Privacy policy

What this website collects

This site uses Google Analytics to count page views and to see which pages lead people to start an account. It sets a first-party cookie holding a random identifier for your browser, so that two visits from you are not counted as two different people. It is not your name, we never send Google anything you have typed, and the identifier is not joined to anything you do inside the product.

Google's advertising features are switched off here at the source rather than left unused: the Google tag is loaded with advertising storage, advertising signals and personalisation all denied, so nothing Google measures on this site can be used to build an audience to advertise to.

You can refuse Google Analytics. Any browser setting or extension that blocks it blocks this, and nothing on this site behaves differently when it is blocked. Every page works with the tag missing, because it is loaded after everything else and no content waits on it.

If you book a demo, the calendar is our own booking system and you give it your name, email and any detail you choose to type. We use it to hold the call and to follow up at most three times. One click unsubscribes, and we do not sell or share the list.

Advertising measurement

We advertise on TikTok, and this site carries TikTok's pixel so that we can tell which of those ads lead someone to read about the product, book a demo or create an account. It reports the pages you view here, and a demo booked or a mail link opened. It sets a first-party cookie, _ttp, holding a random identifier for your browser, and if you arrived from a TikTok ad we keep that ad's click identifier for 28 days.

No page of the product carries the pixel. Instead, when you create a workspace, start a checkout, begin a trial or pay an invoice, our server tells TikTok through its Events API. It sends a one-way hash of your email address and of your account's identifier, the click identifier, the _ttp cookie this site set, the IP address and browser of the device you signed up from, and the address of the page it happened on, which is the sign-up or the billing page. That is how TikTok matches the event to the ad you saw. For payments it also receives the plan and the amount. We erase the IP address, browser and click identifier from our own records within 30 days.

Nothing from inside the product is ever sent. No workspace name, no message, no contact, no phone number, and nothing you open or search for after signing up.

We do not sell your information. Giving it to TikTok to measure our advertising counts as sharing it under California law, and you can stop that below.

Your privacy choices

Advertising measurement does not run at all in a browser that sends Global Privacy Control, which we treat as a request not to share, or whose timezone is in the European Economic Area, the United Kingdom or Switzerland, where it would need a consent we do not ask for, or does not say where it is. Our server also reports nothing about a sign-up or a payment from a connection our network provider places in those countries, or cannot place. A timezone is only a stand-in for where you are, and can be wrong either way; the control below works everywhere.

The choice is a cookie on this site and the sign-up page, for this browser; clearing your cookies clears it too. Blocking TikTok's script with any browser setting or extension also works, and nothing on this site behaves differently when it is blocked. If you have already created a workspace, starting a checkout from a browser that has opted out or sends Global Privacy Control stops all reporting about that workspace for good, payments included, and so does writing to us.

What the product processes

Inside WAOversight, our customer is the data controller and we are the processor. They decide which company-owned numbers to link and what to do with the archive; we hold it and make it searchable. The detail of that relationship is in the data processing agreement.

What the product processes on a linked number:

• Messages sent and received, including their content, timestamps, and whether they were deleted or edited.
• Attachments (images, documents, voice notes), stored encrypted.
• The phone numbers and display names of the people in those conversations.
• Metadata needed to keep the link working, including session state and connection health.

It does not process anything else on the phone. No location, no contacts list, no call logs, no other applications. There is no software installed on any device.

Who else sees it

Our infrastructure providers, in the ordinary way that any hosted product depends on them: cloud hosting and storage, a transactional email provider for notifications, and a payment processor for billing. Card details go directly to the payment processor and never reach our servers. TikTok receives the advertising measurement described above, about the person who signed up, and nothing else.

If a workspace owner switches on Nora, our AI assessment feature, the text of that workspace's customer conversations is also sent to the AI provider the owner chose (OpenAI, Google, Anthropic or DeepSeek), with the workspace's own API key and under its own agreement with that provider, as described on the security page.

We do not sell data, no advertiser ever receives anything from a workspace's archive, and we do not use customer conversation content to train anything.

How long we keep it

Archive retention is set by the customer, per workspace, and defaults to 12 months. It applies from the date each message was captured. The record of who accessed what is kept longer than the messages themselves, three years by default, because an audit trail that expires before the thing it audits is not an audit trail. On cancellation, the archive remains exportable for 30 days and is then deleted.

Website form submissions are kept for 24 months unless you ask us to remove them sooner, which you can do by writing to us.

Your rights

If you are a visitor, you can ask what we hold about you and ask us to delete it. If you are an employee whose conversations are archived by your employer, the controller is your employer: ask them first, and we will support them in answering. We will not disclose a customer's archive to anyone other than that customer without a lawful order.

Write to [email protected] for anything on this page.

Who we are

WAOversight is a product of Applyform, LLC. Write to us at [email protected], or by post: