WAgate Privacy Policy
Last updated: October 21, 2026
1. Who we are
WAgate is run by Socialground Co., Ltd., a company registered in Thailand (registration no./tax ID 0105563044920, registered address 29/20 Kanchanapisek Road, Thap Chang, Saphan Sung, Bangkok 10250, Thailand). This policy explains what personal data we collect when you use the WAgate website, console, API and support, why we collect it, who we share it with, how long we keep it, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
2. Two roles, depending on whose data it is
- Your account data. For data about you and your team (email, billing, sign-ins, support chats), we decide how it is used. Under the PDPA we are the data controller.
- Data in your channels. For data about the people your WhatsApp numbers talk to (their phone numbers, names, messages, media and contact details), you decide why and how it is processed. You are the data controller and we are your data processor: we process it on your behalf, only to run the service for you, under the data processing terms in our Terms of Service. Where we decide for ourselves why and how to process data from your channels, for example to investigate abuse, to protect the service or to meet our own legal obligations, we are the controller for that processing and this policy applies to it. These roles do not change the duties the PDPA places on either of us. If you are one of those people and want to exercise your rights, contact the business whose number you talked to. We will help that business respond.
3. What we collect
Account and sign-in
- Your email address, and your name and Google account ID if you sign in with Google. You need to give us an email address to open an account; without it we cannot provide the service.
- When you open an account, we also add your email address, how you signed in and the date to our contact list in a Google Sheet, which we use to keep track of accounts and to tell you about WAgate. You can opt out of those emails at any time by emailing [email protected], and each one tells you how. We keep that entry until you ask us to delete it (section 8).
- Team members' email addresses and roles, and pending invites.
- Sign-in records: when you last signed in, and the IP address a sign-in link was requested from. We delete that address within 25 hours after the link expires and use it only to limit abuse of the sign-in form.
Billing
- Your subscriptions, plan, renewal and cancellation dates, and payment status. Our payment processor handles your card details; we never see or store full card numbers.
Channel configuration
- For each number: its phone number, the name you give it, labels, the proxy address and any proxy login details you enter, webhook addresses and their signing secrets, optional sending limits and warm-up settings (including whether warming is on, who switched it on and when, and your acceptance of the warming notice), and the WhatsApp linked-device credentials needed to keep the number connected.
- API keys, stored only in hashed form.
- Whether synced history is on for each number, and since when.
Data passing through your channels
- Messages and media your numbers send and receive, and message metadata such as sender, recipient, time and delivery status.
- Synced history, only for a channel where you turn it on. It is off unless you turn it on through the API. While it is on, we store older messages that the number's own phone sends us: when the number is linked, if the setting was on before linking, and when you ask through the API for up to 50 older messages of one chat. For each message we store its ID, chat, sender and the sender's display name, whether your number sent it, its time and the time we received it, its type, its text or caption (for a poll, its question and options; for a shared contact card, the name on the card), the people it mentions, and the message it replies or reacts to. For a poll vote we store which poll was voted in, never the choice. We do not download or store its media files. We store only messages still inside the retention period in section 7.
- Group and community information, and contacts associated with your numbers.
- Health readings we calculate for each number, such as its age, how many of the people it messages are saved contacts, reply rates and daily sending pace.
Support
- What you write in the support chat, in the console or on our public pages, and the replies you receive.
- If you chat without signing in: the name and email address you give us, kept with your messages.
- Your chat messages, and your name and email address, are passed to our support team through a private Telegram group. If you chat without signing in, we also add your name and email address to our contact list in a Google Sheet, so that we can reply to you by email and tell you about WAgate. You can opt out of those emails at any time by emailing [email protected], and each one tells you how.
- If the AI assistant answers you, the text of your chat messages is processed by Anthropic to write the reply.
Technical data
- Request and error logs that record the method, route, status and timing of requests, with no IP addresses.
- API access records. We record requests to our API, including requests made with your API keys and changes you make in the console, with three exceptions: successful read requests (GET or HEAD) from the console, our operator or our own internal services, successful checks our systems make to verify a key, and our health checks. Each record holds the time, the IP address the request came from, the method, the route called (as a pattern, never the full address, query or request body), the response status, and the account and channel the request was made by or acted on. Four kinds of request also get a detailed record, and for them the exception for successful reads does not apply, whoever makes them, including the console, our operator and our own internal services: a request that returns the messages of one chat through the chat-messages function of our API, an export of records we preserve (section 7), a request that turns synced history on or off, and a request that asks a number's phone for older messages. This covers requests that reach one of those functions and pass its basic checks of the request. A request refused before that, for example for a missing or invalid key, an ended subscription, a suspended account or a used-up allowance, gets only the ordinary record described above, if any. We write the detailed record before we return the messages, deliver the export, make the change or send the request to the phone, and if we cannot write it, we refuse the request. When we refuse a request for older messages after it reached that function, we also write a detailed record if we can. The detailed record also holds who made the request (an API key, and which one; the console; our operator; or one of our internal services) and, depending on the kind: the addresses of the chat on your channel (phone numbers, WhatsApp IDs or group IDs; anything sent that is not a WhatsApp address is recorded only as invalid) and how many messages were returned or asked for; which preservation was exported; or whether synced history was turned on or off. It never holds the content of any message. If we cannot record whether a request for older messages that we sent to the phone succeeded, its record shows the outcome as unknown, never as a success. Downloads of media files do not get a detailed record. We keep these records for 90 days to investigate abuse or misuse of your account, and because 90 days is the period the Computer Crime Act B.E. 2550 sets for computer traffic data. Records we preserve for an abuse report, legal request or official order are kept longer, as section 7 describes.
- Our hosting and network providers, such as Cloudflare, process IP addresses to deliver and protect the service.
- A cookie that keeps you signed in. We do not use analytics or advertising cookies or pixels.
- A cookie that remembers your open chat for up to 30 days if you start one without signing in. It is not used for analytics or advertising.
4. Why we use it
- To create and secure your account and sign you in.
- To connect your numbers, deliver your messages and webhooks, keep the synced history you turn on, and show you your numbers' health.
- When the account owner enables warming, we use channel phone numbers, warming settings, acknowledgment records, automated message content, and sender, recipient, time and delivery metadata to exchange messages within the account's warming pool and build chat history.
- To bill you and manage your subscriptions.
- To answer support requests and send you service messages about billing, security and changes.
- To reply by email to people who chat with us on our public pages, and to tell them about WAgate until they opt out.
- To detect and stop abuse, protect the service and other customers, and enforce our Terms of Service.
- To meet legal, tax and accounting obligations, and to respond to abuse reports and lawful requests under Thai law.
Our lawful bases under the PDPA are performing our contract with you, or taking the steps you ask for before entering one, our legitimate interest in running, protecting and promoting the service, and our legal obligations. Where we rely on consent, you can withdraw it at any time.
5. Who we share it with
We share personal data only with these categories of recipients, and only as much as they need:
- Payment processing: the processor that takes your payments and manages your subscriptions.
- Hosting and infrastructure: the providers that host our servers, carry network traffic and hold encrypted backups.
- Email delivery: the provider that sends sign-in links, billing and service emails, and support replies.
- Internal tools: the messaging tools our team uses to receive support chats and service alerts, and the Google Sheet that holds our contact list.
- AI assistant: Anthropic, whose model writes the AI assistant's replies in our support chat. It receives the text of the chat to write a reply, not your name, email address or account data.
- Sign-in provider: Google, if you choose "Continue with Google".
- WhatsApp (Meta): messages you send go through WhatsApp, as from any WhatsApp app, under WhatsApp's own privacy policy.
- Professional advisers and authorities: our accountants, lawyers and auditors, and public authorities where the law requires.
Your webhook receivers and your proxy provider are chosen by you, and data sent to them is governed by your arrangements with them. We may also disclose data where the law requires it, to respond to lawful requests, to protect the rights or safety of people or the service, or as part of a merger or sale of the business, in which case this policy continues to apply.
6. Data stored outside Thailand
Our servers are in Singapore, and some of the providers above process data in other countries, including the United States and the European Union. We transfer personal data outside Thailand because it is necessary to perform our contract with you. We use providers that are bound by contract to protect personal data and that are subject to recognized data protection laws.
7. How long we keep it
| Data | How long |
|---|---|
| --- | --- |
| Message bodies, media and delivery status | Message bodies and delivery status are deleted automatically after 14 days; each media file is deleted 14 days after it was last stored or received again, unless preserved as described below this table |
| Synced history (only if you turn it on) | Deleted automatically once it is older than our content retention period, which is never more than 14 days, counted from when each message was sent, unless preserved as described below this table. Our cleanup runs every hour; until it runs, an expired message can no longer be read. Messages already older than that period when the phone sends them are not stored. Turning the setting off does not delete what was already stored. Deleting the channel deletes it, and so does deleting your account (section 8), except what is preserved |
| Message metadata (the channel and account, the chat, the sender, the message ID, the time, direction and message type, whether it was sent from your number, and whether WhatsApp confirmed a send) | 90 days from the message, the period the Computer Crime Act B.E. 2550 sets for computer traffic data, or longer when a competent official orders it or when preserved for an abuse report, legal request or official order |
| API access records (time, IP address, method, route, response status, and the account and channel; for the detailed records section 3 describes, also who made the request and, depending on the kind, the chat addresses and the number of messages, the preservation exported, or whether synced history was turned on or off) | 90 days from the request, on the same basis |
| Webhook events | Delivered events are deleted within 15 days after they were delivered. Undelivered events, including those of a deleted channel, are deleted within 15 days from when they were created |
| Channel after its subscription ends | 30 days, then deleted |
| Account, team and channel settings, and support chats | While your account is open |
| Chats you start on our public pages without signing in (your name, email address and messages), including the copies in our team's Telegram group and on our contact list | Until you ask us to delete them (section 10) |
| IP address a sign-in link was requested from | Deleted within 25 hours after the link expires |
| Our contact list entry for your account (email address, sign-in method and dates) | Until you ask us to delete it by emailing [email protected] from your account email. Deleting your account does not remove it on its own |
| Mapping between a contact's phone number and WhatsApp's internal identifier for that contact (section 8) | Kept in a table shared by all channels on our service; not removed when your channel or account is deleted |
| Request and error logs | Kept by size, not by age: a log is rotated aside once it grows past a set size, and logs have no fixed age limit |
| Encrypted backups | Normally kept as the most recent 30 daily backups, each replaced as newer ones are made. Older copies can be kept for longer if a snapshot or cleanup fails |
| Log of each preservation we place, renew or lift (section 8) | Kept indefinitely, never deleted |
| Billing and tax records | Five years from the end of the accounting year, or longer if Thai law requires |
When we preserve records for an abuse report, legal request or official order, as section 6 of the Terms of Service allows, the message bodies, media, synced history, message metadata and API access records concerned are not deleted on the schedule above. We keep them until that matter no longer needs them, and then delete any that are past their normal period.
8. Deleting your account
You can ask us to delete your account by emailing [email protected] from your account email. Deletion disconnects your numbers and deletes your channels, their stored messages and settings (each media file is deleted 14 days after it was last stored or received again), your team, your API keys and your sign-in. Copies in encrypted backups are normally removed as those backups are replaced by newer ones, within the most recent 30 daily backups. Older copies can be kept for longer if a snapshot or cleanup fails. The mapping between a contact's phone number and WhatsApp's internal identifier for that contact is kept in a table shared by all channels on our service and is not removed when your channel or account is deleted. Our contact list entry for your account (section 3) is not removed by account deletion; tell us in the same email if you want it removed as well, and we remove it. After deletion we keep billing and tax records for as long as the law requires, and message metadata and API access records for the rest of their 90-day period (section 7), which runs from the message or request, not from the deletion. Records preserved for an abuse report, legal request or official order, under section 7 of this policy and section 6 of the Terms of Service, are kept for as long as that matter needs. We also keep a permanent log of each time we place, renew or lift such a preservation. Each entry records the action, whether the preservation covers a channel or an account, the identifier of that channel or account, the reason we gave when placing or renewing it, that our operator took the action, and the time. This log is never deleted, including after your account is deleted. It holds no message content: it does not copy any message, media, message metadata or API access record. While a preservation stands, we also keep a record of it with the same details and the channels and accounts it covers; that record is deleted when the preservation is lifted. Messages already delivered to WhatsApp, to recipients or to your own webhook receivers are outside our control.
9. Security
We protect personal data with encrypted connections, API keys stored as hashes, signed webhooks, encrypted backups, restricted server access, and sign-in by one-time link or Google instead of passwords. No system is completely secure. If a breach affects personal data for which we are the controller, such as your account data, we will notify the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone's rights and freedoms at risk; where it is likely to put your rights and freedoms at high risk, we will also tell you without delay, including what we are doing about it. If a breach affects data in your channels, for which you are the controller, we will tell you without undue delay and give you the information we hold that you need for your own notifications.
10. Your rights
Under the PDPA you can ask to access your personal data, get a copy in a portable format, correct it, delete it, restrict or object to its use, and withdraw consent where we rely on consent. Email [email protected] and we will respond within 30 days. You can also complain to Thailand's Personal Data Protection Committee.
11. Changes to this policy
We may update this policy. We will post the new version here with a new date, and email account owners about significant changes before they take effect.
12. Contact
Socialground Co., Ltd., 29/20 Kanchanapisek Road, Thap Chang, Saphan Sung, Bangkok 10250, Thailand
Privacy and legal: [email protected]
Support and account requests: [email protected]