Privacy Policy

We don't store your messages

YASend does not store the content of your messages, and it does not store who you send them to. This holds for messages you send through the API, for messages your number receives, and for messages you send or receive in the WhatsApp app on your phone. We cannot read, search or export your conversations, and there is no message log in the portal or in the admin tools.

• Text, media and recipients exist only in memory while a message is being sent, or while it is being handed to your own webhook. They are never written to our database or logs.
• Your queued API messages are held only until they are sent, then wiped. A webhook delivery that carries a message is wiped as soon as it is delivered or has used up its retries, so we can't re-send it later.
• What we do keep is delivery metadata, for about two days: a message id, whether it was sent, delivered or failed, and a time. It has no text and no phone number. It lets your sends be tracked, and it protects your number's health. We also keep counters (how many messages a number sent per day) to apply your plan's limits.
• Media you ask us to decrypt is a temporary copy that is deleted automatically within minutes.

What we collect

• Account data: your name, email address, password (stored only as an argon2 hash), language, and signed-in devices (browser and IP address).
• WhatsApp session data: the login credentials of the numbers you link (encrypted), the number and profile name, and connection events.
• Message metadata only: ids, delivery status and times, kept for about two days, plus daily message counters. Never message content or recipients (see above).
• Billing data: wallet transactions, top-ups and the ShamCash transaction numbers you submit. We never see your ShamCash password.
• Technical data: API request logs, request IDs and error reports, used to run and secure the service.

Why we use it

• To provide the service: connecting your numbers, sending and receiving messages, delivering webhooks.
• To bill you and verify payments.
• To keep the platform safe: preventing abuse, spam and fraud, and protecting your numbers' health.
• To email you about your account: verification codes, security notices, billing and the alerts you choose in Settings.

Who we share it with

We don't sell your data or use it for advertising. We share it only with the providers that run YASend for us, and only what they need:

• Hosting and databases (our cloud provider), email delivery (Brevo), payments (ShamCash), and network protection (Cloudflare).
• WhatsApp, which carries your messages as it does for any linked device.
• Authorities, when the law requires it.

Cookies and storage

We set one essential cookie that keeps you signed in. Your browser also remembers your language choice. There are no advertising or tracking cookies.

Security

Passwords and API keys are stored hashed, WhatsApp credentials are encrypted, and traffic is encrypted in transit. Staff access requires two-factor authentication.

Retention and your choices

• Message metadata is deleted automatically after about two days. Deleting a number deletes its stored login and everything linked to it.
• You can update your profile in Settings and ask us for a copy of your data, or to delete your account, at [email protected].
• We keep billing records as long as the law requires.

Contact

Privacy questions: [email protected].