Privacy & Data Handling
BotWave is built so that the least possible amount of your messaging data is stored. This page lays out exactly what we store, what we don't, and how to exercise your rights.
What We Store
| Data | Stored? | Why |
|---|---|---|
| Account email | Yes | Login + billing |
| Hashed password | Yes (bcrypt) | Auth |
| Session auth state (WhatsApp) | Yes (encrypted at rest) | So your bot reconnects automatically |
| Session auth state (Telegram bot tokens) | Yes (encrypted at rest) | Same as above |
| Command execution logs | 30 days | Debugging, abuse review |
| Message content | Not stored long-term. Only buffered for the seconds needed to process the command. | We don't want it. |
| Group member lists | Cached briefly for command targeting; not persisted | Performance |
| Analytics counters | Aggregated (message counts per day, command counts) — no message contents | Dashboard |
What We Don’t Store
- The text of messages you send through the bot, except where temporarily required by a queued or in-flight command.
- Your contacts.
- Media (images, audio, video) outside the in-memory buffer required to forward or reply.
Encryption
- In transit: TLS 1.3 everywhere.
- At rest: AES-256 for auth state, bcrypt for passwords.
- WhatsApp session keys are sealed with a per-account derived key, so even a partial DB leak does not expose enough material to take over a session.
Your Rights
You can:
- Export your account data — Settings → Account → Export
- Delete your account and all associated data — Settings → Account → Delete (purges within 14 days; backups within 30)
- Pause all sessions — Sessions → Pause All
Third Parties
- Supabase (database + auth) — EU region
- Render (web + bot containers)
- Resend (transactional email)
- AI providers (only when you explicitly enable AI commands; the AI request body contains the message text the user typed and your system prompt only)
We do not sell or share your data with advertisers, brokers, or third-party analytics services.
Reporting Abuse / Subpoena Contact
For abuse reports, send to abuse@botwave.online. We respond within 24 hours.
For lawful requests, see our Terms of Service for the legal contact.