Legal

Privacy Policy

Effective October 5, 2026

1. Who we are

Pywa Cloud (pywa.cloud) is operated by David Lev, an individual based in Israel, as the data controller for the personal data described in this policy. This is an early-access product — the account/dashboard system described below is being built out, and some sections note where that's still in progress.

Contact for any privacy question or request: [email protected].

2. What we collect

Waitlist

If you join the waitlist on this site, we store the email address you provide, the optional "what are you building" text, whether you already have a verified WhatsApp Business Account, and the submission time. This is stored with our hosting provider.

Account & team data

Once you create a Pywa Cloud account: your email address, name, and (if you sign up with a password) a salted hash of your password — we never store your password itself. If you sign in with Google or GitHub instead, we receive your email, name, and an account identifier from that provider; we never see or store your password on that provider.

If you're part of a team, we store the team name and your role in it (owner, admin, or member).

Bots, deployments, and environment variables

Your bot's name, the code you deploy, build logs from each deployment, and any environment variables you configure. Environment variables you mark as secret are encrypted at rest before storage and are never returned by our API once set; non-secret variables are stored as provided. Build logs may contain output produced by your own bot's code.

WhatsApp Business Account connection

To connect a bot to WhatsApp, we store your WhatsApp Business Account ID, the business phone number(s) you assign, and an access token for that account — obtained either through Meta's Embedded Signup (where Pywa Cloud acts as your Meta Tech Provider) or through a WhatsApp Business app/token you provide yourself. These credentials are encrypted at rest and used solely to operate your bot's connection to WhatsApp on your behalf.

Server & security logs

Like any web service, our servers incidentally log request metadata (IP address, timestamp, requested path) for security, abuse prevention, and debugging. We don't use this data for tracking or advertising.

3. How we use it

4. Who we share it with

We don't sell your data. It's shared only with the following, and only as needed to run the service:

5. Cookies and analytics

We use PostHog (Cloud, EU region), reached through our own domain, to count visits and see which features of this site, the documentation, the status page, the dashboard and Pywa Studio get used, so we can fix what is broken and improve what matters. We record the pages and tabs you open, the buttons you press, whether an action succeeded or failed, and technical errors. We do not record what you type or what is on your screen: bot names, environment variable names and values, logs, phone numbers, flow contents and email addresses are never sent, and the waitlist form reports only whether it was submitted.

We also record on our servers that an action on your account happened, so we can run and improve the service and see problems the browser cannot: that a deploy (from the dashboard, the CLI or CI) finished and whether it succeeded, how long it took and roughly how large it was, that a bot was created, started, stopped or restarted, and, once a day per bot, whether it received traffic and whether it answered with errors. These records hold your account's opaque ID, counts, outcomes and timings, never your code, environment variables, logs, message content or email, and they do not depend on the cookie choice below, because they describe operating your account rather than your browsing. In the documentation, we also record what is typed into the search box, once you stop typing, so we can see what the docs fail to answer.

A short bar asks for your choice. If you decline (or ignore it), visits are still counted but anonymously and without cookies or any stored identifier. If you accept, PostHog sets a first-party cookie so your visits to this site, the documentation, the status page, the dashboard and Studio belong to one anonymous visitor (and, once you sign in, to your account's opaque ID, never your email or name). In Pywa Studio only, accepting also lets us watch anonymised session recordings, to see where the builder gets in your way: everything you type and the contents of your flows and templates are hidden in them. We do not record sessions on this website, the documentation, the status page or the dashboard. You can change your mind at any time by clearing the cookies and storage for pywa.cloud, which shows the bar again. Your choice is remembered in one small cookie shared by our sites (it holds only "accepted" or "declined"), so you are asked once, not on every site. We do not use advertising cookies. The waitlist form's spam filtering is a hidden field only a bot would fill in, not a cookie or fingerprinting technique.

6. Data retention

Waitlist entries are kept until you ask us to delete them or you convert to an account. Account, bot, and deployment data is kept for as long as your account is active. Secrets are deleted immediately when you remove them from a bot. We don't yet have an automated retention/expiry schedule for old build logs — that's on our roadmap; until then, deleting your account removes the associated data on request.

7. Your rights

Regardless of where you're located, you can ask us to:

To exercise any of these, email [email protected]. If you're in the EU/EEA, UK, or a US state with its own privacy law, you may also have rights specific to that law and the right to lodge a complaint with your local data protection authority.

8. Security

Secrets (environment variables marked secret, WhatsApp business tokens, app secrets) are encrypted at rest. Traffic to your bot is validated against Meta's own certificate authority and an HMAC signature before it ever reaches your code. Each bot runs in an isolated, non-root container with no route to any other tenant's container. Full detail: the security & isolation page. As noted there, this is container-level isolation on shared infrastructure, not VM-level isolation, and it hasn't had an independent security audit yet.

9. International data transfers

Because our infrastructure providers and Meta operate globally, your data may be processed in countries other than your own, including outside the EU/EEA. Where required, we rely on the safeguards those providers offer (such as standard contractual clauses) for such transfers.

10. Children

Pywa Cloud is a developer tool and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

11. Changes to this policy

If we make material changes to this policy, we'll update the effective date above and, where the change is significant, notify account holders by email or a notice on this site.

12. Contact

Questions about this policy or your data: [email protected]. Abuse reports: [email protected].