--- title: "Rapio Privacy Policy" description: "How Rapio handles personal data: what we store and for how long, who else sees it, where it sits, your rights, and how to have it deleted." url: https://getrapio.com/privacy/ updated: 2026-10-15 --- # Privacy Policy What Rapio does with personal data, in plain words. Where a rule comes from how the product actually works, we say so. Last updated 15 October 2026 Rapio is software that businesses use to send WhatsApp marketing messages to their own customers. That means two different sets of personal data pass through it, and they are not treated the same way. ## 1. Two roles, two sets of data **Your account data.** When someone signs up, we hold their name, email address, the workspace they belong to and their role. Rapio is the controller of this data. **Your customers' data.** When you upload a customer list, or import one from Shopify, we hold phone numbers and, if your list includes them, first name, last name and email address. We also hold the results of what you sent: delivered, read, and whether someone opted out. **You are the controller of this data and Rapio is the processor.** We process it to run the service you asked for, and for nothing else. We do not sell it, we do not use it to train anything, and we do not message your customers on our own behalf. ## 2. What we store, and for how long - **Contacts and lists** — kept while your workspace exists. Deleting an import archives it; deleting the workspace removes the contacts behind it. - **Delivery statistics** (sent, delivered, read, cost) — **kept indefinitely** while the workspace exists, and deleted with it. This is deliberate: Meta's own reporting windows are short, template analytics reach back ninety days and read and click counts reset after seven. If we did not keep the history, your campaign reports would empty out after a few months. - **Change history** — every meaningful change in the workspace is recorded and kept for **two years**, or until the workspace is deleted if that comes first. - **Test messages** — the number a test was sent to, the template and its delivery status are **kept while the workspace exists**, so your team can see what was tested and how it arrived. - **Message content** — kept while your workspace exists, and deleted with it. - **Waitlist and contact form details** — kept for **24 months** from the day you send them, or until you ask us to delete them, whichever comes first. - **Opt-out list** — kept for as long as the workspace exists. This one is on purpose: if we deleted it, someone who asked not to be messaged could be messaged again. - **Billing records and plan-rule confirmations** — kept for as long as the law requires us to keep billing records, even after a workspace is deleted. When you start or change a paid plan, you confirm the plan rules with a checkbox, and we record who confirmed, for which workspace, the date and time, **the IP address**, the amount shown and the version of the rules. - **Free-message record** — the phone numbers and the Meta Business account of a workspace that has used its 100 free messages. Kept even after a workspace is deleted, so the free messages are given only once. - **Raw delivery records** — the delivery updates Meta sends us, kept exactly as received so their signature can be checked. They are deleted automatically after **90 days**. **When a workspace is deleted.** Deletion takes effect seven days after you ask for it, and you can reverse it until then. On that day its contacts, lists, templates, campaigns, message content, reports and change history are removed from our live systems. Backups that hold them are deleted 30 days after they are made. Billing records, plan-rule confirmations and the free-message record stay, as described above. Meta's copy of message content is separate: Meta keeps it for at most thirty days, and our deletion does not change that. Your WhatsApp Business Account is yours and is not deleted; we only disconnect from it. ## 3. Who else sees it **Meta.** The messages go through the WhatsApp Cloud API, so Meta processes them. Meta keeps message content for **at most thirty days** and deletes user identifiers thirty days after the final delivery status. That retention is Meta's, not ours, and we cannot change it. Your WhatsApp Business Account carries a setting that sends read, reply and delivery signals to Meta so it can optimize marketing message delivery. It is **on by default on Meta's side**, it belongs to your account rather than to Rapio, and if you leave it on you need to say so in your own privacy notice and consent text. We show its state; we do not change it for you. **Infrastructure providers.** Hosting, database and email delivery are run by third parties acting as sub-processors under contract. They process data on our instructions and cannot use it for their own purposes. Details sent through the forms on this website are delivered to our email and to a spreadsheet, both on Google Workspace. **Stripe, our payment provider.** When you add a card or start a plan, the card details go to Stripe, which holds them. We never see or store the full card number; we see only what Billing shows you: the name on the card, the brand, the last four digits and the expiry date. Stripe also receives your company name and the email address of the admin who started the plan. Invoices and payment emails, such as the notice that a renewal could not be charged, are sent through Stripe. **Google Analytics.** Google processes information about visits to this website on our behalf. Section 4 explains what is collected. **Google, if you connect Google Sheets.** Rapio asks Google for your Google account's email address and for access to the Google Drive files you pick or that Rapio creates for you. Rapio cannot see any other file in your Drive. We keep the email address and an encrypted authorization token so the connection keeps working, and we keep them only while the connection exists. We use this data only to run the Google Sheets features you see in Rapio. We do not sell it, use it for advertising, or use it to train AI or machine learning models, and nobody at Rapio reads it unless you ask us to for support, it is needed for security, or the law requires it. Disconnecting Google Sheets in Integrations deletes the token and, unless the same Google account is still connected in another workspace, withdraws Rapio's access at Google; you can also remove Rapio from your Google Account settings at any time. **Google, if you connect Google Analytics.** Rapio asks Google for your Google account's email address and for read-only access to your Google Analytics data. Today Rapio uses it to list the Analytics properties your account can see so you can pick one; Rapio cannot change anything in your Analytics. We keep the email address, the property you picked and an encrypted authorization token so the connection keeps working, and we keep them only while the connection exists. We use this data only to run the Google Analytics features you see in Rapio. We do not sell it, use it for advertising, or use it to train AI or machine learning models, and nobody at Rapio reads it unless you ask us to for support, it is needed for security, or the law requires it. Disconnecting Google Analytics in Integrations deletes the token and, unless the same Google account is still connected in another workspace, withdraws Rapio's access at Google; you can also remove Rapio from your Google Account settings at any time. Rapio's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. **Shopify, if you connect your store.** When you connect your Shopify store and import a customer segment, Rapio reads the first name, last name, email address and phone number of the customers in that segment, and whether Shopify shows each of them as subscribed to WhatsApp marketing. Rapio only reads: it writes nothing back to your store, and it does not ask for order, address or payment data. We use this data only to add those customers to your Rapio account as a contact list, so you can send WhatsApp marketing messages to people who agreed to hear from you. The WhatsApp subscription state is shown to you for information only; making sure you have each person's consent is your responsibility. As with a list you upload, you are the controller of this data and Rapio is the processor. The imported contacts are kept in your Rapio account. The access token for your store is stored encrypted, and access to contact data in Rapio is logged. We do not sell this data, use it for advertising, or use it to train AI models, and we share it with no one beyond the providers listed in this section that Rapio needs to run. If you disconnect Shopify in Integrations or remove Rapio from your store, we delete the connection data, meaning the access tokens and your store's details, within 48 hours. Contact lists you already imported stay in your Rapio account as your own data, like a list you uploaded, until you delete your workspace. When Shopify forwards a request to erase one of your customers' data, we delete what came from your store about that customer from your imports. Questions about Shopify data go to [privacy@getrapio.com](mailto:privacy@getrapio.com). That is the whole list. There is no advertising network and no data broker. ## 4. This website **Analytics and cookies.** This site uses Google Analytics to see which pages are useful. It is on unless you turn it off: choose **Cookie Preferences** at the bottom of any page. While it is on, it sets cookies whose names begin with `_ga`, and records which pages you view, how you arrived, your device and browser, and your approximate location. Google Analytics does not store your IP address. If you turn it off, it stops on this site and we remove its `_ga` cookies. Your choice is kept in your browser under the name `rapio-analytics`, so the site remembers it; it is not sent to us. There are no advertising pixels and no session recording. You can also block these cookies in your browser settings. **Waitlist and contact forms.** When you send one of the forms, your details come straight to Rapio: they arrive as an email and as a row in a spreadsheet, both on Google Workspace. They are your name, your email address and, if you gave them, your phone number, company, company size and job title, together with the boxes you ticked and the time you sent them. We use it only to contact you about Rapio, because you agreed to that on the form. We message you on WhatsApp only if you ticked that box, and you can stop those messages at any time by telling us so. We delete these details after 24 months, or sooner if you ask us to. **Booking a call.** If you book a call through the link on our About page, the booking runs on Google Calendar: the form asks for your name and email address, and Google sends us the booking with the time you chose. We use these details only for that call, and delete them after 24 months, or sooner if you ask us to. The product itself, behind the login, uses a session cookie so that you stay signed in. It is required for the service to work and is not used for tracking. ## 5. Deleting a person's data Someone can ask you to erase what you hold about them. The product has a form for it, under workspace settings, and **we complete such requests within thirty days**. The deletion is real: the contact record, the message history, the rows in campaign reports and imports, and the person's opt-out record all go. Campaign totals are recalculated afterwards, so past reports will show smaller numbers. The raw delivery records Meta sent us are not edited one by one; they are deleted automatically after 90 days. **One thing to understand before you use it.** Erasing a person is not the same as adding them to the opt-out list. An erased person is no longer on your opt-out list either, which means that if you upload them again they can be messaged again. If the request was "stop messaging me", the opt-out list is the right tool; if it was "delete what you have about me", this one is. ## 6. Your rights Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, and to object to how it is processed. If you are one of our customers, write to [privacy@getrapio.com](mailto:privacy@getrapio.com). If you received a WhatsApp message from a business using Rapio and want your data removed, contact that business directly: they hold the list, we only process it for them. If you cannot reach them, write to us and we will pass the request on. ## 7. Where the data sits Rapio's own infrastructure is operated in the European Union. Meta processes WhatsApp messages on its own infrastructure, and its supported storage regions do not include Turkey; where a data location is chosen for a WhatsApp Business Account, Germany is the closest option. ## 8. Security Access tokens are stored encrypted. Access to production data is limited to the people who need it to run the service. Every webhook we receive from Meta is verified with a signature before it is processed. ## 9. Children Rapio is business software and is not directed at children. We do not knowingly collect data from anyone under sixteen. ## 10. Changes If this policy changes in a way that affects you, we will tell you by email before the change takes effect. The date at the top of this page always reflects the current version. ## 11. Who to contact RAPIO, LLC 131 Continental Dr, Suite 305 Newark, DE 19713, United States [privacy@getrapio.com](mailto:privacy@getrapio.com)