WhaptureWhapture

Privacy Policy

Last updated: October 6, 2026

1. Introduction

This Privacy Policy describes how Whapture ("we", "us", "our") collects, uses, and shares information about you when you use our service at whapture.app.

Whapture is operated by Dragon Advertising Ltd (Dragon Advertising EOOD), a company registered in Bulgaria (UIC/EIK 206419669, VAT BG206419669), with its registered office at zh.k. Hale, bl. 5, vh. I, ap. 173, 8600 Yambol, Bulgaria, which is the data controller for account data. For lead data collected through your widget, you (the business) are the controller and we act as your processor.

2. Information We Collect

Account Information

When you sign up using Google authentication, we receive your email address, name, and profile picture URL from Google.

Workspace Data

When you create a workspace, we store the workspace name, slug, currency preference, and WhatsApp number.

Lead Data

The Whapture widget installed on your websites collects:

  • Form submissions (name, phone, email, message, or fields you configure)
  • Google Click Identifier (GCLID) when present in the URL
  • UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
  • Page URL where the form was submitted
  • IP address and user agent of the visitor

Cookies

Our widget sets a first-party cookie (whapture_attr) to persist Google Ads attribution across page views. This is functional, not advertising tracking. The cookie expires after 90 days.

3. How We Use Information

  • Provide the service you signed up for
  • Send transactional emails (new lead notifications, reminder digests, team invites)
  • Authenticate you via Google OAuth
  • Internal analytics about service usage (no personally identifiable details shared externally)

4. Data Sharing

We share data with these third-party processors strictly to run the service:

  • Supabase — database, authentication, file storage
  • Vercel — hosting and edge delivery
  • Resend — sending transactional email
  • Stripe — payments and billing
  • Upstash — rate limiting and short-lived technical counters
  • Meta (WhatsApp Cloud API) — delivering lead alerts to the WhatsApp numbers you choose
  • Crisp — in-dashboard support chat
  • Google — OAuth sign-in

When you connect an integration, we send lead and conversion data to your own accounts on your instruction: Google Ads and Meta receive conversions with the ad click ID and hashed (SHA-256) email and phone; Plato Medical is read to match bookings and invoices by phone or email. You can disconnect any integration at any time.

We do not sell your data to anyone.

Google user data

This section explains exactly how Whapture handles data it receives from Google APIs.

What we access

  • Sign in with Google: your name, email address and profile picture.
  • Connect Google Ads (optional, adwords scope): for the Google Ads account you connect (by entering its customer ID): its conversion actions (names, IDs and settings); the names and IDs of its campaigns and ad groups, and their existing final URL suffixes and tracking templates; and whether the account has accepted Google's customer data terms.
  • Data Manager API (datamanager scope): write access only, used to send conversions to your account. We do not read data through this scope.

How we use it

  • We create three conversion actions in that account (Whapture - Lead, Whapture - Qualified, Whapture - Closed Deal), or reuse them if they already exist.
  • We set a final URL suffix with UTM parameters (campaign and ad group names) at account, campaign and ad group level, so each lead in Whapture shows the campaign that brought it. Entities that already carry UTM tracking are left untouched. We do not change your campaigns' budgets, bids, targeting, ads or status.
  • When your team marks a lead as qualified or closed in Whapture, we upload that conversion (with the ad click ID and the lead's SHA-256 hashed email and phone number) to your own account through the Data Manager API.
  • We read the customer data terms status only to show you whether setup is complete.

We use Google user data only to provide these user-facing features. We do not use it for advertising, lending, credit decisions or any other purpose, we do not create aggregated or anonymised datasets from it, and we do not use it to develop, improve or train AI or machine-learning models.

Sharing

We do not sell, rent or transfer Google user data to anyone, including advertisers, data brokers and AI providers. It is processed only by the service providers that run Whapture, under contract and solely to operate the service: Vercel (hosting) and Supabase (database) for all of it, and Resend (email delivery) and Crisp (support chat) for your sign-in email address only. We may also disclose it where required by law.

Protection

Data is encrypted in transit (HTTPS/TLS) and at rest. Google OAuth refresh tokens are additionally encrypted with AES-256-GCM before they are stored, access to them is restricted to our server, and each workspace's data is isolated by database row-level security.

Retention and deletion

We store only what the features need: your Google Ads customer ID, an optional manager account ID, the IDs of the three Whapture conversion actions and an encrypted refresh token. Campaign and ad group names and settings are read when needed and not stored. When you disconnect Google Ads in Whapture, the refresh token is deleted immediately. You can also revoke access at any time at myaccount.google.com/permissions. When you delete your workspace, all associated data is permanently deleted within 30 days. To request deletion at any time, email support@whapture.app.

Whapture's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Retention

We retain your data for as long as your account is active. If you delete your workspace, all associated leads, events, integrations, and team members are permanently deleted within 30 days.

6. Your Rights

You have the right to:

  • Access the data we hold about you
  • Correct inaccurate data
  • Delete your data (by deleting your workspace)
  • Request export of your data

To exercise these rights, contact us at support@whapture.app.

7. Security

We use industry-standard security measures including HTTPS, encrypted databases at rest, and row-level security policies to isolate workspaces from each other. No online service is 100% secure, and we cannot guarantee absolute protection.

8. Children's Privacy

Whapture is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided data to us, contact us and we will delete it.

9. International Transfers

Your data may be processed in countries other than your own (typically the United States and Singapore, where our infrastructure is located). For transfers out of the EU/EEA and UK we rely on standard contractual clauses with our processors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated by email.

11. Contact

For any questions about this policy or your data: support@whapture.app · Dragon Advertising Ltd (EIK 206419669), zh.k. Hale, bl. 5, vh. I, ap. 173, 8600 Yambol, Bulgaria · dragonads.uk. EU residents may also complain to their local data protection authority (in Bulgaria: the Commission for Personal Data Protection).

← Back to home·Terms of Service