Privacy Policy
Last updated: 19 June 2026
WAT (Welcome Automation Tool) is operated by Bespoke Automation Systems Ltd, a company registered in England and Wales. We act as data controller for our customers' account data and as data processor for guest messages handled on a customer's behalf.
1. Who this policy is for
This policy covers personal data we handle for three groups of people:
- Property owners who sign up for WAT
- Guests who message a property using WhatsApp
- Visitors to welcomeautomationtool.co
2. What we collect and why
| Category | Examples | Why |
|---|---|---|
| Account data | Owner name, email, WhatsApp number, property details | Provide the service, billing, support |
| Connected account credentials | WhatsApp Business Account ID, phone number ID, access tokens granted via Meta Embedded Signup | Send and receive messages on the customer's behalf |
| Guest messages | Inbound and outbound WhatsApp text content, sender phone number, timestamps | Generate replies, learn brand voice, escalate to the owner |
| Owner approvals | Owner edits, approves, rejects, and notes on agent drafts | Improve replies for that property over time |
| Billing | Stripe Customer ID, last 4 of card, country, invoice history | Process subscription payments |
| Website usage | Page views, referrer, basic device info | Improve the site |
3. Legal basis (UK GDPR)
- Contract — to deliver the service the customer signed up for
- Legitimate interests — to operate, secure, and improve the product
- Consent — for marketing emails (you can withdraw at any time)
4. Who we share data with
We use a small number of trusted sub-processors. We do not sell personal data.
| Sub-processor | Purpose | Location |
|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business Cloud API delivery | EU / US |
| Twilio Inc. | Fallback WhatsApp messaging and SMS | US |
| Groq Inc. | LLM inference for reply generation | US |
| Stripe Payments UK Ltd | Subscription billing | UK / EU |
| Vultr / hosting provider | Application hosting | EU (Frankfurt) |
5. How long we keep data
- Guest message history: 24 months from last message, then deleted
- Owner approval history (used to learn brand voice): retained for the life of the account
- Billing records: 7 years (UK tax law)
- Account data: deleted within 30 days of account closure unless retention is required by law
6. International transfers
Where we transfer personal data outside the UK / EEA (mainly to US sub-processors), we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum.
7. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict, port, and object to processing of your personal data. To exercise any of these rights, email privacy@welcomeautomationtool.co. We respond within 30 days.
You can also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Data deletion requests
You can request deletion of all personal data we hold about you at any time by emailing privacy@welcomeautomationtool.co with the subject line "Data deletion request". Include the email address or WhatsApp number the data is associated with. We delete within 30 days and confirm by email.
If you are a guest messaging a property that uses WAT, the property owner is the data controller for your messages. WAT processes the messages on their behalf. You can either contact the property directly or email us and we will forward your request to them.
9. Security
Data is encrypted in transit (TLS) and at rest. Access tokens are stored encrypted. Access to production systems is limited to named engineers under multi-factor authentication.
10. Cookies
welcomeautomationtool.co uses essential cookies only (session). No advertising or third-party tracking cookies.
11. Changes
We will post material changes at the top of this page and notify active customers by email at least 14 days before they take effect.
12. Contact
Bespoke Automation Systems Ltd · London, United Kingdom
privacy@welcomeautomationtool.co