Data processing agreement

Do you need this? Not if the account is your own and you use it privately — that is the household exemption in Article 2(2)(c) GDPR, and no agreement is required. You need it the moment the account serves a business: a company number, a sole trader's work phone, a client-facing line. If in doubt, accept it; it costs nothing and binds us, not you.

1. Parties and subject matter

Controller is you, the person or company linking the account. Processor is Finn Jung, Rotlintstraße 79, 60389 Frankfurt am Main, Germany. The subject matter is the hosted synchronisation, storage and retrieval of the WhatsApp message history of the account you link, so that MCP clients you authorise can read and — if you enable it — send messages.

This agreement supplements the Terms. Where they conflict on data protection, this document wins.

2. Duration

It starts when you accept it and runs as long as an account of yours is linked. It ends when the last account is unlinked and the deletion in section 8 is complete.

3. Nature and purpose, categories of data and data subjects

Nature and purpose: storing a copy of an existing WhatsApp history and answering read queries against it; optionally sending messages on your instruction.
Categories of personal data: message content, sender and recipient identifiers, phone numbers, display names, group and chat names, timestamps, media metadata, and media files when a tool downloads one. Special categories under Article 9 may occur incidentally, because we cannot control what people write to you.
Categories of data subjects: you, and every person who has communicated with the linked account.

4. Instructions

We process personal data only on your documented instructions. Your instructions are: this agreement, the Terms, the settings on your account, and the tool calls your MCP client makes. We do not process your data for any purpose of our own — no analysis, no profiling, no model training, no product statistics derived from content.

If we believe an instruction breaks data protection law, we will tell you and may suspend that instruction until it is resolved.

5. Confidentiality

Everyone with access is bound to confidentiality. At the time of writing that is one person: the operator named in the Imprint. If that changes, this section changes with it, and it is a material change under section 12.

6. Security of processing (Article 32)

The honest description, not a wish list:

Separation: one directory and one database per account. No shared message table, no cross-account queries, no join that could reach another customer's data.
Access control: a bearer token or OAuth grant per account; the service port is bound to loopback and never exposed; the host is reachable only over SSH with a key, password login disabled, and a cloud firewall that drops everything else.
Transport: TLS to the site and to the MCP endpoint; the connection to WhatsApp is the protocol's own encryption.
Encryption at rest: in progress. Today the per-account store is not encrypted on disk and is protected by access control alone. We state this rather than imply otherwise; this section is updated when it ships, and that update is announced.
Operator access: possible and unavoidable. A service that searches your messages must read them. Access happens for a fault you reported or a legal obligation under section 10, and for nothing else.
Logging: that a request happened, which account and which tool — never content, never tool results.
Availability: one server, no redundancy, no uptime guarantee. Plan accordingly; this is not a system of record.

7. Sub-processors

You give general written authorisation for the sub-processors below. We tell you before adding or replacing one, with at least 30 days to object; if you object on reasonable data protection grounds and we cannot accommodate it, you may terminate and have your data deleted.

Hetzner Online GmbH, Gunzenhausen, Germany — hosting. Data stays in Nuremberg, Germany.
Cloudflare, Inc., USA — DNS and the tunnel publishing the site; sees connection metadata, not stored message content. Covered by Cloudflare's data processing addendum and EU standard contractual clauses.
1337 Services GmbH (Njalla), Nevis/Germany — the domain and inbound mail forwarding for the addresses on this site.

Note what is not here: no analytics provider, no error tracker, no AI provider. When your client sends a tool result to a model, that is your client's transfer under your own controller relationship, not ours — see the Privacy page.

8. Deletion and return

Unlink an account, or write to [email protected], and the store and the account record are deleted within 30 days, backups included. Deletion is the default; we do not keep a copy unless law requires it, and no law we are aware of requires keeping message content.

You can export at any time through the read tools, which is the practical form of return — the data was always addressable by you.

Deletion also happens without being asked. On the Free plan a chat with no activity for 30 days is pruned, and an account with no request for 14 days is deleted entirely. That is storage limitation under Article 5(1)(e) doing its job, not a punishment for light use — and it is why the free tier can exist at all.

9. Your rights as controller, our duties as processor

We assist you with requests from data subjects, and with impact assessments and prior consultations, as far as the nature of the processing allows.
We notify you without undue delay, and in any case within 48 hours, of a personal data breach affecting your data, with what we know and what we are doing.
We give you the information needed to demonstrate compliance. You may audit — in practice by asking questions in writing, which we answer, and by reading the source, which is public. An on-site audit is available on reasonable notice at your cost.

10. Disclosure to authorities

We disclose only when legally compelled by a competent authority, and we tell you first unless the law forbids it. We have never received such a request.

11. The other side of the conversation

A practical warning rather than a clause. The people who wrote to you never agreed to any of this, and for them you are the controller. Whether you may keep and process that history — and whether you owe them information under Article 13 or 14 — is your call to make, not ours. We can only make sure the handling on our side is clean.

12. Changes

Material changes are announced to the contact address on your account at least 30 days before they take effect. The version and date at the top identify the text you accepted; superseded versions are available on request.

13. Accepting it

Accept it when linking an account, or by writing to [email protected] from the address on your account. Article 28(9) requires written form, and electronic form counts — no signature, no PDF and no scanner are needed. If your organisation nevertheless needs a signed copy for its files, ask and you get one.