Google API Services — User Data Disclosure

1. Overview

This page describes how WAPPI ("the Application"), operated by Wappi Holding LLC, accesses, uses, stores, and protects data obtained through Google API Services. WAPPI's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

2. Application identity and purpose

WAPPI is a conversational commerce platform that enables businesses to manage sales, customer support, and AI agents through WhatsApp and other messaging channels. The application integrates Google services for specific features that users voluntarily activate, such as calendar synchronization and advertising campaign attribution.

3. Google data we access

WAPPI only requests access to the following Google permissions (scopes), each tied to a specific feature:

4. Limited Use of Google data

WAPPI fully complies with the Limited Use requirements of the Google API Services User Data Policy:

• We only use Google data to provide and improve user-facing features authorized by the user. We do not use this data for any other purpose.
• We do not transfer Google data to third parties, except: (a) when necessary to provide the functionality requested by the user; (b) for security purposes (abuse or vulnerability investigation); (c) as required by binding legal process; or (d) with explicit user consent.
• We do not use Google data to serve advertising, including retargeting, personalized advertising, or interest-based advertising.
• We do not allow humans to read Google data, except: (a) with explicit user consent; (b) for security or legal compliance; or (c) when data has been aggregated and anonymized for internal operations.
• We do not use data obtained from Google APIs to train or improve generalized AI or machine learning models.

5. Data storage and security

Google data is protected with the following security measures:

• OAuth access tokens encrypted with AES-256-GCM at rest in our database.
• All communications with Google APIs conducted exclusively through encrypted channels (TLS 1.2+).
• Tokens limited to minimum scopes required for the requested functionality (principle of least privilege).
• OAuth state parameter verified via HMAC-SHA256 to prevent CSRF attacks.
• Automatic token renewal with 5-minute buffer before expiry.
• Google data stored with tenant isolation (multi-tenancy), ensuring no user can access another user's data.

6. Data sharing

WAPPI does not sell, rent, or share Google data with third parties for their own purposes. Data is only shared with technology sub-processors when strictly necessary to provide the requested functionality (e.g., the Supabase database where encrypted tokens are stored). All sub-processors are bound by data processing agreements. The full list of sub-processors is available in our Privacy Policy (https://wappi.chat/privacidad/).

7. Revocation and data deletion

Users can revoke WAPPI's access to their Google data at any time via two methods: (1) From the WAPPI platform: Settings > Integrations > Disconnect the corresponding Google integration. (2) From Google directly: https://myaccount.google.com/permissions — select WAPPI and revoke access. Upon revocation by either method, WAPPI immediately deletes stored access tokens and ceases all access to the user's Google data. Derived data (such as previously synced calendar events) is deleted within 24 hours.

8. Contact

For inquiries about Google data usage in WAPPI, contact our data protection team: [email protected] — https://wappi.chat