Privacy Policy

• Your account data (email, subscription, keys): we are the controller.
• Your WhatsApp content (messages, contacts, groups, media), including messages from people who write to you: you are the controller; we process it on your behalf and under your instructions to provide the Service. You are responsible for informing your contacts and honouring their rights as required by law.

• Account: email, hashed password, login times, IP addresses in technical logs.
• WhatsApp link: the phone number you connected and the linked-device encryption keys needed to keep the connection alive. The Service cannot work without them.
• Messages: text content of incoming and outgoing messages in your chats and groups, message IDs, sender, time, and media metadata (type, filename, decryption key). This includes history synced from your phone on first connection.
• Media: files (images, voice, documents) are downloaded and stored only when you or your AI tool explicitly request them, and served through temporary signed links.
• Contacts and groups: names and identifiers, for display and search.
• API keys, OAuth tokens and webhook secrets: keys and tokens are stored as hashes only; the webhook secret is stored in the database (encrypted at rest by the storage provider) because it is needed to sign events.
• Webhooks: the URLs you configured and a delivery log (status, last error, the payload sent) kept for retries, retained up to 7 days.
• Billing: subscription status and customer identifiers at our payment provider. Card details are held by the payment provider only and never reach us.

We use no third-party analytics or tracking on the site. The only cookies are authentication cookies.

• To provide the Service: keep the WhatsApp connection alive, answer your AI tool's requests, and deliver the webhooks you configured.
• To secure the Service: authentication, rate limiting, abuse detection, and troubleshooting through technical logs that contain no message content.
• To bill and manage your subscription and send essential service emails (not marketing).

We do not read your messages, do not use them to train models, and do not sell or share them for advertising. Staff access to content happens only for support you requested or an incident, and only to the minimum extent needed.

• The AI tools you connect (Claude, Cursor, etc.): when such a tool runs an action, the relevant message content is transmitted to that provider at your request and under its privacy policy. You control this through the connection and your keys.
• Webhooks: incoming message content is sent to the URL you configured. You are responsible for that destination.
• Infrastructure providers (sub-processors): database and file storage at a managed cloud provider (Supabase, servers in the United States); application servers at Fly.io (Amsterdam, EU); website and dashboard at Vercel; payments at a third-party payment provider. They process data under our instructions and data-processing agreements.
• WhatsApp / Meta: the Service talks to WhatsApp's servers as a linked device, exactly like WhatsApp Web.
• Authorities: only when legally required.

Some providers are outside Israel and the EU. Transfers rely on standard contractual safeguards (including Standard Contractual Clauses where required).

• All traffic is encrypted (TLS). Database data is encrypted at rest by the storage provider.
• Full tenant isolation: every query is scoped to the authenticated account, plus row-level access policies in the database.
• Keys and tokens are stored as hashes. Secrets are shown once.
• Technical logs contain no message content.
• No system is perfectly secure. If a security incident affects you, we will notify you and the authorities as the law requires.

• Messages and contacts: while your account is active. You can request deletion at any time.
• WhatsApp link keys: deleted when you unlink the number from the dashboard or your phone.
• Downloaded media: kept until you request deletion or close your account.
• Webhook log: up to 7 days.
• Account closure: within 30 days of your request we delete all account and WhatsApp data, except billing records we must keep by law.

You may access the data we hold about you, correct it, request deletion, object to or restrict processing, and receive a copy in a common format. Write to support@greenolink.com from your account email; we answer within 30 days. If you are a contact of one of our users rather than a user yourself, please contact that user first, who is the controller; we will help them fulfil your request. In the EU you may also complain to your supervisory authority; in Israel, to the Privacy Protection Authority.

The Service is for people aged 18 and over. We do not knowingly collect data about minors.

We will update this policy as needed. Material changes are posted on the site or emailed to you in advance. Privacy questions: support@greenolink.com. See also the Terms of Service.