Privacy Policy

WhatsApp MCP — Privacy Policy Last Updated: November 11, 2026

---

1. Introduction

Welcome to WhatsApp MCP ("we," "us," or "our"). WhatsApp MCP is a connector that lets the AI assistant of your choice (for example Claude, ChatGPT, Grok Bot, Muse, Cursor, or any other tool that supports the Model Context Protocol, "MCP") read and send messages on your WhatsApp account. It works by linking to your WhatsApp as a "linked device," the same way WhatsApp Web does.

WhatsApp MCP has no app, dashboard, or account page. Setup, billing, and account deletion all happen inside your conversation with your AI assistant.

We deeply respect your privacy. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, and the choices you have. By using WhatsApp MCP, you agree to the practices described in this policy.

---

2. Data We Collect

2.1 Your Connection Token

You can connect in two ways:

• From our website: when you click "Generate my URL," we create a private connection token and store it on our servers. The token is part of your connection URL, so treat it like a password: anyone who has your connection URL can use your WhatsApp through WhatsApp MCP.
• From your AI app's sign-in page (OAuth): when you click "Connect" on our connection page, we create the same kind of token and hand it to your AI app through the standard OAuth sign-in. You never see it; the app keeps it.

Either way, the token is what links your AI assistant to your WhatsApp MCP account. When a token is created we also store your IP address, your browser's user agent, the page you came from, and, if you arrived through one of our ads, the ad's click identifier (see 2.10), and, if the link that brought you to our site named where it came from (for example utm_source=mcpservers.org from a directory listing), that source, medium and campaign. We use your IP address to limit how many tokens can be created, and it is deleted after 8 days.

A token that is never linked to a WhatsApp account is deleted after 7 days.

2.2 Account Information

When you link your WhatsApp, we store:

• Phone Number: Your account is identified by your WhatsApp phone number. This is also how we tie your free trial to you.
• WhatsApp Identifiers: The internal identifiers WhatsApp uses for your account and your contacts (e.g., JIDs and LIDs).
• Subscription State: Whether you are on a trial, the free plan, or subscribed; when your trial started; and your Stripe customer and subscription identifiers.
• Connected Clients: The tokens of the AI tools you have connected, and which server ("node") handles your account.

2.3 WhatsApp Session and Messages

To work, WhatsApp MCP keeps a linked-device session open with WhatsApp. On the server that handles your account, this stores:

• Session Keys: The encryption keys WhatsApp issues to a linked device. These are needed to receive and send messages on your behalf.
• Messages: Text and metadata (sender, chat, time, message type) of the messages you send and receive, including the recent history that WhatsApp syncs to a newly linked device (up to about 90 days). This is what lets your AI assistant search your messages and read your chat history.
• Contacts and Groups: Names and numbers of your WhatsApp contacts, and the groups you belong to, as synced by WhatsApp.

Media (photos, videos, voice notes, documents) is not stored. We only keep the information needed to fetch a file from WhatsApp when your AI assistant asks for it. The file is then passed to your assistant directly or through a private link that expires after 15 minutes.

We do not analyze, profile, or train any AI model on your messages. Messages are only read when your AI assistant calls one of our tools on your behalf, and before each message is sent, to check whether the recipient has written to you (see 2.9).

2.4 Feedback

If you (or your AI assistant on your behalf) submit feedback or a bug report through the report_feedback tool, we store its type, title, description, any context provided, and your phone number, so we can follow up.

2.5 Website Analytics

Our website (wa-mcp.com) uses PostHog to understand how visitors use it: pages viewed, buttons clicked (e.g., which AI tool you selected), and basic device and browser information. PostHog uses cookies to recognize returning visitors. Analytics are only collected on the website, never on your WhatsApp data. The website also loads Google's ad tag and the Meta Pixel to measure our ads (see 2.10).

2.6 Payment Information

Payments are handled by Stripe. We never see or store your card details. Stripe tells us when a payment succeeds or a subscription changes, and we store the resulting subscription state (see 2.2).

2.7 Server Logs

Our servers keep technical logs (e.g., which tool was called, errors, connection events) to keep the service running and fix problems. Logs may contain phone numbers or WhatsApp identifiers, but are not used for any other purpose and are only kept for a limited time.

2.8 Scheduled Messages

When your AI assistant schedules a message, we store it until it is sent: the text, the recipient (name, number and WhatsApp identifiers), the send time, time zone and repeat settings, and for a file, its link or a reference to the received file being forwarded (not the file itself). After a scheduled message is sent, cancelled or fails, we keep its record for 90 days so your assistant can show you what happened.

2.9 Anti-Ban Safeguards

To lower the risk of WhatsApp flagging your number as spam, the Service applies safeguards when you message people who haven't written to you (see the Terms and Conditions, Section 5.2). For this, before each message is sent, including scheduled ones, we check your stored messages to see whether the recipient has written to you. When you start a conversation with someone new, we record their WhatsApp identifier and the time, and delete that record after 2 days.

2.10 Advertising Measurement

We advertise on Google and Meta (Facebook and Instagram) and measure which ads bring people who actually use WhatsApp MCP. For this we record a few setup steps for each connection token: when it was created, when an AI app first connected, when WhatsApp was linked, the first time the service was used for real, and the first payment (with its amount). We send these steps, never your messages or contacts:

• To Meta (Conversions API): the step, its time, your IP address and browser user agent from when the token was created, the page you came from, Meta's cookie identifiers if your browser had them, a one-way hash of your token, and for the linking, first-use and payment steps, a one-way hash of your phone number and its country. Meta uses them to match the step to its users and measure our ads, under Meta's terms.
• To Google Ads: the step and its time, only when you arrived through a Google ad (identified by Google's click identifier).
• On our website: Google's ad tag and the Meta Pixel set their own cookies and report page views and the creation of a token.

Your IP address is removed after 8 days, from both your token and these records. Your user agent is removed from the records after 8 days too, but stays with your token (so a later payment can still be measured) until the token is deleted. The records of setup steps themselves are kept.

2.11 Passkey Linking Extension

WhatsApp asks some accounts to confirm a new linked device with a passkey. For this step we offer an optional Chrome extension, "WA MCP Passkey Linker", used from our passkey linking page. When you press Confirm in the window it opens on web.whatsapp.com, your browser asks for your passkey, and the extension sends WhatsApp's one-time confirmation (a signed answer to WhatsApp's challenge, not your passkey) to our server, which passes it to WhatsApp to finish linking. Your passkey never leaves your device or password manager. The extension only runs on web.whatsapp.com and server.wa-mcp.com, stores nothing, and does not read your chats, contacts, cookies or browsing. We keep a record of the steps of each linking attempt (for example started, confirmed, or the error shown) with your connection token, to fix problems; it contains no message content. We don't sell this data or use it for anything else.

2.12 Voice Note Transcription

When you (through your AI assistant) ask to transcribe a voice note, we download that note's audio from WhatsApp and send it to Google's Gemini API, which turns it into text. Only the notes you ask for are sent, one at a time, and nothing else about you goes with them. We use Gemini's paid service, under which Google does not use the audio to train its models; Google may keep it for up to 55 days to detect abuse, then deletes it. We save the text on the same server as your messages so the same note is never transcribed twice and your assistant can read and search it, together with the note's length, language and what transcribing it cost us. Transcripts are deleted with your messages: after 90 days, or when you delete your account.

---

3. Your AI Assistant

WhatsApp MCP does not run its own AI. When your AI assistant calls one of our tools, the result (for example, a chat's messages or a list of contacts) is sent to that assistant, and is handled by its provider (e.g., Anthropic, OpenAI, xAI, Meta, Cursor) under their privacy policy, not ours. You choose which assistants to connect; please review their policies, including whether they use your conversations for training.

Your assistant can also send WhatsApp messages from your account. Messages are sent when your assistant calls the sending tools, so we recommend reviewing what your assistant plans to send.

---

4. How We Use Your Data

We use your data exclusively to provide and improve the WhatsApp MCP service:

We will NEVER:

• Sell your data to third parties.
• Use your messages or contacts for advertising, or share them with advertisers. (We only report setup steps to Google and Meta to measure our own ads; see 2.10.)
• Share your messages or contacts with other users.
• Read your messages or use your data for any purpose other than delivering the service.

4.1 Our Promise of Integrity

We would be lying if we said we physically cannot access the servers where your data is stored. Because we build and maintain the system, we hold the keys. Your messages need to be stored on our servers for your AI assistant to search and read them.

However, operating with integrity is our core principle. We do not access, read, or snoop on your messages or contacts. We only look at the technical data needed to fix a problem, and only when needed.

---

5. Data Storage and Security

5.1 Where Your Data Lives

5.2 Security Measures

• All traffic to and from WhatsApp MCP is encrypted in transit (TLS).
• Our servers expose no public ports. They are only reachable through Cloudflare, which checks a secret before forwarding any request.
• Every request must carry a valid connection token, and each token can only access its own account.
• Database access is restricted to our servers, and database connections are encrypted with verified certificates.
• Links to media and QR codes are signed and expire after a few minutes.

5.3 Data Retention

• Messages are deleted automatically 90 days after they were sent.
• Scheduled messages are deleted 90 days after they are sent, cancelled or fail.
• New-conversation records (see 2.9) are deleted after 2 days.
• Unlinked tokens (never connected to a WhatsApp account) are deleted after 7 days.
• IP addresses stored for ad measurement (see 2.1 and 2.10) are removed after 8 days, and user agents are removed from the reported setup steps after 8 days.
• Free plan accounts: after your trial ends or your subscription is cancelled, your account stays on the free plan. If it is not used for 30 days (no request from any of your AI tools), your WhatsApp is unlinked and all of your data (account, tokens, session, messages) is deleted.
• Deleted accounts: all of your data is deleted immediately (see Section 7.1).
• Feedback is kept after your account is deleted, to help us improve the service.

---

6. Third-Party Services

WhatsApp MCP relies on the following services. Each has its own privacy policy:

Your AI assistant's provider is not one of our service providers: you choose it and connect it yourself (see Section 3).

We do not share your data with these services beyond what is strictly necessary to deliver the service.

---

7. Your Rights and Choices

7.1 Delete Your Data

Ask your AI assistant to delete your WhatsApp MCP account (it uses the delete_account tool and asks you to confirm). This immediately:

• Cancels your subscription.
• Unlinks WhatsApp MCP from your WhatsApp.
• Deletes your account, all connection tokens, your WhatsApp session, and all stored messages and contacts.

This does not delete your WhatsApp account; your chats stay on your phone. Data already sent to your AI assistant is kept by its provider under their policy.

7.2 Unlink WhatsApp

You can unlink WhatsApp MCP at any time by asking your AI assistant (the unlink_whatsapp tool), or from your phone in WhatsApp under Settings → Linked devices. Unlinking stops new messages from reaching us, but keeps your account and stored messages until you delete your account or it expires (see 5.3).

7.3 Access Your Data

Your AI assistant can show you your stored messages, contacts, and subscription status at any time. You can also request a copy of all the information we hold about you by emailing support@wa-mcp.com. We will send it within a reasonable timeframe.

7.4 Your Contacts' Data

Messages you exchange include information about other people. You are responsible for using WhatsApp MCP in a way that respects their privacy and applicable law.

---

8. Children's Privacy

WhatsApp MCP is not intended for use by individuals under the age of 16. We do not knowingly collect data from children. If we learn that we have collected data from a child under 16, we will promptly delete it.

---

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this document, and for material changes we may also notify you through the tool responses your AI assistant receives.

Your continued use of WhatsApp MCP after any changes constitutes acceptance of the updated policy.

---

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

• Email: support@wa-mcp.com

---

This Privacy Policy applies to all WhatsApp MCP users, including those on free trials, the free plan and active subscriptions.