Privacy Policy

The controller for the personal data described here is SOFTIUM Sàrl (Softium LLC), a Swiss limited liability company:

Email and the web form reach the same privacy team. That team is also our contact for the Swiss Federal Data Protection and Information Commissioner (FDPIC), acts as our encarregado under Brazil's LGPD, and handles grievances under India's Digital Personal Data Protection Act (DPDP Act).

EU representative. Under article 27 of the GDPR, our representative in the European Union is STEMPORA LABS S.R.L. (CUI 31084168), Str. Costache Negri nr. 62, bl. C2, sc. B, et. 1, ap. 4, 700070 Iași, Romania. You can write to it at that address. For any GDPR matter you can also reach us directly through the contact form; choose "Privacy or GDPR request".

We handle personal data in two different roles, and the rules differ.

• As controller. We decide how to use the data of people who visit our website, sign up, belong to a team, contact support, or pay us. This policy covers that data.
• As processor for our customers. When a business uses Polymorfa to message or call people on WhatsApp, that business decides why and how the data is used. It is the controller (in India, the data fiduciary), and we process the data only on its instructions under our Data Processing Addendum. If a business contacted you through Polymorfa, read that business's privacy notice and send requests to it. If you write to us, we pass your request on.

Data you give us

• Account data. Name, email address, password (stored only as a hash), passkeys, two-factor settings, and your profile picture if you add one. If you sign in with Google, GitHub, GitLab or Bitbucket, we receive your name, email address and account ID from that provider.
• Team data. Team and project names, members and their roles, invitations, and settings.
• Business profile. When a team upgrades to Pay-As-You-Go: business name, website, support email, the kinds of messages you send, expected volume, how recipients opt in, and who confirmed it and when.
• Support data. Messages, attachments and contact details you send to support, by email, in the console, or in a shared support channel.
• Contact-form data. Name, work email, company, subject and your message, plus, if you give them, how many WhatsApp numbers you plan to use and your current technology stack.

Data we create when you use Polymorfa

• API keys and tokens. Their names, scopes, creation and last-use times. We store secrets hashed and cannot show them again.
• Request and audit logs. For requests made with an API key or token, and for audited actions such as creating, changing or deleting a webhook: time, route, result, IP address, user agent, the key or member who made it, and, for failed requests, a redacted excerpt of the response. For other console requests we log only the method, route, result and duration.
• Billing data. Credit balance, purchases, usage charges, and the billing country. Card numbers go directly to Stripe through secure payment fields. We receive masked card details and payment references, never full card numbers.
• Device and security signals. IP address, browser type and sign-in times, used to protect accounts and detect abuse.

Data we process for customers

We handle this data as a processor (section 2). We list it so that everyone can see what the Service touches.

• WhatsApp session data. The keys and encryption state of each connected number, phone numbers and WhatsApp identifiers of contacts, and message, chat and call identifiers.
• Messages in transit. Message content and media pass through our servers on their way to and from WhatsApp and your webhooks. We do not keep a history of the messages you send and receive. Each message event, including its text, waits in a delivery queue for up to 24 hours so your systems can collect it, and is then deleted. Media files that a customer uploads through the API so it can send them later are stored until the customer deletes them.
• Call records. Time, duration, direction, status and quality data of calls. We do not record call audio or video.
• Campaign and consent records. Recipient lists, opt-in records with the consent text shown, and opt-outs.

Data from cookies and similar tools

See section 12.

Swiss law does not require a legal basis for every use, but we apply the stricter rules of the EU GDPR, Brazil's LGPD and India's DPDP Act to everyone. The table shows the basis for each purpose.

Where we rely on consent, you can withdraw it at any time. Doing so does not affect processing before the withdrawal.

We do not sell personal data. We do not share it for cross-context advertising. We do not use message content, or any customer data, to train AI models.

We store Polymorfa's databases and files, including WhatsApp session data, on servers in the European Union: in data centers in Germany, with backups in Finland. This applies to every customer. We run and control these servers from Switzerland.

Brazil. When a number uses our Brazil messaging region, its WhatsApp session data and message processing stay in Brazil, and your account data stays in the EU. We add the Brazilian hosting provider to the subprocessor list with 30 days' notice before it receives data.

Switzerland. Enterprise customers can agree in a signed order form that we store specified data in Switzerland. The Data Processing Addendum then binds us to keep that data there.

We do not move stored data out of the agreed country unless you ask us to, or a law requires it and we tell you first when we are allowed to.

Some traffic and tools cross borders even so. Our network provider terminates encrypted connections at the data center closest to the user before passing traffic on. Email, support tools and optional analytics run in the countries shown on the subprocessor list. Every WhatsApp message also passes through WhatsApp's own servers. Our staff may access data remotely to provide support and keep the Service running; the data stays stored where it is.

• Subprocessors. Hosting, network, email, support and analytics providers that process data for us under written contracts. The subprocessor list names each one, what it does and where.
• Payment providers. Stripe receives your name, verified email, billing address, payment details and transaction information to process payments and billing. Its data-processing role depends on the activity and applicable agreement. Its Privacy Policy and Data Processing Agreement describe those roles. For purchases previously processed by Paddle, its Privacy Policy describes how it handles that payment information.
• WhatsApp and Meta. When a customer sends or receives messages or calls, WhatsApp and Meta process them under their own terms. They are not our subprocessors.
• Sign-in providers. If you choose to sign in with Google, GitHub, GitLab or Bitbucket, that provider learns that you signed in to Polymorfa.
• Google, for browser calls. When you place a call in the browser, your browser asks Google's public connection service (STUN) for its public IP address and port. Google receives them under its own privacy policy.
• Other members of your team. Every member of a team sees the other members' names, email addresses and roles, and can read the team's audit log, which records members' activity. Team API keys with the sessions:read scope can read the member list and the audit log too.
• Authorities and courts. When the law requires it, or to protect people and the Service. We check that each request is lawful, disclose as little as possible, and tell the affected customer unless the law forbids it.
• A buyer or successor. If Polymorfa is sold or merged, data moves to the new owner under this policy, and we tell you first.

Personal data may be stored or accessed in Germany, Finland, Switzerland, the United Kingdom and the United States, and in Brazil for numbers in our Brazil messaging region, as described on the subprocessor list.

• Switzerland and the European Union recognize each other as providing adequate protection, so data moves between our Swiss company and our EU servers without further safeguards. Where Switzerland, the EU or Brazil (as the case may be) recognizes another destination as adequate, the transfer relies on that decision.
• Customer data that customers send to us is covered by the standard contractual clauses in our Data Processing Addendum, including the clauses published by Brazil's ANPD for data subject to the LGPD.
• Transfers to a subprocessor rely on the safeguards in that provider's data processing terms, such as standard contractual clauses or the Swiss-U.S. and EU-U.S. Data Privacy Frameworks.
• Under the DPDP Act, we do not transfer personal data to any country that the Government of India has restricted.

You can ask for a copy of the safeguards for a given transfer at privacy@polymorfa.com. We may remove commercially confidential terms.

We keep specific data longer only when we must, for example because of a legal hold, an open dispute, or an investigation of abuse, and delete it when that ends.

Wherever you live, you can ask us to:

• confirm whether we process your personal data, and give you a copy;
• correct inaccurate or incomplete data;
• delete data, or anonymize or block it, when we no longer need it or process it unlawfully;
• give you data you provided in a structured, machine-readable format, or send it to another provider;
• stop or restrict processing, and object to processing based on legitimate interests;
• withdraw consent at any time;
• tell you who we share your data with;
• have a person review a decision made only by automated means (section 11).

Write to privacy@polymorfa.com or use the contact form. We may ask you to prove your identity. We answer within 30 days, and within 15 days for a full access request under the LGPD. We tell you if we need longer and why. Requests are free unless they are clearly excessive.

Switzerland

You have the rights in articles 25 to 32 of the Federal Act on Data Protection (nFADP). You can complain to the Federal Data Protection and Information Commissioner.

European Economic Area and United Kingdom

You have the rights in articles 15 to 22 of the GDPR (and the UK GDPR). You can complain to the data protection authority where you live or work, or where you think the problem happened.

Brazil

You have the rights in article 18 of the LGPD, including to be told what happens if you refuse consent. You can petition the Autoridade Nacional de Proteção de Dados (ANPD). Our encarregado is the privacy team named in section 1.

India

Under the DPDP Act you can get a summary of your data and of whom we shared it with, have it corrected, completed, updated or erased, nominate someone to act for you if you die or become incapacitated, and raise a grievance. We resolve grievances within 90 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

United States

Residents of US states with privacy laws, including California, can use the rights listed above. We do not sell or share personal data as those laws define it and do not use sensitive personal data to infer characteristics. We will not treat you differently for using your rights.

We encrypt traffic to and from Polymorfa. We store API keys only as hashes and encrypt Meta credentials that customers give us. Staff tools sit behind single sign-on, and staff actions in them are reviewed and logged. Database row-level security keeps each team's data separate. See Security for more.

If a breach puts your personal data at risk, we notify the authorities that the law requires (for example the FDPIC, the ANPD or the Data Protection Board of India) and notify you directly when the law requires it or when you need to act to protect yourself. For customer data, we notify the customer without undue delay, as the DPA describes, so it can meet its own duties.

We use automated checks to reduce spam and the risk of bans. For example, BanSafe can restrict sending from a number when its measured activity matches patterns WhatsApp restricts numbers for. The Safety page shows each restriction and what lifts it. These checks do not decide anything about you beyond use of Polymorfa. If a check affects you, you can explain your side and ask a person to review it by writing to support@polymorfa.com.

We use two categories. Essential storage is always on because the site does not work without it. Analytics stays off until you allow it in the cookie banner, and you can change your choice at any time under Cookie settings in the site footer.

Session replays mask all text and form inputs and do not record request headers or bodies. We never load analytics on sign-in, sign-up or password pages. Our servers do not send product analytics; analytics only runs in your browser, after you consent.

Polymorfa is for businesses. You must be 18 or older to create an account, and we do not knowingly collect data from children. If you think a child has given us data, write to privacy@polymorfa.com and we will delete it.

We update this policy when our processing changes. For material changes, we email account holders at least 30 days before they take effect, and ask for consent again where the law requires it. The date at the top shows the latest version.

Questions, requests and complaints go to the privacy team in section 1: privacy@polymorfa.com, the contact form, or by post to SOFTIUM Sàrl, Rue des Musées 58, 2300 La Chaux-de-Fonds, Switzerland.