Privacy Policy

Last updated: March 21, 2026

What We Do

Popeki Track provides WhatsApp ad attribution and lead intelligence for businesses. We help businesses understand which ads drive WhatsApp conversations and sales.

Information We Collect

  • Account information (name, email, business name) when you sign up
  • WhatsApp conversation metadata (phone numbers, message timestamps, message content) received via the WhatsApp Business API
  • Ad click data (IP address, user agent, referrer, UTM parameters, click IDs) when users click tracked links
  • Payment information processed securely through Stripe

How We Use Information

  • To attribute WhatsApp conversations to ad campaigns
  • To classify and score leads using AI (see AI Data Processing below)
  • To send conversion data back to ad platforms (Meta CAPI) for ad optimization
  • To provide analytics and reporting in your dashboard

AI Data Processing

Lead classification is performed by AI providers to analyze WhatsApp conversation content in real time. When a new conversation arrives, the message content is sent to one of our AI providers for classification.

  • Conversation content is processed for real-time classification only — it is not stored by the AI provider beyond the duration of the API call
  • Conversation content is not used for AI model training by any provider
  • We rotate between multiple providers for reliability, not for data sharing purposes
  • Each provider is subject to enterprise data processing terms

The AI extracts structured data (lead score, category, intent, budget signals, urgency) which is stored in your Popeki Track dashboard. The raw conversation content remains in your account.

Data Sharing

We do not sell your data. We share data only with:
  • Meta — conversion events sent back via the Conversions API (only when you configure this). Phone numbers are hashed before transmission.
  • AI providers — conversation content is processed for lead classification as described above
  • Stripe — for payment processing

Data Retention

We retain your data for as long as your account is active. You can request deletion of your data at any time by contacting us. Upon account deletion, your data is removed within 30 days.

Your Rights (GDPR, CCPA, LGPD)

Regardless of where you are located, you have the following rights regarding your data:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Portability: Request your data in a machine-readable format
  • Opt-out: Opt out of data processing for marketing purposes

Data processing basis: We process your data based on legitimate business interest (providing the service you signed up for) and, where applicable, your explicit consent.

Data controller vs. processor: Popeki Track acts as a data processor on behalf of your business (the data controller). Your business is responsible for obtaining appropriate consent from your WhatsApp contacts.

Cross-border transfers: Data may be processed in the United States and European Union. We use services that comply with applicable data protection frameworks.

Data Processing Agreement

Enterprise and regulated-industry customers (insurance, financial services) who require a Data Processing Agreement (DPA) can request one by contacting us at the email below. We are willing to sign standard DPAs that align with GDPR and CCPA requirements.

Security

We use encryption in transit (TLS), secure database hosting on enterprise cloud infrastructure, and follow industry best practices to protect your data. Access to production data is restricted to authorized personnel only.

Contact

For privacy questions, data subject requests, or DPA inquiries, contact us at alex@popeki.com. We aim to respond to all privacy requests within 30 days.