Privacy Policy

1. Controller and contact

Messenger to WordPress is operated by spread emotions GmbH.

Schumanngasse 36, 1180 Wien

Privacy enquiries may be sent to office@spreademotions.com.

2. Purpose of the service

Messenger to WordPress receives private text messages through the WhatsApp Cloud API or Telegram Bot API, assigns them to an authorized contact and connected WordPress site, and forwards them for creation of a WordPress draft.

The operator of the connected WordPress installation is generally responsible for the content and its further processing. Where we process data on behalf of a customer, the additional data protection terms agreed with that customer apply.

3. Data we process

Depending on how the service is used, we process in particular:

• account data such as name, email address, roles, language, and workspace assignments,
• session and security data such as session ID, IP address, browser identifier, timestamps, and technical logs,
• connected WordPress site data such as name, endpoint URL, configuration, and authorization data,
• messaging data such as provider, sender ID, display name, preferred language, message text, message ID, timestamp, and diagnostic webhook data,
• delivery and diagnostic data such as routing status, delivery attempts, HTTP status, and errors,
• invitation and security evidence used to connect contacts and WordPress sites securely, and
• billing data such as customer identifier, email address, plan, order or subscription status, and verified payment events.

Passwords are stored only as secure hashes. WordPress site secrets are stored encrypted. Single-use tokens are retained only in hashed form.

4. Purposes and legal bases

We process personal data to:

• provide the service and deliver messages securely,
• manage users, permissions, and connected sites,
• prevent abuse, manipulation, and duplicate deliveries,
• analyze errors and maintain availability,
• administer contracts, subscriptions, and payments, and
• meet statutory retention and evidence obligations.

Where applicable, the legal bases are performance of a contract and pre-contractual measures under Article 6(1)(b) GDPR, legal obligations under Article 6(1)(c) GDPR, and our legitimate interests in secure and reliable operation under Article 6(1)(f) GDPR. Where consent is required, processing is based on Article 6(1)(a) GDPR.

5. Recipients and connected services

Data is disclosed only where required to operate the service. Recipients may include:

• Meta Platforms for WhatsApp messages and Telegram for Telegram messages,
• the WordPress installation connected by the customer,
• hosting, database, email, and infrastructure providers,
• Lemon Squeezy for payment and subscription processing, and
• public authorities or other bodies where disclosure is legally required.

Data processed directly by WhatsApp, Telegram, WordPress, or a payment provider is also subject to that provider’s privacy terms.

6. International transfers

Some connected providers may process data outside the European Economic Area. Where no adequacy decision applies, providers rely on appropriate safeguards such as EU Standard Contractual Clauses. Details are available in the privacy information of the relevant provider.

7. Retention

We retain data only for as long as required for the purposes above, service security, and legal evidence obligations. The exact period depends on the type of data, contract status, pending deliveries, and statutory retention periods. Single-use invitations expire shortly; technical deduplication and security evidence may be kept longer to prevent repetition and abuse.

8. Security

We use appropriate technical and organizational measures, including encrypted transport, signed webhooks and WordPress requests, encrypted secrets, replay-resistant request IDs, restricted access rights, and recorded delivery operations.

9. Data subject rights

Subject to statutory requirements, individuals have rights of access, rectification, erasure, restriction, portability, and objection. Consent may be withdrawn at any time for the future.

Requests may be sent to office@spreademotions.com. We may request reasonable proof of identity or authorization to prevent unauthorized disclosure. Individuals also have the right to lodge a complaint with a competent data protection authority.

10. Changes

We update this Privacy Policy when the service, connected providers, or legal requirements change materially. The current version is published on this page.