smartwaLast updated: October 2026
This Privacy Policy explains how SmartWA (“SmartWA”, “we”, “us”) handles personal data when you visit our website, use our dashboard, or when a website or link that uses SmartWA measures a visit. SmartWA is an independent product and is not affiliated with WhatsApp or Meta.
1. Who is responsible
- We are the controller (data fiduciary) of data about our customers and users: accounts, billing, security, abuse reports and privacy requests, and of data we collect on our own website.
- We are the processor (data processor) for analytics, smart-link click data and form submissions collected for our customers. The customer (the website or link owner) decides why that data is collected and has its own notice and legal basis. Our Data Processing Addendum applies.
Contact for data protection: hello@smartwa.link.
2. What we collect
Account and billing. Name, email address, password (stored only as a salted hash) or your Google account identifier if you sign in with Google, your team members, plan details, and payment status. Card details are entered with our payment provider and never reach our servers.
Customer settings. Websites, WhatsApp numbers, smart links, prefilled messages, forms and their results, which our customers enter themselves.
Website visitors (analytics on a customer’s site). When a customer installs the SmartWA script, then, only after the visitor accepts analytics and sends no privacy signal (see section 5), the script records: a random visitor ID kept in the browser’s local storage (stored on our server only as a keyed hash), a session ID, page address, referrer, campaign (UTM) parameters, device type, browser, operating system, screen size, language, time zone, approximate location (country, region, city, derived from the IP address with a local database, the IP address is shortened before it is stored (the last part of an IPv4 address is set to 0; an IPv6 address is cut to its first 48 bits) for smart links, and not stored at all for website analytics), time engaged, scroll depth, form-submission and outbound-link events, and WhatsApp-button clicks with timing signals (such as how long the tab was hidden) used to estimate whether a chat was started. We cannot see the content of WhatsApp chats and do not collect visitors’ phone numbers through the analytics script.
Smart-link clicks. When someone opens a SmartWA link we record the time, an IP address in shortened form, approximate location, device, browser, operating system, referrer, campaign parameters, and, where allowed (section 5), a random identifier in a first-party cookie to count unique clicks. A short “Opening WhatsApp” page measures whether the visitor really left for WhatsApp and for how long. Automated link-preview crawlers are recorded separately as bots.
Forms. Whatever a visitor types into a form built with SmartWA is stored for the form owner, with the page address, device type, country and a shortened IP address.
Reports and requests. If you report abuse or make a privacy request we keep what you send (name and email are optional for abuse reports) and a shortened IP address for abuse reports.
Technical logs. Our hosting provider keeps standard server logs (including full IP addresses) for security and operation, under its own retention settings.
3. Why we use it, and our legal bases
| Purpose | Legal basis (GDPR) / ground (India DPDP) |
|---|---|
| Provide the account, dashboards, links, analytics and billing | Contract; for visitors, the customer’s basis (usually consent) |
| Measure visits and WhatsApp clicks on a customer’s website | Consent (the analytics banner or the customer’s consent tool); the customer is responsible for obtaining it |
| Security, fraud and abuse prevention, bot filtering, enforcing our Acceptable Use Policy | Legitimate interests; legitimate uses |
| Answer requests, complaints and legal claims; comply with law and orders | Legal obligation; legitimate interests; legitimate uses |
| Account notices (billing, password reset, important changes) | Contract; legitimate interests |
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not build advertising profiles. We use no automated decision-making that has legal or similarly significant effects on people.
4. Cookies and local storage
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
smartwa_session | Our site (logged-in or form pages) | Strictly necessary: sign-in session and security token | Until you close the browser |
smartwa_link_visitor | Smart-link domain | Analytics: counts unique clicks. Not set for visitors with a privacy signal, visitors who opted out, or (by default) visitors in the EU/EEA, UK and Switzerland | 1 year |
smartwa_optout | Smart-link domain | Remembers that you opted out | 1 year |
smartwa_vid, smartwa_session_*, smartwa_queue_* | Customer’s website (local storage) | Analytics: visitor and session IDs and events waiting to be sent. Created only after consent | Until deleted; the session ID renews after 30 minutes of inactivity |
smartwa_consent, smartwa_optout | Customer’s website (local storage) | Strictly necessary: remembers your analytics choice | Until deleted |
smartwa_site_ga | Our site (local storage) | Remembers your choice about optional analytics on our own pages | Until deleted |
If we have switched on Google Analytics for our own marketing pages, it is loaded only after you accept the banner on those pages and never when your browser sends a privacy signal.
5. Your choices: consent and browser privacy signals
- The SmartWA script waits for consent by default. Nothing is stored in your browser and nothing is sent to us until you choose Accept in the analytics banner (or the site’s own consent tool). You can withdraw at any time through the site’s privacy settings; withdrawing deletes the identifiers SmartWA stored.
- We honour Global Privacy Control and Do Not Track: when your browser sends either, the script collects nothing and smart links set no identifier. This also counts as an opt-out of sale/sharing under US state laws.
- You can opt out of smart-link tracking in this browser on our privacy requests page.
- The WhatsApp button and smart links keep working in all cases.
6. Who receives data
Only the people and companies needed to run the service: our hosting and infrastructure provider; Dodo Payments (payment processing); Google, only if you use “Sign in with Google”; and our email delivery. We list them with their roles in the DPA. Visitor IP addresses are looked up in a local GeoIP database and are not sent to any third-party geolocation service. Our public pages load open-source code (Tailwind CSS, and Chart.js in the dashboard) from content delivery networks, which see your IP address and browser details like any web request. We may disclose data to courts, law enforcement or other authorities where the law requires, or to protect rights and safety, and to a successor if our business is transferred.
7. International transfers
Our customers and visitors are in many countries, so data may be processed outside your country. Where the law requires safeguards we use them, such as Standard Contractual Clauses, and we follow India’s DPDP Act on transfers.
8. How long we keep data
| Data | Kept for |
|---|---|
| Raw analytics events and sessions, smart-link clicks and WhatsApp-return signals | 400 days, then deleted automatically |
| Account data | While your account is active and until deleted at your request (within 30 days), except what the law requires us to keep |
| Billing records | As long as tax and accounting law requires |
| Abuse reports | The report is kept; the reporter’s name, email and IP are removed 180 days after the report is resolved |
| Privacy requests | Personal details removed 12 months after the request is completed |
| Form submissions | Until the form owner deletes them or deletes the form |
9. Security
We use HTTPS, keyed hashing of visitor identifiers, password hashing (Argon2id), role-based access, CSRF protection, rate limiting and shortened IP addresses. No online service is perfectly secure. If a breach is likely to harm you we will tell you and the authorities as the law requires.
10. Your rights
Depending on where you live you may have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent at any time; not be subject to solely automated decisions; and complain to a regulator. Under India’s DPDP Act you also have the right to a summary of your data and the processing, to grievance redressal and to nominate another person to exercise your rights. Under California law you may know, delete and correct your data and opt out of sale or sharing (we do neither). We will not discriminate against you for using your rights.
To use a right, use our privacy request form or email hello@smartwa.link. We may need to confirm who you are. We reply within 30 days (or sooner where the law says). If you are a visitor to a customer’s website, the customer decides on your request and we help them; we hold only pseudonymous identifiers, so we may ask you for the identifier from your browser.
11. Children
SmartWA is a business service for people aged 18 or over. We do not knowingly collect data from children. Customers must not use SmartWA to target children or collect their data. If you think a child’s data has reached us, contact us and we will delete it.
12. Grievance officer (India) and complaints
Grievance Officer, SmartWA
Email: hello@smartwa.link
We acknowledge complaints within 48 hours and aim to resolve them within one month. You may also complain to your data protection authority.
13. Changes
We may update this policy. We will change the date above and, for material changes, tell account holders by email or in the dashboard.