Privacy Policy

01

Who We Are (Data Controller)

WAPI Solutions LLC

WAPI Solutions LLC, a limited liability company organized under the laws of the State of Wyoming, United States ("WAPI", "we", "us", or "our"), is the controller of the personal data described in this Policy, except where this Policy states that we process data on behalf of a customer (see Section 5). This Policy applies to wapiso.com and to the products and services we provide through it. We serve customers worldwide, and Section 10 describes the rights we extend to all users regardless of location.

30 N Gould St Ste R Sheridan, WY 82801, USA
[email protected]
wapiso.com

02

Personal Data We Collect

We collect the following categories of personal data. What we actually hold about you depends on which of our services you use.

Identity Data

Name, surname, username, date of birth, and, where required for invoicing, a tax or national identification number

Contact Data

Email address, phone number, billing and delivery addresses

Financial Data

Payment details and transaction history; card data is collected and processed by our payment providers, and we do not store full card numbers

Technical Data

IP address, browser type, device information, login records, access times

Usage Data

Service usage patterns, preferences, feature interactions, API usage statistics

API & Credential Data

API keys, request logs, authentication tokens, usage metrics

Communications & Chat Data

Messages you exchange with our support team and with our AI assistants (including Caretta), chat transcripts, and related metadata; voice messages sent on connected channels may be transcribed to text so the assistant can reply

Visitor-Submitted Details

Contact details (such as a name, email address, or phone number) that a website visitor chooses to leave with an assistant deployed by one of our customers, and verified identity attributes the customer's own systems pass to us; processed on that customer's behalf (see Section 5)

Mobile App & Device Data

Account data, device information, and push notification tokens processed when you use our companion apps (WordPress, Android, and, when released, iOS) to monitor and answer conversations

03

Legal Bases for Processing

Where the GDPR applies, we rely on the legal bases set out in Article 6(1); comparable grounds apply under US privacy laws.

Performance of a Contract

Processing necessary to provide the services you have requested, to manage your account, and to bill you.

Legal Obligation

Processing necessary to comply with the laws that apply to us, including United States federal tax and accounting requirements and ICANN rules that apply to domain registration services.

Consent

For marketing communications, for uses of your data in AI model training as described in Section 5, and for non-essential cookies. You may withdraw consent at any time.

Legitimate Interests

Securing and improving the services and preventing fraud and abuse, in each case balanced against your rights and freedoms.

04

How We Use Personal Data

Service Delivery

Operating our AI assistant services, APIs, domain registration, hosting, software licensing, and custom development services

Customer Support

Responding to inquiries, resolving technical issues, and providing service notifications

Billing & Invoicing

Processing payments, issuing invoices, and administering subscriptions and account balances

Security & Compliance

Detecting and preventing fraud and abuse, maintaining service integrity, and meeting our legal obligations

05

AI Services & Data Processing

How Our AI Services Handle Personal Data

Our products include AI-powered services, in particular the Caretta assistant, which can be used in our dashboard, embedded on customer websites, or connected to messaging channels. This section explains how personal data is handled when those services are used.

Controller & Processor Roles

When you interact with Caretta on wapiso.com, WAPI is the controller of that conversation data. When a customer embeds Caretta on its own website or connects it to its own messaging channels, we process the messages of that customer's visitors on behalf of the customer, which remains the controller of its visitors' data and is responsible for its own privacy notices.

Data Minimization & Model Training

AI services process only the data needed to generate the requested output. We do not use your personal data or your confidential content to train AI models made available to other customers without permission. We may use de-identified, aggregated usage data to maintain and improve service quality.

Third-Party Model Providers

Responses may be generated using third-party machine-learning infrastructure. Those providers receive the data needed to generate a response and are bound by contractual terms that restrict any other use of it.

Human Oversight & Automated Decisions

We do not use AI services to make decisions that produce legal or similarly significant effects on you without human involvement. You may request human review of an AI-assisted decision that affects you.

Live Conversations & Human Takeover

Conversations run in real time over encrypted connections. Where a customer enables live takeover, the customer's authorized team members can view a conversation and reply in person through the dashboard or companion apps; while they do, the AI stops answering, and replies written by humans are not reused as automated answers for other visitors.

Visitor-Submitted Details & Verified Identity

Where a customer enables these features, contact details a visitor chooses to leave, and identity attributes verified by a cryptographic signature from the customer's own systems, are collected on the customer's behalf and stored encrypted with per-visitor keys. Email addresses and phone numbers are not included in prompts sent to AI models, conversations attached to a verified identity are excluded from cross-customer aggregation, and deletion of an individual visitor's details is supported at the customer's instruction. Visitors should direct privacy requests to the operator of the website they visited; if you contact us directly, we will refer your request to that operator and assist.

06

Domain & Hosting Services

WHOIS Data & ICANN Requirements

For domain registration services, we are required to collect and maintain registration data under ICANN policy and to pass it to the applicable registrar and registry. This data includes:

Registrant name, organization, and contact information
Technical and administrative contact details
Domain registration and expiration dates
Name server information

WHOIS Privacy Protection

Where the applicable registry permits, we offer WHOIS privacy protection, which replaces your personal details with proxy data in public WHOIS records while preserving compliance with ICANN policy.

Hosting Data

For hosting services, we process server logs, traffic data, and backups. Hosting data is stored in secured data centers under appropriate technical and organizational measures.

07

Disclosure & International Transfers

We disclose personal data only to the following categories of recipients, and only to the extent necessary:

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA.

08

Data Security

Encryption

TLS encryption for data in transit; passwords stored as salted one-way hashes; card data handled by PCI DSS compliant payment providers

Access Control

Role-based access, two-factor authentication support, and audit logging

Network Protection

Firewalls, intrusion detection, DDoS mitigation, and recurring security reviews

Backup & Continuity

Routine backups and disaster recovery procedures

09

Cookies & Similar Technologies

10

Your Rights

Depending on where you live, you have some or all of the following rights with respect to your personal data:

Right to Information

To know whether we process your personal data and to obtain information about that processing.

Right of Access

To request a copy of the personal data we hold about you.

Right to Rectification

To have inaccurate or incomplete personal data corrected.

Right to Erasure

To request deletion of your personal data where it is no longer needed or where you withdraw consent.

Right to Restriction

To limit the processing of your personal data in the circumstances defined by law.

Right to Data Portability

To receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

To object to processing based on legitimate interests and to processing for direct marketing.

Automated Decision-Making

Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

How to Exercise Your Rights

Send your request to [email protected] from the email address associated with your account, or write to us at the postal address in Section 12. We extend the core rights above to all users worldwide, regardless of location, subject to identity verification and applicable law. We respond within one month under the GDPR and within 45 days under the CCPA, and otherwise within the period your local law requires; where the law allows an extension, we will tell you before the original deadline expires. We will not discriminate against you for exercising any of these rights. You may also lodge a complaint with a supervisory authority:

United States: Federal Trade Commission (ftc.gov) or your state Attorney General
EU/EEA: the data protection authority of your member state
United Kingdom: Information Commissioner's Office (ico.org.uk)
Türkiye: Kişisel Verileri Koruma Kurumu (kvkk.gov.tr)
Other jurisdictions: the data protection authority competent for your place of residence

11

Data Retention

Account Data

For as long as your account is active, and for up to 3 years after closure where needed to comply with legal obligations or to establish, exercise, or defend legal claims

Financial Records

7 years, as required by applicable tax and accounting law

Domain Registration Data

The registration period plus 3 years, as required under ICANN policy

Server Logs

90 days for security purposes, after which they are deleted or anonymized

API Usage Logs

12 months for billing and capacity planning

12

Contact & Data Protection

Data Protection Contact

Email: [email protected]
We respond within the timeframes required by applicable law.

Privacy Inquiries

Email: [email protected]
[email protected]

Phone

+1 307 207 0 100

Postal Address

WAPI Solutions LLC
30 N Gould St Ste R Sheridan, WY 82801, USA