Privacy Policy

This Privacy Policy explains how Activated Digital Ltd ("WAGate", "we", "us") collects, uses, shares, and protects personal information in connection with the WAGate platform at wagate.app and its related apps, APIs, and services (the "Service").

1. Our two roles

WAGate plays two different data-protection roles depending on whose data is involved:

• As a controller — for the personal data of our own account holders (the businesses and individuals who sign up), website visitors, and prospects. We decide why and how that data is processed.
• As a processor — for the personal data inside the WhatsApp conversations that our business customers run through WAGate (their end-customers' phone numbers, names, and message content). Here our customer is the controller, we act on their documented instructions, and processing is governed by our Data Processing Addendum.

2. Information we collect

Account & profile data

When you create an account we collect your name, email address, password (stored only as a salted hash), business name, and your notification and language preferences.

WhatsApp Business connection data

When you connect a WhatsApp Business Account through Meta's Embedded Signup, we receive and store your WhatsApp Business Account ID, phone number IDs, display names, business verification status, and the access tokens needed to call the Meta Cloud API on your behalf. Access tokens are encrypted at rest (AES-256-GCM).

Messaging data (processed for our customers)

To deliver the Service we process the messages, phone numbers, profile names, media, and delivery/read events that flow between our customers and their end-customers over WhatsApp. We process this data only to provide the Service and never sell it or use it for our own advertising.

Usage, device & log data

We log API requests, IP address, browser/device type, pages viewed, approximate location (derived from IP for language/Hebrew gating), and error diagnostics.

Payment data

Subscriptions are billed through our payment provider (pay.activated.digital, powered by Sumit). We receive your plan, billing status, and the last four digits / receipt metadata. We do not store full card numbers — these are handled by the payment provider.

3. How we use information & legal bases

• Provide the Service — operate your account, connect numbers, send/route messages, show analytics (performance of a contract).
• Billing — process subscriptions and prevent fraud (contract / legitimate interests).
• Communications — service emails, security notices, and (with consent where required) product updates.
• Security & abuse prevention — protect the platform, enforce our Acceptable Use Policy (legitimate interests / legal obligation).
• Improvement — aggregate, de-identified analytics to improve the Service (legitimate interests).
• Legal compliance — meet obligations under applicable law and Meta's platform requirements.

4. WhatsApp & Meta Platform data

WAGate is built on the official WhatsApp Cloud API. Our use of information received from Meta APIs follows the Meta Platform Terms and Developer Policies. In particular:

• We only request the permissions needed to operate the Service for you.
• We use Meta/WhatsApp data solely to provide and improve the features you connect — not to build advertising profiles and not for any purpose you have not authorized.
• We do not sell Meta/WhatsApp data, and we do not transfer it to data brokers or ad networks.
• We comply with the WhatsApp Business Messaging Policy and require our customers to do the same under our Acceptable Use Policy.

WAGate is an independent platform and is not endorsed by, affiliated with, or operated by Meta Platforms, Inc. "WhatsApp" and "Meta" are trademarks of Meta Platforms, Inc.

5. AI features

Some optional features — including the AI chatbot and AI-assisted replies — process message content and your configured knowledge-base content through a third-party large-language-model provider (Google Gemini) to generate suggestions or automated responses. This processing happens only when you enable the feature. Content sent for AI processing is used to produce the response for you and is not used by us to train our own models. Google's handling of API data is governed by its applicable terms. You can disable AI features at any time in your settings.

6. Sharing & subprocessors

We do not sell personal data. We share it only with:

• Subprocessors who help us run the Service (hosting, email delivery, payments, AI). They act under contract and may process data only as needed to provide their service.
• Meta/WhatsApp, to actually deliver your messages over the Cloud API.
• Authorities, where required by law or to protect rights, safety, and the integrity of the Service.
• A successor, in a merger, acquisition, or asset sale (subject to this Policy).

Our current subprocessors are listed in the Data Processing Addendum.

7. International transfers

We are based in Israel and our subprocessors operate in various countries. Where personal data is transferred across borders (including from the EEA/UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Retention

We keep account data for as long as your account is active and as needed to provide the Service. Messaging data processed on behalf of customers is retained per the customer's configuration and the DPA. After account closure we delete or anonymise personal data within a reasonable period, except where we must retain it to meet legal, accounting, or security obligations.

9. Security

We use prepared statements, hashed passwords, encryption of access tokens at rest (AES-256-GCM), TLS in transit, session protections, CSRF protection, and least-privilege access. No method of transmission or storage is 100% secure, but we work continuously to protect your data.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent. EEA/UK residents have these rights under the GDPR; California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To exercise any right, contact us at info@activated.digital. You also have the right to lodge a complaint with your local data-protection authority.

If we process your data on behalf of a business customer (as a processor), please direct your request to that business; we will assist them in responding.

11. Deleting your data

You can delete your account and associated data at any time. See our dedicated Data Deletion page for exactly what is removed and how to request it.

12. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the "Last updated" date; material changes will be communicated through the Service or by email.

14. Contact us

Activated Digital Ltd
Company no.: 514400597
Gary Bertini 1, Tel Aviv, Israel
Tel: +972-3-52-444-11
Privacy / Data Protection: info@activated.digital