Privacy Policy

Last updated: October 14, 2026

This Privacy Policy describes how Yapper, Inc. ("Company", "we", "us", or "our") collects, uses, stores, and protects personal information when you use the Yapper platform, dashboard, and related services (the "Service"). This policy applies to Account Owners, their authorized users, and the end users who interact with the Service through WhatsApp, Instagram, Facebook Messenger, or a website chat widget.

For purposes of applicable data protection law, including the GDPR where applicable, the data controller for personal data described in this Privacy Policy is Yapper, Inc., based in Alameda, California, United States.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 End-User Conversation Data

When your end users message you through a channel connected to Yapper, we process the following on your behalf:

This data is processed solely to provide the Service to you. As the Account Owner, you are the data controller for your end users' personal data, and we act as your data processor.

2. How We Use Your Information

We use the information we collect to:

We do not sell your personal information. We do not use end-user conversation data to train AI models.

3. Legal Basis for Processing

We process personal data based on the following legal grounds:

4. Data Sharing and Disclosure

We may share personal data with the following categories of recipients:

We do not sell or rent personal data to third parties for their marketing purposes.

5. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. When transferring data outside your country of residence, we rely on:

6. Data Retention

We retain personal data as follows:

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 All Users

7.2 European Economic Area (GDPR)

7.3 California Residents (CCPA/CPRA)

We do not sell personal information as defined by the CCPA. We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service.

7.4 Mexico Residents (LFPDPPP)

To exercise your ARCO rights, contact us at privacy@yapper.chat. We will respond within twenty (20) business days as required by Mexican law.

7.5 End Users

If you are an end user who has interacted with a business through a channel powered by Yapper (WhatsApp, Instagram, Messenger, or website chat), please contact the business directly to exercise your data rights. The business is the data controller for your conversation data. If you are unable to reach the business, you may contact us at privacy@yapper.chat and we will assist in directing your request.

We operate two distinct deletion tiers. First, an individual who connected a channel through Meta (Facebook or Instagram) may request deletion of their personal data through Meta at any time. When we receive such a request, we delete the Meta identity records and OAuth credentials associated with that individual and provide a confirmation code for verification. The affected channel disconnects until an Account Owner reconnects it. Business workspace data (conversations and customer records) is retained because it belongs to the business account rather than to the individual, and the business remains its data controller.

Second, permanent deletion of all workspace data is available to Account Owners through account deletion in the dashboard (see the "Account deletion" item under Data Retention above). This erases the entire workspace, including conversation history, customer records, and channel connections.

8. Cookies

The dashboard uses strictly necessary cookies for sign-in and session management. The pages of our website set no cookies and we use no analytics or advertising cookies. For the full list of cookies, their purposes, and how to manage them, please see our Cookie Policy.

9. Security

We implement commercially reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, and regular security reviews.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly notifying affected parties and relevant authorities in the event of a data breach, as required by applicable law.

10. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email or through the dashboard.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

For complaints regarding data processing, you may also contact your local data protection authority, PROFECO (Mexico), or the California Attorney General (California).