Legal document

Full privacy notice

Last updated: November 4, 2026 · Version 2026-11-04

This is a translation. If there is any difference, the Spanish version prevails.

1. Who is responsible for your data

Nqual5, S. de R.L. de C.V., with its address in Aguascalientes, Mexico, and phone number +52 449 427 1321, is the data controller (the “responsible party” under Mexican law) for the processing of your personal data in the ConnectYourGPT service (“ConnectYourGPT”, “we”), provided at connectyourgpt.com and api.connectyourgpt.com.

For any privacy matter, including exercising your rights, write to soporte@connectyourgpt.com. Requests are handled by “Privacy Support”, at that same address.

ConnectYourGPT has no relationship with WhatsApp, Meta, OpenAI or Anthropic.

2. What the service does, in one sentence

ConnectYourGPT links your WhatsApp as one more device (just like WhatsApp Web) so that the artificial intelligence you connect (Claude or ChatGPT Plus) can send messages on your behalf (with a photo or a PDF, if needed), publish WhatsApp statuses and manage your address book, without ever reading your conversations: your AI has no tool to read chats, replies or other people’s statuses. Every send takes two steps, and the connector asks the AI to show you the recipient and the text and wait for your yes before the second one.

3. Who this notice applies to

You, if you have an account (“user”).
The people in your address book or whom you message with ConnectYourGPT (“your contacts”). You decide about their data: you are responsible for having their permission to message them, and we process their data on your behalf and only to provide you the service. Section 12 explains what they can do.
Anyone who writes to you on WhatsApp, shares a group with you or publishes statuses, even if they aren’t in your address book: we don’t store what they write, only the technical data in section 4.

4. What data we process

We don’t ask you for sensitive personal data (health, religion, origin, preferences, etc.). What you write in your messages is up to you: we ask you not to include anyone’s sensitive data.

Group	What data	Where it comes from
GroupYour account	What dataEmail address (verified with a code; you can change it), password if you sign in with email (at least 15 characters; Clerk stores it encrypted and checks it isn’t among leaked ones; we never see it), first and last name if you give them; if you sign in with Google: first name, last name, verified email and profile picture. An internal identifier for your account, your time zone, for the daily limits, and your country, to read numbers without a prefix (Mexico City and Mexico by default), sign-up and last-visit dates, whether your email is verified, and the version and date of the terms you accepted.	Where it comes fromYou, Google if you choose it, and Clerk
GroupYour linked WhatsApp	What dataYour number and WhatsApp identifier, the link status (connected, unlinked, paused, blocked by WhatsApp and until when), dates, and the keys of the linked device. Ended links stay as history until your data is deleted (section 8).	Where it comes fromWhatsApp, when linking
GroupWhat the WhatsApp library keeps	What dataTo be able to send and receive, the WhatsApp library keeps: for each person with an encrypted conversation, their encryption keys and identifier; for each group the account is in, the key of each member who writes, and for each person who publishes a status, theirs (updated with every message or status that arrives); the privacy permissions WhatsApp delivers per contact, with their date (those of accounts already unlinked are deleted automatically); the mapping between phone numbers and WhatsApp’s internal identifiers; and the contact list the phone syncs (saved names), along with an encrypted fingerprint of each action on a chat (such as mute, pin, archive, mark as read or delete) that makes it possible to check whether a specific chat had that action, but not to see its value. It does not keep texts, files, message identifiers, other people’s profile names or chat settings; for your own account it does keep its profile name, the business name if it has one, and the type of phone. The history the phone sends when linking is processed in memory and discarded, except for the permissions and mappings it brings.	Where it comes fromWhatsApp
GroupYour address book	What dataFor each contact: number, name (as saved on your phone or as you or your AI write it), their WhatsApp identifier, tags and notes you or your AI add, whether they asked not to receive messages and since when, how many messages you have sent them and when, when they were seen in your phone’s contacts and where the contact came from. Also a record of each contact sync.	Where it comes fromYour phone’s contacts (synced when linking and then every 6 hours), you and your AI
GroupWhat your AI sends for you	What dataRecipient (number, name and WhatsApp identifier), your number it goes out from, whether it was a first contact, message text (30 days), a fingerprint of the text, which AI prepared it, status (queued, sent, delivered, read, failed, cancelled or unknown whether it went out), its dates, the reason for a failure and the message identifier. “Delivered” and “read” are reported by WhatsApp, only in direct chats. The drafts the AI prepares before sending carry the recipient and the text. If a message has a photo or a PDF, the text is its caption, and of the file we keep its name, type, size, a fingerprint and the website it comes from (the link’s domain), also for 30 days; the file itself, never (we download it from the link when preparing it, to check it, and again to send it, and throw it away); the full link, encrypted, only while the draft is valid (and until the next cleanup if it expires unused) and while the send waits in the queue. And the WhatsApp statuses it publishes, text or with a photo, with the same as a message (text for 30 days, its fingerprint, which AI prepared it, its status, dates and the reason for a failure; with a photo, the same as for a sent file), plus the background, the font and whether you removed it; never who saw it or other people’s statuses.	Where it comes fromYour AI, you and WhatsApp
GroupThe AIs you connect	What dataApplication name (for example, “Claude” or “ChatGPT”), its domain, the permissions you gave it, connection and last-use dates, and whether you disconnected it. Access codes and permissions are stored only as a fingerprint.	Where it comes fromYour AI and you
GroupUsage	What dataDaily counters: messages sent, failed, delivered, read, first contacts, WhatsApp refusals, how many times each tool was used, how many times it failed and when it was last used.	Where it comes fromThe service
GroupBilling	What dataYour subscription status, amount and currency, the email you leave for the receipt (your Mercado Pago account’s, if you pay with it) and the latest ones you tried to pay with, up to 10; Mercado Pago identifiers (subscription, payer and charges), the type of payment method (for example, “visa”, never the card number), charge dates, “paid until”, non-payments and cancellation, the charge history (what was charged, when and with what result) and the billing notices we send you (date and amount of the charge, whether the notice went out, its dates and attempts, the reason if it failed and Resend’s identifier for the message; without your email). We never see or store your card details: Mercado Pago handles them.	Where it comes fromYou and Mercado Pago
GroupRecord of what you accept	What dataEach time you accept these texts (in the dashboard, or with the sign-up checkbox once the dashboard passes it to our server): their version, the language you had them in, and the date and time on our server when it was recorded. And each time you press the button that authorizes the charge, also: the version of that authorization’s text, the amount and currency we showed you, and the subscription’s identifier at Mercado Pago. We don’t keep your IP or browser with it. Only our server writes it, and it isn’t changed afterwards.	Where it comes fromYou, when you press, and the service
GroupFree trial	What dataThat your account already used its trial, when it started and ended, how many messages it sent, and when you asked to link your WhatsApp to start it. Of the number you tried it with we keep only a fingerprint: until the trial’s end by time, also with your account; after that, without your account (section 7).	Where it comes fromThe service
GroupTechnical data	What dataIP address and browser data, used at that moment for security and to stop abuse (for example, how many free trials are requested from one IP, which is kept in memory for up to a day); we don’t store the IP in the database, logs or backups. Clerk stores the IP and browser of your open sessions, reviews sign-ups that look automated or come from VPNs, Tor or proxies (and may give you a challenge), recognizes your device, and blocks sign-in for 60 minutes after 10 failed attempts.	Where it comes fromYour browser

What we don’t store: the content of what people write to you (texts, photos, audio, files, reactions, edits), your chats, your history, the profile names of who writes to you, or your chat settings. Like every linked device, ours receives your messages encrypted; the library decrypts them in memory and they are discarded at once, without being stored, forwarded or shown to any AI. Nor do we store the files you send (photos and PDFs, including the photos in your statuses): they are downloaded from the link to send them and thrown away.

What can’t be requested either: the WhatsApp connection we use only serves a closed list of operations (linking, its status, its notifications, contacts and sending). Neither we nor anyone with its key can ask it for your history, the files you receive, your contacts’ profiles or photos, your privacy settings, your blocked list or your groups, or ask it whether a number has WhatsApp without writing to it (when a message is sent, WhatsApp can refuse it if it can’t find the number); and we don’t receive who views your statuses, which group member reads a message, or delivery notices from chats that aren’t direct.

5. What we use it for

Purposes necessary for the service (without them we can’t provide it; they are based on the relationship you accept when you sign up):

Creating and protecting your account, and letting you in.
Linking your WhatsApp, keeping it connected and showing you its status.
Preparing and sending the messages (and their photos or PDFs) your AI sends on your behalf, publishing the statuses it prepares, telling you whether they were delivered and letting your AI check your address book and what it already sent.
Applying the automatic limits against WhatsApp blocks and abuse (how many messages per day and per hour, how many new people, the same text to many people, pauses if WhatsApp refuses or blocks). They are fixed rules about volume; they don’t assess anything personal about you.
Offering a single free trial per number and per account.
Charging for the subscription, notifying you before each monthly charge, handling non-payments and cancellations, and deleting your data when due.
Keeping a record of what you accept (these texts and each charge authorization), so we can prove it if there’s a complaint, a charge dispute or a chargeback.
Security: detecting and stopping improper access and failures.
Meeting legal obligations (tax, consumer, requests from authorities) and honoring your rights.

Purposes that would need your separate consent: none. We don’t sell your data, we don’t advertise with it, and we don’t use it to train artificial intelligence or to profile you. If we ever wanted another purpose, we would ask your permission first.

6. How to limit the use of your data

Unlink your WhatsApp from the dashboard, or from your phone (“Linked devices”). Unlinking doesn’t delete your address book or what you sent: for that, cancel or ask for your account to be closed (section 12).
Disconnect your AI: removing the connector from the AI itself (in Claude, “Connectors”; in ChatGPT, its plugins section) makes it stop using it, but doesn’t withdraw the permission you gave it, which stays valid for up to 30 days, and what it had already queued may go out during the next hour. To withdraw it at once, disconnect it from the dashboard (“Connected AIs”) or ask us (section 12): what that AI queued then stops going out right away (except a message already being sent at that moment), and what another AI that is still connected queued goes out as normal.
Mark a contact as “do not message” (by asking your AI): new messages to them can no longer be prepared. A message already in the queue may go out.
Cancel the subscription in the dashboard or, if you paid with your Mercado Pago account, there too (section 8).
Don’t send sensitive data in your messages.

7. How long we keep it

Data	How long
DataText of what your AI sends (messages, statuses and the caption and details of a photo or a PDF)	How long30 days. Then it is deleted (nothing remains of a photo or a PDF) and the rest of the data about what was sent stays, without the text, until your data is deleted (section 8). The fingerprint doesn’t let anyone read the text, although someone holding the database could check whether a specific text they already knew was sent.
DataDrafts the AI prepares	How longValid for 10 minutes; deleted the day after they expire.
DataSend log of the WhatsApp connection (recipient, type, status and date, no text)	How long7 days.
DataYour address book, your linked WhatsApp, the library’s keys, what was sent (without text), your connected AIs and your counters	How longWhile you use the service; deleted as described in section 8. The WhatsApp library’s part is deleted when unlinking if the connection to WhatsApp is active at that moment, except for two things: your contacts’ privacy permissions, deleted the next time the WhatsApp connection starts, and the mapping between numbers and WhatsApp’s internal identifiers, which the library shares across all accounts and doesn’t delete. If the connection isn’t active, that part stays until you ask us to delete it (section 12).
DataYour AI’s permissions	How longThe access one lasts 1 hour and the renewal one, 30 days; the AI application’s registration, 90 days without use.
DataFingerprint of the free trial number	How long12 months from the month it was used (12 to 13 months): during that time that number can’t repeat the trial. It is a fingerprint (HMAC-SHA256) made with a secret key kept outside the database and its backups; the fingerprint doesn’t carry your account and its date has only the month. It isn’t full anonymity: with few trials in a month, someone holding both the database and the key could associate a number with its account; that’s why the key is kept outside the database and the backups.
DataThe list of technical notifications already handled (it goes with your WhatsApp link) and the counts, with no account or IP, of how many trials were requested	How long2 days.
DataWhatsApp receipts that don’t yet match a send	How long15 minutes.
DataYour empty account and the charge history (with the billing notices)	How long5 years from the last charge. During that time they are used only for legal obligations and liabilities and so that, if you come back, it’s the same account, and so that the same account can’t repeat the free trial.
DataRecord of what you accept	How longWhile you have an account and, once your data is deleted (section 8), 365 more days: the time to be able to prove what you accepted if you dispute a charge after leaving. Then it’s deleted automatically.
DataUnused accounts (you never paid or used the service)	How longNo automatic period: they are deleted if you ask by email (section 12).
DataThat your account already used the free trial	How longThe same as the empty account; if you never paid, until you ask us to delete your account (section 12).
DataServer technical logs	How longThose of each part are deleted when it is rebuilt (the API, the dashboard and the WhatsApp connection, with each update; the web server, when it is recreated, which may take months), and at the latest when they reach their size limit. They carry no texts, numbers, names or your IP: the WhatsApp connection redacts them and the web server deletes IP addresses, headers and the last part of web addresses (with any permission identifiers they might carry).
DataBackups	How longOne a day, encrypted, which rotate: normally none is older than 14 days (section 10).
DataData kept by Clerk, Mercado Pago, Resend, Google or your AI provider	How longWhatever their own notices say.

8. What happens if you cancel or don’t pay

If you cancel, you keep using the service until the end of the period already paid. The same if you cancel from Mercado Pago.
If a charge fails (having paid before), everything keeps working for 10 days while Mercado Pago tries again; after that the tools stop and your WhatsApp stays linked. If the first charge fails, there are no such 10 days.
If you pause the subscription from Mercado Pago, the tools stop even if you have paid days left and, if no charge is outstanding, your data stays until you reactivate or cancel it.
If your free trial ends without you subscribing, the tools stop and your WhatsApp stays linked.
14 days after the later of the end of what you paid for and your cancellation (if a charge is outstanding, after the end of the 10 grace days, or after your cancellation if you cancel before they end; the grace days also count if the first charge fails even though you can’t use the service then; or after the trial’s end by time, even if you finish it earlier by reaching the 20 messages, or after the last payment you started and didn’t complete, if that’s later), we unlink your WhatsApp (it normally also closes on your phone; if it’s still there, remove it in “Linked devices”) and delete your address book, what your AI sent (messages and statuses), the drafts, your connected AIs, the fingerprints of your numbers that your trial kept and your counters. Before deleting we check again with Mercado Pago that you haven’t paid. If your subscription is still open there, we cancel it first and wait at least a day before deleting, looking at your payments again; so, in that case, the deletion comes a day later. If a payment shows up in that time, or you pay again before then, nothing is deleted and you keep using the service until the end of what you paid for (Mercado Pago doesn’t let a cancellation be undone, so the subscription stays cancelled).
What stays: your empty account (so that, if you come back, it’s the same one, and so that it can’t repeat the free trial), the charge history and the record of what you accepted, for their periods in section 7.

9. Who we share your data with

We don’t sell or hand over your data. These companies process it, on our behalf and only to provide you the service:

Who	What for	What data	Where
WhoContabo	What forHosting the server, the databases and the backups we keep in the United States	What dataAll the data in section 4 that we store	WhereUnited States: the server and the backups kept there
WhoClerk (Clerk, Inc.)	What forAccounts, sign-in, email verification and sending its emails (sent from connectyourgpt.com), and checking suspicious sign-ups (Clerk Protect, loaded from its own network)	What dataEmail, password, name, Google picture, sessions (IP and browser), device and browser data when signing up and signing in, acceptance of the terms	WhereUnited States
WhoResend	What forSending the service’s notices by email, such as the one before each monthly charge	What dataThe email you gave us for the receipt and the notice’s content: subject, date and amount of the charge, whether the last one couldn’t be made, and a link to your dashboard. Without your name or your WhatsApp data	WhereUnited States

And we share data with these third parties because it is necessary for your contract with us, so we don’t need your consent:

Who	What for	What data
WhoMercado Pago	What forCharging for your subscription (you give your card directly to Mercado Pago, under its own privacy notice; you don’t need an account with them)	What dataYour account’s internal identifier, the email you leave for the receipt or try to pay with, the amount and the description
WhoWhatsApp (Meta)	What forIt is the network your messages go out through, from your own account	What dataThe messages your AI sends (with their photos or PDFs) and their recipient, end-to-end encrypted like any WhatsApp message; and the statuses it publishes, which are shared according to your phone’s status privacy setting (the AI can’t read that setting). “Only share with…” limits it best. With “My contacts” a status may still reach someone you deleted after linking, and with “My contacts except…” the exclusion isn’t guaranteed.
WhoGoogle (only if you choose to sign in with Google)	What forIdentifying you	What dataGoogle knows you sign in to ConnectYourGPT
WhoAuthorities	What forOnly with a duly founded and reasoned order	What dataWhat they request, within the law

You choose your AI provider (Claude from Anthropic, ChatGPT from OpenAI or another). When your AI uses ConnectYourGPT, what you ask it and what we return to it (names, numbers, tags and notes of your contacts, and whether they asked not to receive messages; what you sent, with the text (and a photo’s or a PDF’s details) while it is kept, and its status, only if you gave it permission to send; the statuses published with ConnectYourGPT from your account, with their text while it is kept, and how many of the contacts in your address book were synced when they were prepared, if you gave it permission for statuses; and your own number, since when your WhatsApp has been linked, your time zone, your sending counters and limits, the status of your subscription and of your trial, and that AI’s name and permissions) is handled by that provider under its own rules, which we don’t control. We send it nothing your AI doesn’t ask for. If you use ChatGPT, OpenAI warns that what this connection brings in may be used to improve its models if you have its option to improve the model for everyone turned on: if you don’t want that, turn it off in ChatGPT.

International transfer: the server and part of the backups are in the United States, so your data leaves Mexico. All the sharing in this section is necessary to provide you the service: we make no transfers that need your consent, and if there ever were any, we would ask you first.

10. Backups

Every night we copy the two databases (the service’s and the WhatsApp connection’s, which holds the device’s keys), encrypted before they are written, and keep them in three places: the server itself (the latest 3), a second server of the responsible party in the U.S. and a computer of the responsible party in Mexico (in these two, normally none is older than 14 days). If a transfer fails, they may stay longer until it is fixed, and the computer in Mexico always keeps the last good copy. The key to decrypt them isn’t on the server. The backups don’t carry the key for the free trial fingerprint. What is deleted from the database disappears from the backups as they rotate.

11. Security

Everything travels encrypted (HTTPS). The database is only accessible inside the server, and administering it requires a cryptographic key. Access codes and permissions are stored as a fingerprint. Technical logs redact numbers, WhatsApp identifiers and names, and we don’t use error-tracking or analytics services. If a security breach significantly affects your rights, we will tell you immediately.

12. Your rights (ARCO) and how to withdraw your consent

You can access your data, rectify it, ask for its cancellation or object to its processing (ARCO rights), and withdraw your consent, at any time.

How: write to soporte@connectyourgpt.com with your name and a way to reply to you, your account’s email (to check it’s you; if that isn’t enough, we will ask you to confirm it from your session), a description of the data and what you are asking for.
Time limits: we reply within at most 20 business days and, if it applies, we carry it out within the following 15 business days; both periods can be extended once if the case justifies it. It is free, except for shipping or copying costs. We give you access in an electronic file.
On your own, from the dashboard: disconnect your AIs (“Connected AIs”), cancel, unlink and change your email, name or password (“Manage account”). If you haven’t accepted the current version of these texts yet, unlink from your phone. Closing your account completely is requested by email, and an unused account is deleted that way too. Withdrawing consent means no longer using the service and cancelling: the data is deleted as described in section 8.
What we may keep even if you ask for cancellation: the charge history, the record of what you accepted (for its period in section 7) and whatever the law requires us to keep, blocked.
If you don’t use ConnectYourGPT but someone wrote to you with it or you are in their address book: that person decides about that data. You can ask them or write to us at soporte@connectyourgpt.com with your number: we will tell you what we have and, if you ask, we will mark that you don’t want to receive messages through ConnectYourGPT from that account (that person can remove the mark, and it is deleted with their address book). You can also block their number on WhatsApp. If you have only dealt with that person on WhatsApp (you wrote to them or share a group), all we have about you is the technical data in section 4.
Authority: if you disagree with our answer, you can go to the Secretaría Anticorrupción y Buen Gobierno (Mexico’s Anti-Corruption and Good Governance Ministry) within the following 15 days.

13. Cookies and similar technologies

We only use the ones essential for your session to work: Clerk’s (on connectyourgpt.com and clerk.connectyourgpt.com, including those of its suspicious sign-up check and device recognition) and one cookie with the language you choose. When you go to pay, your browser remembers in that tab that you went to Mercado Pago, to carry on when you return, and forgets it when you return or close the tab. We don’t use analytics, advertising pixels or trackers, and fonts are served from our own server. The payment page belongs to Mercado Pago, under its own rules. If you block cookies, you won’t be able to sign in.

14. Changes to this notice

We will publish any change on this page with its date. If the change is important (new data, new purposes or new recipients), we will tell you in the dashboard and, if you pay, at the email you left for the receipt, and ask you in the dashboard to accept it again.

15. Language

This notice exists in Spanish and in English. If there is any difference, the Spanish version prevails.