Privacy Policy¶
Last updated: 3 May 2026
PRIVACY POLICY¶
This Privacy Policy explains how Wably collects, uses, stores, and shares personal data when you use our platform or when our clients use the platform to communicate with their end customers.
Two roles under GDPR: Wably acts as Data Controller when processing data of registered clients and platform visitors. Wably acts as Data Processor when processing end-customer data on behalf of its clients (see Section 6 — DPA).
1. Data Controller
Controller: Marco Santucci (trading as Wably)
Address: Calle Agustina de Aragón 92, Barcelona, Spain
Privacy contact: privacy@wably.app
2. Data We Collect and Why
2.1 Platform Clients (B2B)
When you register and use Wably as a business client, we process:
• Identity data — name, company name, NIF/VAT number;
• Contact data — email address, phone number;
• Billing data — payment method details (handled by Stripe; we do not store card data), invoicing address;
• Account data — username, hashed password (via Keycloak), role, subscription plan;
• Usage data — login timestamps, feature usage, API call logs;
• Configuration data — connected integrations, calendar settings, workflow configurations.
Legal basis and retention per processing purpose:
• Account creation and authentication — contractual necessity (Art. 6(1)(b)) — retained for contract duration + 1 year;
• Service provision — contractual necessity (Art. 6(1)(b)) — retained for contract duration;
• Billing and invoicing — legal obligation (Art. 6(1)(c)) — retained 5 years (Spanish tax law);
• Customer support — contractual necessity (Art. 6(1)(b)) — retained 3 years from last interaction;
• Security and fraud prevention — legitimate interests (Art. 6(1)(f)) — logs retained 12 months;
• Marketing communications (opt-in only) — consent (Art. 6(1)(a)) — until consent withdrawn;
• Legal compliance and dispute resolution — legal obligation (Art. 6(1)(c)) — as required by law.
2.2 Website Visitors
• IP address and browser metadata (for security and analytics);
• Cookie data (see Section 7).
2.3 End Customers of Our Clients
When our clients use Wably to interact with their own customers, those end customers’ personal data is processed under the instructions of our client, who acts as Data Controller. We act as Data Processor. See Section 6 (DPA) and Section 5 (WhatsApp Data) for details.
3. Data Sharing
GOOGLE DATA (GOOGLE CALENDAR AND GOOGLE CONTACTS)¶
When the user connects their Google account, Wably accesses Google data solely through Google's official APIs and only within the limits of the authorized scopes:
- Google Calendar (
calendar.events,calendar.events.freebusy,calendar.calendarlist.readonly): to create, update, and delete the events related to booked appointments, check busy time slots and calculate available slots, and allow the user to select which calendar to use. - Google Contacts (
contacts): to import the existing address book (read) and, if the customer enables the option, add new contacts acquired through the assistant.
Google remains the authoritative source for contact data. Wably's operations are limited to reading and adding new contacts: Wably never modifies or deletes contacts in the user's Google account.
This data is used solely to provide the scheduling and contact-management features described above. It is not sold, is not used for advertising or profiling, is not used to train generalized or personalized artificial intelligence models, and is not shared with third parties except to the extent strictly necessary to provide the service (e.g., hosting infrastructure). OAuth tokens are stored in encrypted form and the user can revoke access at any time from the dashboard or from their Google Account security page.
Compliance with Google's Limited Use Policy. Wably's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
ARTIFICIAL INTELLIGENCE AND GOOGLE USER DATA¶
Wably uses a large language model to interpret WhatsApp messages sent by your clients and to manage appointments on your behalf.
Model used: openai.gpt-oss-120b, an open-weight model released under the Apache 2.0 licence.
Provider and hosting: the model is hosted and executed by Oracle Cloud Infrastructure (OCI) Generative AI within our own OCI tenancy in the European Union. The model vendor (OpenAI) is not part of the processing chain and receives no data. We do not use any consumer AI service such as ChatGPT, DeepSeek, or OpenRouter.
No training: Google user data obtained through Google APIs is never used to develop, improve, train, or fine-tune generalised AI or machine learning models, by us or by any third party. Oracle does not retain prompts or responses and does not use them to improve its services, as documented at https://docs.oracle.com/en-us/iaas/Content/generative-ai/data-handling.htm.
No human review, no sale, no transfer: Google user data is not read by humans, is not sold, and is not transferred to third parties, except to Oracle acting strictly as our data processor under the Oracle Data Processing Agreement.
Scope of processing: data from Google Calendar and Google Contacts is used solely to provide the scheduling and contact features you explicitly enable, in compliance with the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell personal data. We share data only with:
• Oracle Cloud Infrastructure (Oracle Corporation) — EU-based cloud hosting and Generative AI inference (Frankfurt, EU);
• Stripe Payments Europe, Ltd. — payment processing;
• Meta Platforms Ireland Ltd. — WhatsApp Business API delivery;
• Google Ireland Ltd. — Calendar and Contacts API integration (where enabled);
• Sendinblue SAS (Brevo) — sending service email communications (reminders, summaries and review requests);
• Legal authorities — when required by law or to protect rights and safety.
All third-party processors are bound by appropriate data processing agreements.
4. International Transfers
Wably stores data primarily within the European Economic Area (EEA). Where transfers outside the EEA occur (e.g. via Meta or Google infrastructure), they are carried out under EU Standard Contractual Clauses (SCCs) as adopted by the European Commission.
5. Your Rights
Under GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you have the following rights:
• Access (Art. 15) — request a copy of personal data we hold about you;
• Rectification (Art. 16) — correct inaccurate or incomplete data;
• Erasure (Art. 17) — request deletion where no compelling reason to continue processing;
• Restriction (Art. 18) — request limitation of processing in certain circumstances;
• Portability (Art. 20) — receive your data in a structured, machine-readable format;
• Objection (Art. 21) — object to processing based on legitimate interests;
• Withdraw consent — at any time without affecting prior processing;
• Lodge a complaint — file with the AEPD (Agencia Española de Protección de Datos) at www.aepd.es.
To exercise any right, contact us at privacy@wably.app. We will respond within 30 days.
6. Data Security
• Encryption of data in transit (TLS 1.2+) and at rest;
• Role-based access control with principle of least privilege;
• Audit logging of data access and system events;
• OAuth tokens stored in encrypted form;
• Regular security review of third-party integrations.
7. Data Retention
After termination of a client account:
• Account and configuration data is deleted within 90 days;
• Billing and invoice data is retained for 5 years (Spanish tax law);
• Anonymised usage statistics may be retained indefinitely.
WHATSAPP MESSAGING DATA¶
This section provides additional transparency required by Meta’s WhatsApp Business Platform policies and applies to all use of Wably as a WhatsApp Business Solution.
Wably integrates with the WhatsApp Business API (provided by Meta Platforms Ireland Ltd.) to enable businesses to automate appointment-related and transactional messages.
1. What WhatsApp Data We Process
When clients send messages via WhatsApp through Wably, we may process:
• Phone number (E.164 format);
• Messaging metadata (delivery status, timestamps);
• Message content to the extent required to route and log the communication;
• Opt-in and opt-out status;
• Contact profile data provided by the client (name, email, appointment details).
2. How We Use WhatsApp Data
WhatsApp data is used exclusively to:
• Deliver messages requested by the client (appointment confirmations, reminders, notifications);
• Log delivery status and errors for operational purposes;
• Maintain conversation context for the AI scheduling assistant;
• Comply with legal obligations.
WhatsApp data is never used for: advertising profiling, third-party data sales, cross-tenant data sharing, or any purpose unrelated to the contracted service.
3. Consent for WhatsApp Messaging
Our clients must ensure that every WhatsApp message recipient has explicitly opted in to receive messages. Opt-in must be: obtained directly by the client from the end customer; clear, specific, and freely given; documented and verifiable. Clients are solely responsible for obtaining and maintaining valid opt-in records.
4. Opt-Out
End customers can opt out at any time by replying “STOP” or equivalent, or by contacting the business directly. Opt-outs must be honoured by the client within 24 hours.
5. Permitted Message Types
• Utility — appointment confirmations, reminders, rescheduling, cancellations;
• Service — responses to user-initiated conversations within a 24-hour messaging window.
Promotional or marketing templates are not supported and their use is prohibited.
6. Meta’s Role
Meta Platforms Ireland Ltd. is an independent data controller with respect to WhatsApp infrastructure. Their data handling is governed by the WhatsApp Business Policy and Meta Platform Terms. Wably is not responsible for Meta’s data practices.
7. Retention of Messaging Data
The conversational content needed to maintain the context of the dialogue is retained for a maximum of 12 hours, after which it is automatically deleted. Delivery logs, which contain metadata and not the text of the messages, are retained for a maximum of 12 months, after which they are permanently deleted unless legal obligations require longer retention.
DATA PROCESSING AGREEMENT (DPA)¶
The relationship between Wably and the Client using the service is governed by a data processing agreement under Article 28 of the GDPR, in which the Client acts as Data Controller and Wably as Data Processor.
The agreement is published in full, and always in its current version, on a dedicated page: data processing agreement. It sets out the roles of the parties, the subject matter and duration of the processing, the categories of data and of data subjects, the treatment of special categories of data and of free-text fields, the Controller's instructions, the security measures, the complete list of sub-processors, transfers outside the EU, the retention and deletion terms, the notification of personal data breaches and the right to audit.
The Client accepts the agreement electronically upon registering for the service, with a record of the date, time and version accepted. Clients requiring a separately signed agreement may contact legal@wably.app.
CONTACT RIGHTS REQUESTS¶
General inquiries: info@wably.app
Privacy data rights: privacy@wably.app
Legal compliance: legal@wably.app
Support: support@wably.app
Postal address: Marco Santucci / Wably, Calle Agustina de Aragón 92, Barcelona, Spain
Supervisory authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
We aim to respond to all privacy-related requests within 30 calendar days. Complex requests may take up to 3 months in total, with notification provided within the first 30 days.
This document was last updated on 3 May 2026 and supersedes all previous versions.