Privacy Policy

Effective date: 2026-11-05 · Versión en español

This Privacy Policy explains how Power Era Servicios, S.C. ("PowerEra", "we", "us") collects, uses, stores and shares personal information when you use Waykee: the web application at wk2.waykee.com, the Waykee mobile and desktop apps, the Waykee API, and the Waykee connector for ChatGPT and Claude (the "Connector", served at https://wk2.waykee.com/mcp). Together these are the "Service".

1. Information we collect

Information you provide

• Account data: name, username, email address and password (stored only as a salted hash), and optional profile settings such as language and theme.
• Workspace content: the projects, tasks, conversations, messages, documentation, files and attachments you or your team create in Waykee.
• Billing data: if you buy a paid plan, our payment processor (Stripe) collects your card details. We receive only a payment reference, the plan, and the billing status; we never see or store full card numbers.
• Support communications: what you send us when you contact support@powerera.com.

Information collected automatically

• Technical and security logs: IP address, browser or app version, request timestamps, and errors, used to operate and secure the Service.
• Cookies and local storage: a session cookie that keeps you signed in, a language cookie, and your theme preference stored in your browser. We do not use advertising cookies.
• Push notification tokens: if you enable notifications on a device, that device's push token.
• Website visits: our public website records basic visit data (page, time, referrer, browser). It does not geolocate visitors.

2. Information we receive through ChatGPT and Claude (the Connector)

When you connect Waykee to ChatGPT (OpenAI) or Claude (Anthropic), you sign in to Waykee and approve the connection. After that:

• What we receive: only the tool requests that the AI assistant sends to Waykee on your behalf, for example a search query, the ID of a task to read, or the text of a message you asked it to post. We do not receive your full chat history with ChatGPT or Claude, your OpenAI or Anthropic account credentials, or your files in those services unless the assistant includes them in a tool request.
• What we return: only data from your Waykee account that you already have permission to see, limited to what the requested tool needs.
• Access tokens: we issue the assistant an access token valid for 1 hour and a refresh token valid for up to 90 days. We store only cryptographic hashes of these tokens, plus an audit log of authorization events (connection, token refresh, revocation).
• Connection data: the client name and redirect URL that ChatGPT or Claude registers with us, and the time of each authorization.

Data that Waykee returns to ChatGPT or Claude is then processed by OpenAI or Anthropic under their own privacy policies. We do not control how those services store or use it.

3. WhatsApp Business messaging

A business can connect its WhatsApp Business number to Waykee, through Meta's Embedded Signup or a manual setup, to serve its customers from Waykee. For this data the business decides what is processed and why, and PowerEra processes it on the business's behalf and under its instructions. If you are a customer writing to a business on WhatsApp, the business is responsible for your data; you can also contact us as described below.

What we receive from Meta and WhatsApp

• Business account data: the WhatsApp Business Account ID, the phone number ID, the business phone number and its verified display name, the Meta business portfolio ID, and the status of the account.
• Access token: the token the business grants to Waykee when it connects through Embedded Signup, so Waykee can send and receive messages for that number.
• Contact data: the phone number and WhatsApp profile name of each customer who writes to the business.
• Messages: the content of the messages exchanged with the business, and the attachments allowed by Waykee (images, audio, video, PDF and Office documents up to 16 MB). Audio is stored as received; Waykee does not transcribe it.
• Delivery data: the message IDs and delivery statuses (sent, delivered, read, failed) that WhatsApp reports.
• Messages sent from the WhatsApp Business app: if the business keeps using the WhatsApp Business app on its phone with the same number ("coexistence"), Waykee receives a copy of the messages the business sends from the phone and, once, when the number is connected, the chat history that Meta shares (up to 180 days).
• Meta login: the business signs in with Facebook to connect its number. We do not read the person's Facebook profile; from Meta's deauthorization and data deletion requests we keep only an irreversible hash of the Meta user ID.

What we use it for

Only to let the business serve its own customers from Waykee: the conversation inbox, the business's AI assistant (if the business turns it on), handing a conversation over to a person on the business's team, and tickets created from those conversations. Customers can write HUMANO to talk to a person, PRIVACIDAD to receive the business's privacy notice again, and STOP or BAJA to stop receiving messages. We do not use WhatsApp data for advertising, we do not build profiles of customers, we do not sell it, and we do not use it to train AI models.

How we protect it

• Encryption in transit (HTTPS/TLS) on every connection with Meta and with Waykee users, and webhook calls from Meta are verified with Meta's signature.
• Encryption at rest of databases and file storage. In addition, the contact's phone number and name are encrypted individually (AES-256-GCM), and the raw messages Meta delivers are stored encrypted while they are processed.
• The business's access token is stored encrypted as a secret that only the Waykee server can read; it is never shown to users or to AI assistants.
• Only the members the business authorizes in Waykee can see its WhatsApp conversations. Connecting and disconnecting accounts, permission changes and handovers are recorded in an audit log.

Who we share it with

• Meta (WhatsApp Business Platform): to send and receive the messages. Meta processes this data under its own terms and privacy policy.
• AI providers: if the business turns on its AI assistant, the text of the conversation needed to answer is sent to Anthropic or OpenAI, depending on the model the business uses, only to generate the assistant's replies. Messages are first screened for prompt-injection attempts by a classifier that runs on our own servers. The text of conversations can also be sent to the OpenAI Embeddings API to power search inside the business's Waykee workspace. Under their API terms, these providers do not use this data to train their models (see section 5).
• Our hosting and notification providers listed in section 5, as needed to run the Service. Members of the business's team see the conversations they are authorized to see.

Retention and deletion

• Conversations, attachments and delivery statuses are kept while the business keeps its Waykee account, so it can keep serving its customers, unless the business or the customer asks us to delete them.
• The encrypted copy of the raw messages Meta delivers to us is deleted 30 days after processing. The chat history shared when a number is connected is kept encrypted only until it is imported.
• When a business disconnects its number from Waykee (or removes Waykee from its Meta Business portfolio), we unsubscribe Waykee from its WhatsApp Business Account, destroy the stored access token and stop sending and receiving messages for that number. The conversation history stays in the business's workspace until the business deletes it or asks us to delete it.
• To delete WhatsApp data, follow the data deletion instructions or write to support@powerera.com. We complete requests within 30 days, except for data we must keep for legal, tax or security reasons.

WhatsApp and Meta policies

Waykee's use of the WhatsApp Business Platform complies with the WhatsApp Business Messaging Policy, the WhatsApp Business Terms of Service and the Meta Platform Terms. Businesses that use Waykee must also comply with them, including getting their customers' consent before messaging them and honoring opt-outs.

4. How we use information

• To provide, maintain and secure the Service, including authenticating you and enforcing access permissions.
• To run the features you request, such as search, notifications, AI agents and the Connector.
• To process payments and manage subscriptions.
• To respond to support requests and send service messages (for example security or billing notices).
• To detect, investigate and prevent abuse, fraud and security incidents.
• To comply with legal obligations.

We do not sell your personal information, we do not use it for advertising, and we do not use your workspace content, Connector data or WhatsApp data to train AI models.

5. How we share information

We share personal information only with service providers (subprocessors) that process it on our behalf to run the Service, under contracts that limit their use of it, and only as needed. Our current subprocessors are:

OpenAI and Anthropic process the data sent through their APIs under their API data-processing terms: under those terms they do not use API data to train their models, and they keep it only for limited periods for abuse monitoring. We will update this list before adding a new subprocessor.

We may also disclose information if required by law or to protect the rights, property or safety of our users or others, and in connection with a merger or acquisition, subject to this Policy. Members of your Waykee workspace can see the content shared with them in accordance with workspace permissions.

6. Storage, security and international transfers

Data is stored on cloud infrastructure operated by Microsoft Azure. Data is encrypted in transit (HTTPS/TLS) and at rest (encrypted databases and file storage). Passwords and access tokens are stored as hashes, and access to production systems is restricted to authorized personnel. Your information may be processed in countries other than your own, including the United States and Mexico; where required, we use appropriate safeguards for these transfers.

7. Retention

• Account data and workspace content are kept while your account is active.
• Connector access tokens expire after 1 hour; refresh tokens expire after at most 90 days or as soon as you disconnect or revoke the connection.
• WhatsApp data is kept as described in section 3.
• Security and audit logs are kept for as long as needed to secure the Service and meet legal obligations.
• When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except where we must keep it for legal, tax or security reasons. Backups are overwritten on their regular cycle.

8. Your choices and rights

• Disconnect the Connector at any time from ChatGPT or Claude settings, or revoke it in Waykee from Connected apps; see how to revoke access. You can also ask us to revoke every Connector token on your account.
• Delete data: see the data deletion instructions.
• Access, correct, export or delete your personal information, or object to or restrict its processing, by writing to support@powerera.com. Depending on where you live (for example under Mexico's data protection law, the GDPR, or US state privacy laws) you may have additional rights, including the right to complain to your data protection authority.
• If your account is managed by an organization, some requests may need to go through that organization.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

10. Changes to this Policy

We may update this Policy. We will post the new version on this page with a new effective date and, for material changes, notify account holders by email or in the app.

11. Contact

Power Era Servicios, S.C.
Calle Vasco de Quiroga 3900, Torre A, Piso 10 B, Col. Santa Fe Cuajimalpa, Alcaldía Cuajimalpa de Morelos, C.P. 05348, Ciudad de México, México
Email: support@powerera.com