeps what it receives under its own policy.
Emails with us: as long as we need them to deal with your message and any follow-up.
Technical logs: only as long as we need them to run, secure and fix WhatsHook.
Visit counts: 13 months.
Backups: deleted information can stay in our database provider's backups for up to 30 days, until they are replaced.

We may keep information for longer if the law requires it or we need it for a legal claim.

8. How we protect it

Connections to WhatsHook, between our servers, and to WhatsApp are encrypted in transit.
Our database is encrypted at rest, and your WhatsApp login has an extra layer of encryption (AES-256), with a key kept separately from the database.
Each account has its own WhatsApp connection with its own internet address. Your reader's copy of your chats is kept on its server's private disk, protected by the server's access controls, and is deleted when WhatsHook is unlinked. That disk isn't separately encrypted at rest.
WhatsApp messages are end-to-end encrypted between devices. Your reader is one of your linked devices, so, like WhatsApp on a computer, it decrypts the messages it receives.
Our staff tools never show message content, and only a small number of authorised people can access our systems. We don't read your messages unless you ask us to (for example, to fix a problem) or the law requires it.
We store the tokens AI apps use to connect only in scrambled (hashed) form. Older private connector links are stored encrypted.
No system is completely secure. If a breach puts your information at risk, we will tell you and the regulator as the law requires.

9. Cookies

We always use the cookies needed to keep you signed in, and one (wh_consent) that remembers your answer to our cookie banner for about 6 months. We count visits ourselves without cookies (see Visit counts above). Only if you press Accept do we also use Meta's Pixel and its cookies, _fbp and _fbc, which last up to 90 days, to measure our ads (see Advertising above); press Reject and no Meta code runs. Change your answer at any time with Cookie settings at the bottom of every page. If you choose to sign in with Google, Google's own pages use their own cookies.

10. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it (including where we rely on legitimate interests), to receive it in a portable format, and to withdraw consent at any time.

Your dashboard lets you do most of this yourself: change the chats you share, disconnect AI apps, and “Disconnect and delete my data”. For anything else, email hello@whatshook.com.
We will reply within one month. We may extend this by up to two more months for complex requests, and if we do we will tell you. We may need to confirm who you are first. It is free, unless a request is clearly unfounded or excessive.
Deleting data in WhatsHook doesn't delete anything in WhatsApp itself, or copies your AI app already has.
If you're unhappy, please contact us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live or work.

11. Children

WhatsHook is only for people aged 18 or over, and we don't knowingly collect information from children as users. If we learn that a user is under 18, we will close the account and delete the data. Chats can include messages from children, and users must take particular care with them (see our Terms of Service).

12. If you live in the United States

We don't sell or “share” personal information as US state privacy laws define those words, and we don't use it for targeted advertising. Wherever you live, you can ask us to access or delete your information by emailing us, and we won't treat you differently for asking.

13. Changes to this policy

We will update this policy when the way we handle information changes. The date at the top shows the latest version. For important changes we will email you or tell you on your dashboard.

14. Contact

WhatsHook LTD, [registered office address]. Email hello@whatshook.com.