Privacy Policy
Last updated: 6 October 2026
This policy explains what personal data Threadwire handles, why, and for how long. Threadwire is run by TriTech Solutions of Cairo, Egypt ("we", "us").
Two kinds of data
- About our customers and their teams: names, email addresses and how you use Threadwire. We decide how this is used.
- On the numbers our customers link: their contacts' phone numbers and WhatsApp names, messages and files. We handle these to run Threadwire for the customer, and to protect the customer's numbers, for example by honouring opt-outs and measuring how many people answer. The customer decides what is sent and to whom, and is responsible for telling their contacts how their data is used.
What we keep, and for how long
| What | Why | How long |
|---|---|---|
| Your users' names, email addresses and roles, when each last signed in, which alert emails each chose to get, whether our emails reach their address (our email provider tells us when one bounces or is marked as spam), and passwords (stored only in scrambled, hashed form) | To let you sign in, to email you sign-in links and alerts, and to stop writing to an address that does not want or get them | While your account is open. Someone removed from a team is kept until then too, so they can be restored |
| Payments you tell us about (amount, how you paid, the transfer's reference) and your invoices, with the billing details you give us | To confirm payments and issue invoices | Payments while your account is open; invoices as long as tax law requires, also after your account closes |
| Your plan, and the date your subscription is paid until | To bill you, and to remind you before it ends | While your account is open |
| Sign-in sessions, with the IP address and browser they came from | To keep you signed in | Until you sign out, or soon after 2 hours without activity |
| If you turn on two-step sign-in: its secret key and recovery codes, encrypted | To check the code from your authenticator app | Until you turn it off |
| Sign-in and invitation links | To let you set a password | 7 days, or until used |
| API keys (stored only in hashed form), your webhook address and your signing secret (encrypted) | To run the API and send you events | Until you revoke or change them, or your account closes |
| Each number you add: its phone number, the name you gave it, whether it has a WhatsApp profile name and picture, and its latest safety score with the counts behind it (no message text and no contacts) | To send and receive for you, and to protect the number | Until you remove the number |
| The WhatsApp session that keeps a number linked. Like any linked device, it holds what WhatsApp syncs to it: the number's contacts, its chat list and recent chat history | To keep the number connected | Until you remove the number |
| Every message on a linked number, in one-to-one chats and in its groups: sent through Threadwire, typed on the phone, or received. Each with the other person's phone number (in a group, who wrote it), the name they show on WhatsApp, the text, any file, the reactions people put on it, and whether it was delivered and read | To send them, deliver them to your webhook, and show them in your panel | 30 days, then deleted |
| If you turn on automatic warm-up: the short, general messages your own numbers send each other (never to anyone else), stored like other messages but not shown in your panel's chats or sent to your webhook | To warm up new numbers | 30 days, then deleted |
| Records of webhook events sent to you, which include the message they are about | To retry them and show you what was sent | 30 days after each event, then deleted |
| The same events, kept for your systems to fetch from the API, also when you have no webhook address | So a system that cannot receive webhooks, or missed some, can fetch them | 30 days after each event, then deleted |
| If you turn on the AI agent: the API key you give us for your own Anthropic or OpenAI account (encrypted, and shown to you only by its last 4 characters), what you tell it about your business, its settings, and the chats where your team stopped it (with the chat's phone number) | To answer people for you with your AI account | Until you change or remove them, or the number |
| Labels and notes your team puts on chats, with the chat's phone number and who wrote each note | To organise your team's work in the panel; they are never sent to WhatsApp | Until you remove them, or the number. They stay with the chat after its messages are deleted, and show again if the person writes again |
| Details your team writes about a person who wrote to you, such as a customer number or a city, with that person's phone number. A broadcast keeps a copy of the ones its text uses | To show your team who they are talking to, and to make your broadcasts personal; they are shown only to your team | Kept while you keep them: until you clear them or remove the field, and removed with your account. They are not removed with that person's messages or when you remove a number, since the person may write to another of your numbers; your admins can clear anyone's from the Chats page. A broadcast's copy goes with the broadcast |
| Which of your team looks after each chat, with the chat's phone number | To organise your team's work in the panel | Until you change it, or remove that person or the number |
| A record of each request your systems make with your API keys: which key, what was called, the answer and how long it took, and for a refused request the reason (with phone numbers removed; it can include the address your request came from). Never what a request carried | To show you why a request failed | 24 hours, then deleted |
| Phone numbers of people who replied "STOP" | To stop messaging them, and to keep them out of broadcasts after they write to you again | Until they reply "START" or a word like it, or your account is closed |
| When someone last wrote to your instance. We keep a keyed code, not the number; with our secret key a guessed number can be checked against it | So a message to someone who wrote to you before does not count as one to a new person once their messages are deleted | 90 days after they last wrote, then deleted |
| Broadcasts you make: their text, any file, and the people they go to (only people who wrote to your number, or saved contacts you chose to include: their phone number, name, any columns your list had, and whether each was sent or passed over). People left out are only counted, never kept | To send each person their message, one at a time, and show you how it went | 30 days after it finishes, or after it was last changed if it never finishes, then deleted |
| OTPs you start with "WhatsApp OTP": the phone number it was for, the number that verified and when, and your reference. The code itself is kept only in scrambled (hashed) form | To verify the person and show you the result | 30 days, then deleted |
| On a plan with usage limits, the phone numbers you messaged this month, to count your conversations | To apply the plan's limits | Until the month is over |
| WhatsApp statuses your numbers post, with who they were shown to and the phone numbers of the people who viewed them | To post them and show you who saw them | 30 days, then deleted |
| Phone numbers you checked, or first messaged, and whether they are on WhatsApp | So the same number is not looked up twice, which protects your number | A week if it is on WhatsApp, a day if not |
| The phone number behind a contact's private WhatsApp id, when WhatsApp addresses them by one | So it is not looked up again with every message from them | A day |
| A record of who did what in your account: sign-ins, and changes to numbers (with their phone numbers), API keys, webhooks (by address), your team and your plan, with the IP address they came from | For security, and to answer "who changed this?" | 1 year, then deleted |
| Counts of the people a number messaged first and how many answered | To protect the number | Until you remove the number |
| Records of background jobs that failed, which include what they were working on, such as a message | To find and fix problems | 30 days, then deleted |
| Server logs of requests and errors, which can include IP addresses, email addresses, phone numbers and message text | To keep Threadwire working and secure | 14 days |
| The WhatsApp engine's own log, which can include phone numbers | To find and fix connection problems | Up to a week |
| Backups of the database and of the WhatsApp sessions, and the database's own record of recent changes | To recover from a failure | Database: up to a month. Sessions: up to a week |
So something deleted can stay in backups, and in the database's record of changes, for up to a month more. WhatsApp's engine on our server keeps its own copy of a received file for 10 minutes while we fetch it.
Who else handles it
- WhatsApp (Meta): your messages travel through WhatsApp, as from any linked device, and WhatsApp's own privacy policy applies to them.
- Contabo: hosts our servers, in Germany.
- Cloudflare: carries traffic between you and our servers, and can hold copies of our backups and the files of your messages (photos, documents, voice notes). On the sign-up and "Forgot password?" forms, its Turnstile check looks at your browser to tell a person from a script.
- A proxy provider (IPRoyal), when we route your numbers through one: carries the connection between a linked number and WhatsApp. WhatsApp encrypts that connection and messages are end-to-end encrypted, so the provider sees only that a connection is made, not what it carries.
- Anthropic or OpenAI, only if you turn on the AI agent: to write each answer, the words of the chat's latest messages (up to 10, without the person's phone number) and the information you gave it about your business go to the provider you chose, under your own account with it and its terms, using your API key. You decide whether to turn it on, and you are responsible for telling your contacts that AI may answer them.
- Resend: sends our emails, such as sign-in links.
- Paymob, if you pay by card: takes your card on its own secure page, with your name and email and the amount. We never see or keep your card details, only Paymob's transaction number.
- Discord: carries our team's alerts about problems. An alert can include a number's name and phone number, your business name, and your webhook's address.
- Google Fonts and Bunny Fonts: serve the fonts on our pages, and see your IP address when they do.
- unpkg: serves the viewer for our API reference page, and sees your IP address when it does.
We only give each provider what it needs to do its job. We do not sell personal data, use it for advertising, or train AI models on your messages.
Outside Egypt
Our servers are in Germany, and some of the providers above work in other countries, including the United States.
Security
Traffic to Threadwire is encrypted (HTTPS). Passwords and API keys are stored only in hashed form, and signing secrets are encrypted. Access to our servers is restricted, and every webhook we send is signed so you can check it came from us.
Cookies
Our public pages set no cookies. When you sign in to your panel, we set a session cookie to keep you signed in and a security cookie that protects forms. If you tick "Remember me", a further cookie keeps you signed in on that browser until you sign out, for up to 400 days. We use no advertising or analytics cookies.
Your rights
You can ask to see, correct or delete the personal data we hold about you, or object to how we use it, by writing to [email protected]. If you are a contact of one of our customers, please ask that business first: they decide what is sent to you, and we will pass your request to them. You can also complain to Egypt's Personal Data Protection Center, or to the data-protection authority where you live.
When an account closes
When an account closes, at the customer's request or ours, we unlink its numbers and delete its data within 30 days, apart from anything the law requires us to keep, such as invoices. Copies in backups are deleted as the backups expire, within a further month.
Changes
We will post any change to this policy here, and tell customers about significant changes by email or in their panel.
Contact
TriTech Solutions, Cairo, Egypt · [email protected]