Data Processing Agreement

Roles

For the personal data contained in the messages, calls, contacts, and accounts you handle through the service, you are the controller and WhatsMCP is your processor: we process that data only to provide the service and only on your documented instructions, which your use of the service and these terms constitute. Where a data-protection law applies to this processing (including the EU GDPR, the UK GDPR, and the CCPA/CPRA), this DPA sets out how we do it. Nothing here makes us the controller of that data.

What we process, and why

The subject matter is our operation of a linked WhatsApp account on your behalf; the duration is for as long as the account stays linked and your account stays open; the nature and purpose is to send, receive, and serve back the data of that account through the API; for a Business (official) number with WhatsApp calling on, to connect its calls; if you connect a CRM, to sync the data you choose into it; and, if you use AI agents, to answer the people who message your numbers through the LLM provider you choose, from any knowledge bases you give them, and through any HTTPS endpoints you choose for an agent's actions. The personal data and data subjects are as described in our Privacy Policy, in summary:

• Categories of personal data: message content and metadata; the linked account's phone number and session credentials; the synced address book; call history; group and channel membership; media attachments; webhook destinations; for a hosted SIP line, the IP address, user agent and connection type of each device that connects to it; and, if you connect a CRM, which CRM contact each WhatsApp number matched and what the CRM panel reads from your CRM to show you. For a Business (official) number connected through Meta's WhatsApp Cloud API: its messages and media, its WhatsApp Business Account and phone-number identifiers, its message templates, and an encrypted Meta access token; with WhatsApp calling on, also its call records (the other party's number, direction, start time, whether the call was answered, its duration and how it ended), the requests asking a person to allow calls and their answers, and the call audio, which passes through our SIP servers in transit and is not recorded. For AI agents: a copy of the messages in the direct chats of each number an agent is on, contacts' phone numbers and opt-outs, the state of each conversation, the replies the agent writes, the record of its decisions, and the usage and technical trace of each reply. Where you use knowledge bases: the files, texts and questions and answers you add to them, the text read from the web pages you add, and the passages cut from all of these, with any personal data they hold. Where an agent has actions: what each action sends and the answer it gets, which pass through our servers and are not kept, and a record of each call.
• Categories of data subjects: you, the people you and your linked account communicate with or store as contacts, and anyone whose personal data is in what you add to a knowledge base.

Our obligations as processor

We will:

• Process personal data only on your instructions, including for transfers, unless required otherwise by law — in which case we'll tell you first, where the law permits.
• Ensure the people who process the data are bound by confidentiality.
• Not use the data for our own purposes, and never for advertising, and never sell it.
• Assist you, taking into account the nature of the processing, in meeting your own obligations (see "Helping you meet your obligations" below).

Security

We keep technical and organisational measures appropriate to the risk. These include per-workspace isolation (a request authenticated to one workspace cannot read another's data), API keys stored only as salted hashes, HMAC-SHA256-signed webhook deliveries, and encryption in transit. Calls are encrypted between WhatsApp and our servers, and between our SIP servers and a voice-agent provider you connect; inside our servers a call passes only between processes on the same machine. On to your own phone, softphone or PBX on one of our hosted SIP lines, a call is encrypted when the device connects over TLS with SRTP, and a browser phone always is. A call that our bridge sends to your own PBX has its signalling encrypted if you choose TLS, but not its audio. The LLM keys you add for AI agents are encrypted with a key derived for your workspace, never shown again in full, and sent only to their provider, over HTTPS. The credentials you add for an agent's actions are protected the same way, and used only on calls to the endpoints of the actions that name them, over HTTPS. We review these measures as the service changes.

Sub-processors

You authorise us to engage sub-processors to provide the service. Each is bound by data-protection terms no less protective than this DPA, and we remain responsible for their performance. Our current sub-processors are:

• Our hosting provider — servers and storage for the service, in Amsterdam, the Netherlands.
• Cloudflare — content delivery, network security and bot protection.
• Brevo — account-related (transactional) email.
• Stripe — billing, for paid plans only.
• Sentry — error monitoring: reports of errors in the service, which can include personal data the failing step was handling. Stored in Sentry's EU data region, in Germany.
• Network (VPN) providers — carry a linked Personal number's connection to WhatsApp; they see only encrypted WhatsApp traffic.

WhatsApp and Meta are not our sub-processors. A Personal number talks to WhatsApp as one of your own linked devices. For a Business (official) number you contract with Meta directly under the WhatsApp Business Solution Terms, and Meta processes that number's messages and calls under its own WhatsApp Business Data Processing Terms. Services you connect yourself — your AI assistant, the LLM provider whose key an AI agent uses, OpenAI when one of your keys with it searches your knowledge bases by meaning, an HTTPS endpoint you choose for an agent's action, a voice-agent provider you connect with your own credentials, your CRM, your webhook endpoint — are your choice, not our sub-processors. When an AI agent answers, we send its LLM provider what the reply needs, and an action's endpoint what that action carries, on your instruction; with such an OpenAI key, we send OpenAI the text of your knowledge bases and what each search looks for, on your instruction too. AI agents run on the same servers as the rest of the service, and the files you add to knowledge bases are kept in the same storage.

We will tell you at least 14 days before we add or replace a sub-processor, by email to the account owner, so you can object on reasonable data-protection grounds. If we cannot address the objection, you may end the affected service and we will refund any prepaid fees for the unused period.

International transfers

We store the personal data we process for you in the European Union (Amsterdam, the Netherlands), which the UK recognises as adequate. Where we or a sub-processor transfer it to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) together with the UK International Data Transfer Addendum, which are incorporated into this DPA by reference. When an AI agent sends data to the LLM provider you chose, or to OpenAI with a key you chose to search your knowledge bases, we send it on your instruction to your own provider, and your agreement with that provider governs any transfer outside the UK or the EEA. When an action sends data to an HTTPS endpoint you chose, we send it on your instruction too, and your own arrangements for that endpoint govern any such transfer.

Helping you meet your obligations

Taking into account the nature of the processing and the information available to us, we will help you respond to requests from data subjects (access, correction, deletion, portability, objection), and help you with data-protection impact assessments and consultations with a supervisory authority. You can stop processing for a number yourself by unpairing it in the console, or stop only an AI agent's processing for it by disconnecting the agent from it, and you can delete a knowledge base, or any document in it, yourself; deletion requests are handled as described in the Privacy Policy. Assistance beyond what the service and its self-service tools provide may be charged at our reasonable cost.

Personal-data breaches

If we become aware of a personal-data breach affecting data we process for you, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it, and give you the information you reasonably need to meet your own notification duties as it becomes available.

Deletion or return

On your request — at the end of the service or at any time before — we delete the personal data we process for you within 30 days, except where we are required by law to keep it. Until then, messages age out on your plan's message-history period, and what AI agents keep on the periods set out for them, as stated in our Privacy Policy.

Audits

We will make available the information reasonably necessary to demonstrate our compliance with this DPA and will contribute to audits, including inspections, conducted by you or an auditor you mandate, on at least 30 days' prior notice, no more than once a year unless a supervisory authority requires it or after a breach, subject to confidentiality and at your cost. We will first try to answer with written information.

Your obligations as controller

You are responsible for having a lawful basis for the processing you instruct, including any consent the people you contact require, and for the accuracy and legality of the instructions you give us through the service.

Order of precedence and law

If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. The processor under this DPA is Skylark Labs Ltd, a company registered in UK. This DPA is governed by the laws of England and Wales, as the Terms of Service are.

Contact

This DPA takes effect when you accept the Terms of Service; you do not need to sign a separate copy. Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, except where the law does not allow it.

Questions about this DPA, or to request a countersigned copy: contact us.