Privacy Policy

The controller is LACA-SOFT (laca-soft.com). To exercise your rights or ask questions, write to us at hola@waveroft.com.

Account data: name, email address and access credentials.

Configuration data: provider credentials (Meta Cloud API) and AI credentials, stored encrypted in the database.

Messaging data: messages, phone numbers and conversation metadata you process through the service.

Technical data: usage logs, IP addresses and events needed to operate and secure the platform.

Providing the service (sending and receiving messages, running the agent and workflows), operating the multi-tenant infrastructure, ensuring security, preventing abuse and providing support.

We don't sell your data or your recipients' data.

Each tenant is isolated: provider and AI configuration is per tenant and encrypted in the database. We apply object-level authorization so one tenant cannot access another's data.

To provide the service we share strictly necessary data with: Meta (WhatsApp Cloud API) for message delivery; the AI providers you configure (e.g. OpenAI or Anthropic) when you use the agent; and object storage providers (S3/Cloudflare R2) for media.

Each processes data under its own policies. By using the Cloud API or an AI provider with your credentials, you also accept their terms.

Secrets and credentials are stored encrypted (AES-256-GCM). Passwords are stored hashed. Webhooks are signed with HMAC-SHA256 so you can verify their authenticity.

No system is 100% secure, but we apply reasonable technical and organizational measures to protect data.

We keep data while your account is active and for as long as needed to meet legal obligations or resolve disputes. You can request deletion of your account and associated data.

Under applicable law, you may access, rectify, delete or object to the processing of your data, and request its portability. To exercise them, write to us at hola@waveroft.com.

We may update this Policy. We will publish the current version on this page with its update date.