What Rapio does with personal data, in plain words. Where a rule comes from how the product actually works, we say so.
Rapio is software that businesses use to send WhatsApp marketing messages to their own customers. That means two different sets of personal data pass through it, and they are not treated the same way.
Your account data. When someone signs up, we hold their name, email address, the workspace they belong to and their role. Rapio is the controller of this data.
Your customers' data. When you upload a customer list, or import one from Shopify, we hold phone numbers and, if your list includes them, first name, last name and email address. We also hold the results of what you sent: delivered, read, and whether someone opted out. You are the controller of this data and Rapio is the processor. We process it to run the service you asked for, and for nothing else. We do not sell it, we do not use it to train anything, and we do not message your customers on our own behalf.
When a workspace is deleted. Deletion takes effect seven days after you ask for it, and you can reverse it until then. On that day its contacts, lists, templates, campaigns, message content, reports and change history are removed from our live systems. Backups that hold them are deleted 30 days after they are made. Billing records, plan-rule confirmations and the free-message record stay, as described above. Meta's copy of message content is separate: Meta keeps it for at most thirty days, and our deletion does not change that. Your WhatsApp Business Account is yours and is not deleted; we only disconnect from it.
Meta. The messages go through the WhatsApp Cloud API, so Meta processes them. Meta keeps message content for at most thirty days and deletes user identifiers thirty days after the final delivery status. That retention is Meta's, not ours, and we cannot change it.
Your WhatsApp Business Account carries a setting that sends read, reply and delivery signals to Meta so it can optimize marketing message delivery. It is on by default on Meta's side, it belongs to your account rather than to Rapio, and if you leave it on you need to say so in your own privacy notice and consent text. We show its state; we do not change it for you.
Infrastructure providers. Hosting, database and email delivery are run by third parties acting as sub-processors under contract. They process data on our instructions and cannot use it for their own purposes. Details sent through the forms on this website are delivered to our email and to a spreadsheet, both on Google Workspace.
Stripe, our payment provider. When you add a card or start a plan, the card details go to Stripe, which holds them. We never see or store the full card number; we see only what Billing shows you: the name on the card, the brand, the last four digits and the expiry date. Stripe also receives your company name and the email address of the admin who started the plan. Invoices and payment emails, such as the notice that a renewal could not be charged, are sent through Stripe.
Google Analytics. Google processes information about visits to this website on our behalf. Section 4 explains what is collected.
Google, if you connect Google Sheets. Rapio asks Google for your Google account's email address and for access to the Google Drive files you pick or that Rapio creates for you. Rapio cannot see any other file in your Drive. We keep the email address and an encrypted authorization token so the connection keeps working, and we keep them only while the connection exists. We use this data only to run the Google Sheets features you see in Rapio. We do not sell it, use it for advertising, or use it to train AI or machine learning models, and nobody at Rapio reads it unless you ask us to for support, it is needed for security, or the law requires it. Disconnecting Google Sheets in Integrations deletes the token and, unless the same Google account is still connected in another workspace, withdraws Rapio's access at Google; you can also remove Rapio from your Google Account settings at any time.
Google, if you connect Google Analytics. Rapio asks Google for your Google account's email address and for read-only access to your Google Analytics data. Today Rapio uses it to list the Analytics properties your account can see so you can pick one; Rapio cannot change anything in your Analytics. We keep the email address, the property you picked and an encrypted authorization token so the connection keeps working, and we keep them only while the connection exists. We use this data only to run the Google Analytics features you see in Rapio. We do not sell it, use it for advertising, or use it to train AI or machine learning models, and nobody at Rapio reads it unless you ask us to for support, it is needed for security, or the law requires it. Disconnecting Google Analytics in Integrations deletes the token and, unless the same Google account is still connected in another workspace, withdraws Rapio's access at Google; you can also remove Rapio from your Google Account settings at any time.
Rapio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Shopify, if you connect your store. When you connect your Shopify store and import a customer segment, Rapio reads the first name, last name, email address and phone number of the customers in that segment, and whether Shopify shows each of them as subscribed to WhatsApp marketing. Rapio only reads: it writes nothing back to your store, and it does not ask for order, address or payment data. We use this data only to add those customers to your Rapio account as a contact list, so you can send WhatsApp marketing messages to people who agreed to hear from you. The WhatsApp subscription state is shown to you for information only; making sure you have each person's consent is your responsibility. As with a list you upload, you are the controller of this data and Rapio is the processor.
The imported contacts are kept in your Rapio account. The access token for your store is stored encrypted, and access to contact data in Rapio is logged. We do not sell this data, use it for advertising, or use it to train AI models, and we share it with no one beyond the providers listed in this section that Rapio needs to run.
If you disconnect Shopify in Integrations or remove Rapio from your store, we delete the connection data, meaning the access tokens and your store's details, within 48 hours. Contact lists you already imported stay in your Rapio account as your own data, like a list you uploaded, until you delete your workspace. When Shopify forwards a request to erase one of your customers' data, we delete what came from your store about that customer from your imports. Questions about Shopify data go to privacy@getrapio.com.
That is the whole list. There is no advertising network and no data broker.
Waitlist and contact forms. When you send one of the forms, your details come straight to Rapio: they arrive as an email and as a row in a spreadsheet, both on Google Workspace. They are your name, your email address and, if you gave them, your phone number, company, company size and job title, together with the boxes you ticked and the time you sent them. We use it only to contact you about Rapio, because you agreed to that on the form. We message you on WhatsApp only if you ticked that box, and you can stop those messages at any time by telling us so. We delete these details after 24 months, or sooner if you ask us to.
Booking a call. If you book a call through the link on our About page, the booking runs on Google Calendar: the form asks for your name and email address, and Google sends us the booking with the time you chose. We use these details only for that call, and delete them after 24 months, or sooner if you ask us to.
The product itself, behind the login, uses a session cookie so that you stay signed in. It is required for the service to work and is not used for tracking.
Someone can ask you to erase what you hold about them. The product has a form for it, under workspace settings, and we complete such requests within thirty days.
The deletion is real: the contact record, the message history, the rows in campaign reports and imports, and the person's opt-out record all go. Campaign totals are recalculated afterwards, so past reports will show smaller numbers. The raw delivery records Meta sent us are not edited one by one; they are deleted automatically after 90 days.
One thing to understand before you use it. Erasing a person is not the same as adding them to the opt-out list. An erased person is no longer on your opt-out list either, which means that if you upload them again they can be messaged again. If the request was "stop messaging me", the opt-out list is the right tool; if it was "delete what you have about me", this one is.
Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, and to object to how it is processed.
If you are one of our customers, write to privacy@getrapio.com. If you received a WhatsApp message from a business using Rapio and want your data removed, contact that business directly: they hold the list, we only process it for them. If you cannot reach them, write to us and we will pass the request on.
Rapio's own infrastructure is operated in the European Union. Meta processes WhatsApp messages on its own infrastructure, and its supported storage regions do not include Turkey; where a data location is chosen for a WhatsApp Business Account, Germany is the closest option.
Access tokens are stored encrypted. Access to production data is limited to the people who need it to run the service. Every webhook we receive from Meta is verified with a signature before it is processed.
Rapio is business software and is not directed at children. We do not knowingly collect data from anyone under sixteen.
If this policy changes in a way that affects you, we will tell you by email before the change takes effect. The date at the top of this page always reflects the current version.
RAPIO, LLC
131 Continental Dr, Suite 305
Newark, DE 19713, United States
privacy@getrapio.com