Privacy Policy
This policy explains what personal data Worus collects, why, who it's shared with, how long it's kept and what rights you have. It applies to the Worus web panel and the assistant that acts on your WhatsApp (the "Service"). The controller is Pablo María Arranz Pou, Spain ("Worus", "we", "us"), reachable at arranzpou10@gmail.com. We follow the EU General Data Protection Regulation (GDPR) and Spanish data protection law.
The short version
- Your phone number identifies your account. We never sell it, share it for marketing, or message you with ads.
- Worus only reads, with AI, the chats and groups you delegate. Everything else that reaches your WhatsApp is ignored and not stored, except the stickers you send yourself.
- Photos and voice notes are fetched only when Worus answers, and aren't kept afterwards. Your own stickers are kept, so Worus can send them too.
- We don't train AI models on your data, and our AI providers don't either.
- No ads, no analytics, no tracking cookies. You can ask us to delete everything at any time.
1. What we collect
| Data | Where it comes from | What for |
|---|---|---|
| Phone number and timezone | You, when you sign up | Identify your account, sign you in, show times correctly. |
| WhatsApp link keys (the encryption keys of the linked device) | Created when you scan the QR code | Keep Worus connected to your WhatsApp without rescanning. Stored encrypted at rest and never shown to anyone. |
| Contact names and ids WhatsApp shares with linked devices (name, phone or anonymous id, group names and members) | Your WhatsApp | Let you say "handle Marta" and have Worus find the right chat, and show names in the panel. |
| Your delegations: which chats, instructions, time windows, limits | You, in the panel | Know what to answer, when, and how. |
| Messages in delegated chats: incoming text, photos, stickers, voice notes (transcribed), the replies Worus sends and their delivery status | Your WhatsApp | Answer on your behalf, keep a short summary of each conversation for context, confirm delivery and alert you if something failed. |
| Group context: the last 50 messages of a group you delegated | Your WhatsApp | Understand the conversation before answering when mentioned. |
| Your stickers: the sticker files you send from your phone (in any chat), the ones saved in your WhatsApp, and those in the recent history WhatsApp shares when you link; with an AI-written description of each and how often you send it. Not who you sent it to. | Your WhatsApp | Let Worus reply with your own stickers where they fit. |
| Knowledge bases: text and images you add | You, in the panel | Give Worus accurate information to answer with. |
| Your chat with Worus in the panel, including voice messages (transcribed), plus a running summary and a search index of it (text and numeric "embeddings") | You | Understand your instructions, show your history, and let Worus remember and look up what you told it earlier. |
| Usage and technical logs: actions Worus took, AI usage counts, error logs, IP address in server logs | The Service | Enforce limits, show you your usage, keep the Service secure and fix problems. |
2. What we don't collect
- Chats you haven't delegated. WhatsApp delivers every message to every linked device, so Worus technically receives them, but it discards them straight away without reading them with AI. We keep only the message id for up to 3 days, so the same message isn't handled twice.
- Photos, stickers and audio files you receive. They stay on WhatsApp's servers. Worus downloads one only at the moment it answers that message, uses it, and doesn't store the file.
- Your WhatsApp password (there is none), your contacts' address book beyond what's described above, your location, payment details, or advertising identifiers.
3. How and why we use it
We only use your data to provide Worus to you. The legal bases are:
- Performing our contract with you (GDPR art. 6.1.b): creating your account, signing you in, linking WhatsApp, answering the chats you delegate, storing your knowledge and history.
- Our legitimate interests (art. 6.1.f): keeping the Service secure, preventing abuse and spam, fixing errors, and understanding aggregate usage to improve it. We balance these against your privacy and keep them to a minimum.
- Legal obligations (art. 6.1.c): responding to lawful requests from authorities.
We don't sell personal data, don't use it for advertising, don't profile you for marketing, and don't make decisions with legal effects about you by automated means.
4. Your contacts' data
When you delegate a chat, Worus processes the messages and details of the people in it. For that data you decide which chats are handled and why, and we process it on your behalf, only to follow your instructions, as a processor under GDPR art. 28. For purely personal or household use, data protection law may not apply to you at all; if you use Worus for work or business, it does, and you're responsible for having a legal basis and for informing your contacts where required.
If you are someone who talks to a Worus user and want to know about or delete your data, contact the Worus user directly, or write to us and we'll help.
5. AI processing
To write replies, understand images, summarise conversations and transcribe voice notes, Worus sends the relevant content (your instructions, the recent messages of that chat, the knowledge you chose, the image or audio being answered, and each new sticker of yours, once, to describe it) to AI model providers through their business APIs. Under their terms, these providers:
- process the content only to return a result to us;
- don't use it to train their models;
- may keep it for a short period (typically up to 30 days) solely to detect abuse, and then delete it.
We don't train or fine-tune any models on your data either.
6. Who we share it with
We share data only with the service providers we need to run Worus, bound by data processing agreements, and only for that purpose:
| Provider | What they do | Location |
|---|---|---|
| Fly.io, Inc. | Runs the Worus servers and the WhatsApp connection | London, United Kingdom |
| Supabase, Inc. | Database and file storage (knowledge images, your stickers) | Ireland, EU |
| Anthropic, PBC | AI models (Claude) that write replies and run the panel assistant | United States |
| Groq, Inc. | Transcription of voice notes | United States |
| OpenAI, L.L.C. | Embeddings of your chat with Worus, so it can search what you told it earlier; backup transcription, only if Groq is unavailable | United States |
| GitHub, Inc. | Hosts our public website (no personal data from the Service) | United States |
WhatsApp (Meta) itself carries your messages, as it always does; its own privacy policy applies to that. We may also disclose data if the law requires it, to protect people's safety, or to a successor if Worus is transferred (you'd be told first).
7. International transfers
Some providers are in the United Kingdom or the United States. Transfers to the UK rely on the European Commission's adequacy decision. Transfers to the US rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Commission's Standard Contractual Clauses, with additional safeguards such as encryption in transit.
8. How long we keep it
- Account, delegations, knowledge, your stickers, conversation summaries, sent-message records and your panel chat (with its summary and search index): while your account exists.
- Messages waiting to be answered: deleted as soon as Worus has answered them.
- Group context: only the latest 50 messages per delegated group; older ones are deleted automatically.
- Ids of incoming messages: 3 days.
- Sign-in codes: stored only as a hash, valid for 10 minutes, and deleted once used.
- WhatsApp link keys: until you unlink Worus or delete your account. Unlinking from your phone makes them useless immediately.
- Server logs: up to 30 days.
When you delete your account, we delete your data within 30 days, except what we must keep by law. Backups roll over and are gone within a further 30 days.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. The database isn't reachable from the public API, sign-in requires proof from your own phone, and access to production is limited to the operator. No system is perfectly secure: if a breach affects your data, we'll tell you and the authorities as the law requires.
An assistant that acts for you carries specific risks: it can make mistakes, and people can write messages designed to manipulate it. Keep an eye on what Worus does, and don't delegate chats where a mistake could seriously hurt you or someone else.
10. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw any consent you've given. Write to arranzpou10@gmail.com from, or mentioning, the number linked to your account; we may ask you to confirm it's you from that phone. We'll answer within one month.
You can also complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country, although we'd appreciate the chance to fix it first.
11. Cookies and local storage
The panel uses no cookies, no analytics and no third-party trackers. It stores one item in your browser's local storage: your session token, which keeps you signed in and is strictly necessary. Signing out removes it.
12. Children
Worus is for adults (18+). We don't knowingly collect data from children. If you believe a child has created an account, contact us and we'll delete it.
13. Changes
If we change this policy, we'll update the date at the top and, for material changes, tell you in the panel before they apply.