Privacy Policy
Last updated: 29 September 2026
1. Who we are
Worbo is a product of EXTENDED DEV S.R.L.. It is a WhatsApp messaging platform for businesses, operated by EXTENDED DEV S.R.L., registered office Municipiul Galati, Strada CRIZANTEMELOR, Nr. 2G, Bloc A, Etaj parter, Ap. 08, Judet Galati, Romania, trade register no. J17/1870/2006, VAT/tax ID RO19219800 ("Worbo", "we").
Data protection contact: hello@worbo.app. General contact: hello@worbo.app, phone +40 336 102 862.
2. Scope
This policy covers the websites worbo.ro and worbo.app, the applications my.worbo.app, partner.worbo.app and hub.worbo.app, the Worbo mobile app and the Worbo API (together, the "Service").
3. Our roles: controller and processor
- For website visitors, people who contact us and users who create an account, Worbo is the data controller.
- For data that our customers (businesses using the Service) upload or generate through the Service, meaning their contacts, message content and consent records, Worbo is a data processor and the customer is the controller. We process such data only on the customer's instructions and under the Data Processing Agreement (DPA) concluded with them.
- If you received a WhatsApp message from a business that uses Worbo, that business is the controller of your data. Requests about that data go to the business; we can help you identify it if you write to hello@worbo.app.
- Meta Platforms Ireland Limited provides the WhatsApp Business Platform and processes message data under its own terms, including the WhatsApp Business Data Processing Terms.
4. Data we process as a controller
- Account data: name, email address, phone number, company name, role, password (stored only as a hash), two-factor authentication settings.
- Billing data: legal company name, tax ID, address, billing contacts, payment history. Card details are processed directly by the payment processor and never reach our servers.
- Usage data and technical logs: IP address, browser or device type, pages visited, in-app actions, technical errors, timestamps.
- Form data: whatever you send through contact, demo request or subscription forms.
- Communications: emails and support conversations with us, including on WhatsApp if you message our number.
- Cookies and similar technologies, described in section 11.
5. Data we process as a processor
On behalf of our customers we process: phone numbers and names of contacts, attributes and tags assigned by the customer, the content of messages sent and received through WhatsApp, attached media files, delivery statuses, consent records (source, time and text accepted) and opt-out preferences.
6. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, providing the Service, support | performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing, accounting, tax records | legal obligation (Art. 6(1)(c)) |
| Keeping proof of consent and of opt-out requests | legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Security of the Service, abuse and fraud prevention, technical logs | legitimate interest (Art. 6(1)(f)) |
| Improving the Service, aggregated statistics | legitimate interest (Art. 6(1)(f)) |
| Marketing communications to business contacts | consent, or legitimate interest for existing customers with an opt-out in every message (Art. 6(1)(a) or (f); Romanian Law 506/2004, Art. 12) |
| Non-essential cookies | consent (Art. 6(1)(a); Romanian Law 506/2004, Art. 4) |
7. Who we share data with
We use providers that process data on our behalf under data processing contracts:
| Provider | Role | Data location |
|---|---|---|
| Meta Platforms Ireland Limited | WhatsApp Business Platform (Cloud API) | EU, with transfers to Meta Platforms, Inc. in the US under standard contractual clauses and Meta's Data Processing Terms |
| Hetzner Online GmbH | server hosting and file storage | Germany or Finland |
| Cloudflare, Inc. | DNS for the Worbo domains | global network, under standard contractual clauses |
This is the current list of sub-processors. Providers for upcoming features, such as payments or email delivery, are added here before they are used, and customers are notified at least 30 days before a new one is added.
We may also disclose data to authorities where required by law, and to our advisers (accountants, lawyers) under confidentiality obligations. We do not sell personal data and do not use it for third-party advertising.
8. Transfers outside the European Economic Area
Data is stored in the European Union. Some providers (Meta, Cloudflare) may transfer data to the United States. Those transfers rely on the standard contractual clauses approved by the European Commission and, where applicable, certification under the EU-US Data Privacy Framework.
9. Retention
| Category | Period |
|---|---|
| Account data | for the life of the account, then 90 days after deletion to close obligations and possible disputes |
| Billing data | the period required by tax and accounting law |
| Customers' contacts and messages | for the life of the contract; deleted on the customer's instruction or at the end of the contract within 30 days |
| Consent and opt-out records | for the life of the contract and 3 years after the last message, as evidence |
| Technical logs | 12 months |
| Backups | at most 35 days after deletion from active systems |
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, objection, and the right to withdraw consent at any time without affecting prior processing. To exercise them, write to hello@worbo.app. We answer within one month.
You may also lodge a complaint with the Romanian supervisory authority, ANSPDCP (B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro), or with the authority of your country of residence.
If your request concerns data we process on behalf of a customer, we forward it to the customer and support them in answering.
11. Cookies
The worbo.ro and worbo.app websites do not use cookies. The my.worbo.app application uses only strictly necessary cookies, which do not require consent: session and authentication, CSRF protection, the "Remember me" option, language, theme and sidebar state. We do not use analytics or advertising cookies; if we ever introduce them, they will be enabled only with your consent.
12. Security
We apply encryption in transit (TLS), encryption at rest for access tokens, two-factor authentication, role-based access control, encrypted backups and hosting in the European Union. Our staff's access to customer data is limited to support, at the customer's request.
13. Data obtained through Meta platforms
Data received from Meta through the WhatsApp Business Platform and Facebook Login for Business (business account and phone number identifiers, access tokens) is used solely to provide the Service to the customer who authorised it, in line with Meta's developer policies. Instructions for deleting this data are published at https://worbo.app/data-deletion.
14. Children
The Service is intended for businesses and professionals. We do not knowingly process data of persons under 16.
15. Changes
We update this policy when the Service or the law changes. Previous versions are available on request. Material changes are announced by email to account holders.