Privacy Policy

Last updated: 2026-08-09 — version 2026-08-09

This policy explains what data واتس ديف collects, why, where it is stored, who sees it, and what your rights are. It is written to say what actually happens, not what reads best.

1. Who we are

The data controller is you dev. For anything concerning privacy: support@youdev.online — address: اليمن (Yemen).

When our customer uses the service to message their own customers, the customer is the controller of their recipients' data and we are a processor acting on their behalf under the Terms of Service.

2. What we collect

Account data: name, company or entity name, email address, mobile number, password (stored hashed and not recoverable), interface language.

Connected WhatsApp numbers: the number itself, the session state, and the technical connection data needed to run it.

Message content and recipient numbers — plainly: we store this on our servers. That includes the text of outbound and inbound messages, descriptions of the media sent, recipient phone numbers, each message's status and timestamps, the contact lists you upload or build in the platform, and the knowledge-base text you write for a chatbot.

Custom contact fields and message templates: a contact record can carry — alongside the phone and the name — additional fields you define, such as an order number or a city, and you store whatever you want in them. Their content is your choice alone; we impose no type on it, we do not look at it beyond what running the service requires, and section 5 treats it exactly like the rest of your contact data. The same goes for the message templates you write using those field names: they are stored as the text you wrote, and each message's text after the fields are filled in is stored with the campaign's recipients.

Technical access data: API keys (stored hashed — we do not keep the key itself and cannot show it to you again after it is created), webhook URLs and their secrets (encrypted), IP allow-lists.

Usage counters: the number of messages sent against your plan's quota.

Sales enquiries: if you send the enquiry form on the home page we store the name, company name, mobile number and email address you type, the description of your intended use, and the IP address the form was sent from — whether or not you go on to open an account.

Server and error logs: IP address, user agent, request time, path, response code, and technical error details.

Cookies: we set no analytics, advertising or cross-site tracking cookies, and no third-party cookies. Two cookies are strictly necessary: a session cookie that keeps you signed in to the portal, and an XSRF-TOKEN cookie that protects forms against cross-site request forgery (CSRF). One more is functional rather than strictly necessary, and is set only if you tick "Remember me" when you sign in: a persistent login cookie (remember_web_…) that keeps that browser signed in for about 400 days. Signing out deletes it.

3. Why we collect it

• Operating the service: sending and receiving messages and showing them to you in the portal and over the API.
• Calculating and enforcing quotas and limits.
• Support and answering your enquiries.
• Investigating abuse complaints and protecting other customers and the infrastructure.
• Billing and subscription management.
• Improving reliability and diagnosing faults.

4. Third-party processors

We do not sell or trade your data. We rely on the following parties only, and only to the extent the service requires:

• The WhatsApp engine (WAHA/GOWS) — moves messages between the platform and the WhatsApp network. It is self-hosted on the platform's own servers, so content does not leave to a third party at this step. The WhatsApp/Meta network is, by its nature, the final destination of every message you send, and it is governed by Meta's policies rather than ours.
• The AI provider — Google Gemini today. The platform operator can switch it, from the admin settings, to Anthropic or OpenAI; all three are named here so that switching cannot make this policy untrue without notice. When you enable a chatbot on a number, the text of inbound messages on that number, and the knowledge-base text you wrote, are sent to whichever of them is in use to generate the reply. The context sent alongside the inbound message includes the earlier messages in that same chat whoever sent them: including replies you typed by hand in the portal, and messages your own systems sent over the API on that chat. This is processing by a third party outside our jurisdiction. If you do not enable a chatbot, nothing is sent to any of them.
• Sentry — technical error tracking. Crash reports are sent to it after message content, phone numbers, API keys and credentials have been stripped; that stripping is implemented in code and covered by automated tests. Even so, any scrubbing layer is a technical control, not an absolute guarantee.
• Google Fonts — the interface font is loaded from Google's network, so your IP address and browser type reach Google whenever you open any page of the site, including this one. No account data and no message content is sent with that request, and Google sets no cookie on it.
• Hosting provider: Contabo GmbH — the platform's servers and database run on cloud (VPS) hosting rented from this provider, and all the data described in clause 2 is stored there.

5. Retention

• Account and subscription data: kept for as long as the account is active, and afterwards for as long as we need it to meet our accounting and legal obligations.
• Message records: the message metadata (number, status, time) is kept while the account is active; the detailed message content is deleted automatically after 90 days from creation.
• Inbound media files: images, video, voice notes and documents sent to you are downloaded and stored on our servers in private storage reachable only by your account, and are deleted automatically after 30 days. The message record itself survives the file's deletion.
• Webhook delivery log: deleted automatically after 30 days.
• Bulk campaigns: the campaign's recipients are deleted automatically 90 days after it finishes, and the campaign's message text is erased with them — only its name and counters remain.
• Sales enquiries: an enquiry that has not been converted into an account is deleted automatically after 180 days. Once it has been converted, it stays with the account as the record of where that account came from.
• Server logs: the application's own log is kept for 14 days, then rotated. The container runtime logs of the application containers — the web server's request log, holding the IP address, path and response code — are capped by size rather than by age: 50 MB per container, oldest lines discarded first, so how long a line survives there depends on traffic. The rest we do not cap at all: the runtime logs of the database, cache and WhatsApp-engine containers, and the access log of the web server on the host machine in front of them, which also records visitor IP addresses. Those are bounded only by the server's own operating-system log rotation, and we state no retention period for them.
• Contacts and their custom fields, lists, message templates and chatbot knowledge bases: kept until you delete them or your account is closed.

6. Your rights under the Saudi Personal Data Protection Law (PDPL)

You have the right to access your data, to have it corrected, to have it deleted, to obtain a copy of it in a readable format, and to object to a particular processing or withdraw your consent to it.

Stated plainly, this is how that works today:

• Obtaining a copy is self-serve. From your profile page in the portal you can request a zip archive of your account: account and subscription details, the people on the account, messages, contacts and their custom fields, lists, scheduled messages, campaigns, templates, suppressed numbers, sessions, webhook endpoints, payments and API-key metadata, as CSV files alongside a manifest.json that names every category left out of the archive and why. It carries no credential: an API key exists only as an irreversible hash, and webhook signing secrets, session proxy credentials and password hashes are never exported. One archive can be requested every 24 hours, it is downloadable only by a signed-in user of that same account and never from a public link, and the archive is deleted 7 days after it is produced.
• Deleting your account is self-serve. From the same page you can close the account yourself. The moment you confirm, your access ends: every API key is revoked, every WhatsApp number is disconnected, and every pending scheduled message and running campaign is cancelled — none of which is restored if you change your mind. Everything else the account holds, stored files included, is erased permanently 14 days later, and at any point before that you can cancel the request from the portal and the account is reopened.
• Payment records are the one thing that survives that erasure. We are required to keep them for accounting, so instead of deleting them we detach them from the account and strip the fields that could name it. What remains is an anonymised financial record that can no longer be traced back to you through us.
• The remaining rights are handled by hand. Access, correction, objection and withdrawal of consent are carried out manually, within a maximum of 30 days of us receiving your request at support@youdev.online. We may ask you to verify your identity first.

If any of this changes, this policy will be updated and its version raised.

If you are not satisfied with how we handled your request, you have the right to complain to the competent supervisory authority in المملكة العربية السعودية (Saudi Arabia).

7. Security

• All traffic to the platform and the API goes over TLS (HTTPS).
• API keys are stored hashed; a key is shown once at creation and cannot be retrieved afterwards.
• Webhook secrets, provider keys and proxy credentials are encrypted in the database.
• Passwords are hashed with a modern hashing algorithm.
• Every customer is logically isolated: one account cannot reach another account's data, and that is checked by automated tests.
• Administrative access to the servers is limited to the platform operator, at the least privilege needed.
• No system is perfectly secure. If a breach affects your personal data, we will notify you and the supervisory authority as the law requires.

8. Transfers outside the Kingdom

Our servers, our hosting provider (Contabo GmbH), and the AI provider, Google Fonts, the three content delivery networks and Sentry may be located outside the Kingdom of Saudi Arabia. By using the service — and in particular by enabling a chatbot — you are aware of and consent to that transfer.

9. Children

The service is intended for businesses. It is not directed at anyone under 18, and we do not knowingly collect their data.

10. Changes to this policy

On any material change we announce it in the platform and/or over WhatsApp and raise the version shown at the top of this page.

11. Contact

• Entity: you dev
• Email: support@youdev.online
• Address: اليمن (Yemen)