Privacy Policy

This policy explains what data Engator collects when you use the Engator Android app and the web dashboard at app.engator.io, what we do with it, who else handles it, and how to have it deleted. It also covers the data of the customers you talk to through Engator.

Effective 13 October 2026

1. Who we are

Engator is an AI sales assistant for people who sell on WhatsApp. It is available as an Android app (package io.engator.app), a web dashboard at app.engator.io, and this website. In this policy, "Engator", "we" and "us" mean the operator of the Engator service. "You" means the seller who holds an Engator account.

For anything about privacy, email support@engator.io.

2. What we collect

We collect only what the service needs to work. This is everything we collect, grouped by where it comes from.

Your account

• When you sign up: your name, email address and password. We store a hashed password, never the password itself.
• When you set up your business: the industry you work in, the kinds of products you sell, and optionally your business name. The AI uses your business name when it introduces you.
• When you connect WhatsApp: the phone number of the WhatsApp account you link.
• Settings: your AI mode, quiet hours and time zone, sending limits, and similar preferences.
• Verification codes: one-time codes we email you to confirm your address or reset your password. They are kept for 10 to 15 minutes.

Your WhatsApp conversations

Once you link your WhatsApp number, Engator receives the one-to-one chats on that number so it can reply for you. Group chats, Status updates and broadcast lists are ignored, and we don't import your older chat history.

• Messages: the text of messages you and your customers exchange, and the captions on images and documents. We store message status: sent, delivered or read. We don't download or store the images, videos or documents themselves.
• Voice notes: incoming voice notes are sent to an AI provider to be turned into text. We keep the transcript, not the audio. A voice note may be transcribed before Engator decides whether the chat is a sales lead. If the chat isn't a lead, the transcript is thrown away.
• Leads: the phone number of each customer Engator talks to, and any details you or the AI record about them: name, company, city, tags, notes, score and status.
• Saved contact names: when you link WhatsApp, we receive the names you've saved for your contacts, along with their numbers. We use them to tell your existing contacts apart from new enquiries, so the AI doesn't treat your friends and family as leads.
• Messages from unknown numbers: if you turn on replies to new enquiries, the text of a message from an unsaved number is checked by the AI to decide whether it is a sales enquiry.

Content you add

• Product information: product names, descriptions, prices, notes, and the photos and videos you upload. Product media is stored on our server and can be viewed by anyone who has its link, because Engator sends it to your customers inside WhatsApp messages.
• Brochures: a brochure (PDF or image) you upload so the AI can fill in a product. It is processed and then discarded, not stored.
• Lead photos: a photo of a written or printed list of contacts. The AI reads the names and numbers from it. The photo isn't stored. Only the contacts you confirm are saved as leads.
• Imported lists: a CSV file of leads. We read it, import the rows and discard the file.
• Contacts from your phone: the app can open your phone's contacts in two places: to choose who gets a scheduled message, or to add people to your "never treat as a lead" list. Only the contacts you pick are sent to us. We don't upload your address book from the app.
• Campaigns, scheduled messages, reminders and notes: what you write and when you want it sent.
• Your feedback on AI replies: whether you approved or edited a draft. We keep a few of your past replies as style examples, so the AI learns how you write.

Your device

• Push notifications: the app registers a push token issued by Expo, along with your platform (Android) and the app version. We use these only to send you notifications.
• We don't collect your location, advertising ID or contact list in the background, and we don't use any analytics or crash-reporting SDK.

Payments

• Subscriptions are paid on our website through Stripe. Card details are entered in Stripe's own form and go straight to Stripe. We never see or store your full card number.
• From Stripe we keep your Stripe customer ID, the card brand and last four digits, your plan, your trial and renewal dates, and a record of each payment: amount, status and invoice link.
• When we create your Stripe customer record, we give Stripe your name, email and phone number.

Usage and logs

• In-app activity: counts and events that power your own dashboard. For example, how many chats Engator opened, replies sent, hot leads, opt-outs and AI usage against your plan's limits. We don't send this to any third-party analytics service.
• Server logs: our servers keep technical logs for running and fixing the service. These can include a customer's phone number, short message excerpts, verification codes and error details.
• Website: engator.io uses no analytics, ad pixels or tracking cookies. It remembers your light or dark theme choice in your browser only.

3. How we use it

• To provide the service: receiving your WhatsApp messages, showing your inbox, leads, campaigns and reminders, and keeping your accounts in sync across devices.
• To generate AI replies: drafting or sending answers based on the conversation and your product information. The AI also scores leads, spots hot leads and opt-out requests, summarises chats, finds reminders in messages, transcribes voice notes and reads lead photos and brochures.
• To send messages for you: sending the replies, campaigns and scheduled messages you set up from your own WhatsApp number, within the pacing and sending hours you choose.
• Notifications: alerting you to hot leads, hand-offs, drafts to approve and due reminders. A notification can include the customer's name or number and a short preview of the message.
• Billing: running your trial and subscription and applying plan limits.
• Support: answering your questions and fixing problems you report.
• Security: verifying your email, protecting your account, preventing abuse, and checking that WhatsApp connections are healthy.

We don't sell your data or your customers' data. We don't use it for advertising, and we don't use your conversations to train AI models of our own.

4. AI processing

To write a reply, Engator sends an AI provider your business and product information, a few of your past replies as style examples, and the recent conversation history with that customer. That includes the customer's name and phone number. Lead photos, brochures and voice notes are sent to an AI provider for reading or transcription. We send each request through the provider's API and use the result in your account.

Google's Gemini API is our default provider for text, images and voice notes. If Gemini is unavailable, or for particular tasks, we may route requests to one of the backup providers listed in the next section. We tell OpenRouter not to let its model providers collect your data.

AI output can be wrong. In Co-pilot mode you approve each draft before it is sent. In Autonomous mode the AI sends replies on its own. Either way, you remain responsible for what is sent from your number (see our Terms).

5. Service providers

These companies process data for us so we can run Engator. They receive only what they need for their task.

If you connect your number through Meta's WhatsApp Business Platform (Cloud API) in the dashboard, your messages travel through Meta under your own Meta business account, and Meta's terms apply to that account.

We may also disclose data if the law requires it, or to protect our users, ourselves or others from harm or fraud.

6. How we connect to WhatsApp

Engator works with your own WhatsApp number. You link it the same way you link WhatsApp Web: by entering a pairing code or scanning a QR code. Engator then appears as a linked device on your WhatsApp account. You can unlink it any time from WhatsApp (Settings → Linked devices) or from Engator.

While your number is linked, our servers keep the WhatsApp session keys needed to stay connected. When you disconnect or close your account, we log the linked device out and delete those keys.

Engator is an independent product. It is not affiliated with, endorsed by or sponsored by WhatsApp or Meta. WhatsApp's own terms and policies still apply to your WhatsApp account.

7. Your customers' data

When you use Engator, you decide whom to message and what for, so the data of the people you talk to belongs to you. We process it on your behalf to provide the service.

• You need a lawful basis to contact people. That might be their consent or an existing business relationship. You must follow the privacy and marketing laws that apply to you and to them.
• Opt-outs are honoured automatically. If a customer replies STOP, UNSUBSCRIBE or a similar word (in English or Arabic), or the AI sees that they've asked not to be contacted, Engator stops the AI in that chat. It also adds their number to your do-not-contact list. Campaigns and scheduled messages skip numbers on that list. You can also add numbers to the list yourself.
• If one of your customers asks us about their data, we will pass the request to you and help you respond to it.

8. Retention and deletion

While your account is open

We keep your account data, conversations, leads and products for as long as your account is open, so the service keeps working. If you delete a lead, its conversation and messages are permanently deleted. The activity log behind your analytics is automatically deleted after about 400 days. We don't yet have a fixed deletion period for server logs or for the records of failed background tasks.

When you close your account

You can close your account in the app (Settings → Delete account). Closing it does the following straight away:

• Cancels any active subscription immediately.
• Logs Engator out of every linked WhatsApp number and deletes the session keys.
• Signs out all your devices.
• Deactivates your account and any extra numbers in it, so no one can log in and nothing more is sent.

We keep records of payments and invoices for as long as tax and accounting law requires, even after erasure. Stripe also keeps its own copies under its own policies. Full details and steps are on our account deletion page.

9. Security

• All traffic between the app, the dashboard and our servers is encrypted with HTTPS (TLS).
• Passwords are stored only as salted hashes. API keys for connected WhatsApp Business Platform accounts are encrypted in our database.
• Our servers are reached only through the HTTPS entry point, and the database is not exposed to the internet.
• Each account can only see its own data, and app sign-ins use per-device tokens that are revoked when you sign out or close your account.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

10. International transfers

Our servers are in Germany. Our service providers may process data in other countries, including the United States and, for DeepSeek, China. So your data, and your customers' data, may be processed outside the country where you or they live. We use only the providers listed above, and only to provide the service.

11. Your rights

You can see and change most of your data in the app and dashboard yourself: profile, products, leads, conversations and settings. You can also email support@engator.io to:

• get a copy of the data we hold about you,
• correct something you can't change yourself,
• have your account and data erased,
• object to or ask us to limit some processing.

We'll answer within 30 days, and we may ask you to confirm the request from your account email. Depending on where you live, you may also have the right to complain to your local data protection authority.

12. Children

Engator is a business tool for adults. It is not intended for anyone under 18, and we don't knowingly collect data from children. If you believe a child has created an account, contact us and we will close it.

13. Changes to this policy

We may update this policy when the service or the law changes. We'll change the effective date above. If the change is significant, we'll also tell you by email or in the app before it takes effect.

14. Contact

Questions, requests or complaints: support@engator.io.