Privacy and consent

About 10 minutes · Last checked 31 October 2026 · Plugin 2.10.0

How WAPI Connect Pro keeps track of who agreed to your messages and who asked you to stop, how to give a customer their data or erase it, and what to put in your privacy policy and your Meta app. This guide explains what the plugin does; it is not legal advice.

Message customers who agreed

WhatsApp’s rules ask you to have a customer’s permission before you message them, and marketing messages in particular may only go to customers who agreed (opt-in). People who get messages they did not want block and report them, and Meta then lowers your quality and limits or restricts the number.

• Ask clearly and say what they agree to. The plugin adds an unticked box to WooCommerce’s classic checkout page: “I agree to receive order updates and promotional offers via WhatsApp.”
• Do not tick it for them, and mark contacts as agreed only when they really agreed: on your website, in person or in a chat. The plugin asks you to confirm each time.
• You can also ask inside a chat: an automation’s “Actions” step with “Sign up for offers” marks the customer as agreed after their own answer, and records what they answered.
• Make stopping easy, and respect every stop. The plugin does that for you, below.
• Never ask customers on WhatsApp for card numbers or ID numbers.

Campaigns only go to contacts marked “Agreed” who did not unsubscribe. How contacts get there is in the contacts and campaigns guide.

Stop words

A customer who sends one of these words or phrases as the whole message stops receiving campaigns:

• Capital letters, punctuation, Arabic vowel marks and the different ways of writing hamza do not matter: “STOP!”, «ايقاف» and «إيقاف» all count.
• The message must be exactly the word or phrase. “Please stop sending me offers” does not count; you can stop marketing for that customer yourself in the inbox.
• «إلغاء» on its own is not a stop word: customers write it to cancel an order.
• Tapping a button with one of these words counts too, such as Meta’s “Stop promotions” button in a marketing template. A tap on a button of your own automations never counts.

The first time, the customer gets one short reply in their language: “Done: you will not receive offers from [your store] anymore. You can still write to us here anytime.”

What a stop does

• The contact is moved to “Unsubscribed”, and campaigns skip them. Each campaign message is checked again right before it goes out.
• A stop word or the stop button also ends the automation the customer was in, and automations no longer send them products on their own after a wait.
• Order updates and your replies in the inbox still go out.
• A store sync or an import never brings them back.

Customers can also stop marketing inside WhatsApp itself. The plugin hears about it in two ways: through the user_preferences webhook field (turn it on, see webhook fields), or when WhatsApp refuses a marketing message with error 131050. Either way the contact is unsubscribed.

If the customer turns marketing back on in WhatsApp, that only undoes WhatsApp’s own stop. When WhatsApp’s setting was the only reason, the contact goes back to what it was before. When the customer also asked you (a stop word or the stop button), or you stopped them, they stay stopped, and the inbox shows that they turned marketing back on in WhatsApp, so you can decide.

Stop or allow marketing yourself

• In the inbox app: open the chat → Customer info → “Marketing messages” → “Stop marketing messages”, with an optional reason.
• In Contacts: tick contacts and press “Unsubscribe”, or open a contact and change its status.
• Allow again only when the customer asked: in Customer info press “Allow marketing again” and tick “The customer asked me to receive offers again”. It is saved with your name and the date.

The inbox app guide shows these steps with the customer panel.

The consent log

Every contact keeps a history of its consent. The plugin records:

• when and where the contact agreed: at checkout, at the WhatsApp login, in an import, by you, or in an automation, with the automation’s name and what the customer answered
• every change into or out of “Unsubscribed”: what happened, how (a stop word, the stop button, WhatsApp’s setting, error 131050, an automation’s “Stop offers” or you), when, which of your users did it, and the stop word or note
• a customer turning marketing back on in WhatsApp, and whether that allowed marketing again

The latest 40 events are kept per contact. You see the current state in the inbox, under Customer info → “Marketing messages”: how and when it was stopped, by whom, and the reason. The full history is part of the customer’s personal-data export (below), as “Consent history”.

Export or erase a customer’s data

The plugin adds itself to WordPress’s own privacy tools as “WhatsApp (WAPI Connect Pro)”.

1. Start the request

   In WordPress open Tools → Export Personal Data (to give a customer a copy) or Tools → Erase Personal Data (to delete it). Enter the customer’s e-mail address and add the request. WordPress can first send the customer an e-mail to confirm it is really them.

2. How the customer is found

   From the e-mail address the plugin finds the customer’s WhatsApp numbers: the contact with that e-mail, the phone number on their account, and the phone on their orders.

3. Export

   The export file has a “WhatsApp contact” part (number, name, tags, “Offers on WhatsApp” and “Consent history”), the “Answers given to WhatsApp automations”, and “WhatsApp messages”: each message with its date, whether it came from the customer or the store, and its text or file name.

4. Erase

   Erasing deletes the customer’s chat with all its messages and files, their automation runs and answers, and the contact. One thing is kept for a customer who stopped offers: their number and that choice, with the name, e-mail, tags, notes and custom fields removed, so they are never sent offers again. WordPress shows a note when that happens.

The plugin does not erase WooCommerce orders; WooCommerce’s own privacy settings decide that. Copies Meta keeps under its own terms are not touched by the plugin.

Suggested text for your privacy policy

Open WordPress Settings → Privacy and look at the policy guide. Under “WAPI Connect Pro” the plugin suggests this text, for you to check and copy into your policy:

We use WhatsApp (Meta’s WhatsApp Business Platform) to send order updates and login codes, to answer you and, when you agreed, to send offers. For this we keep your WhatsApp number, your name, the messages you exchange with us on WhatsApp and the answers you give to our automatic replies.

Messages go through Meta (WhatsApp). When an automatic AI assistant answers you, your question and the recent messages of the chat are sent to our AI provider to write the answer; it tells you that it is automatic, and you can ask for a person at any time.

You can stop offers at any time by writing “stop” or “إيقاف”. You can ask us to send you, or delete, the data we keep about you.

Change it to fit your store. Leave out the AI paragraph if you do not use an AI step, and name your AI provider if you do. The plugin shows it in the language you chose for the plugin’s admin, Arabic or English; the Arabic version of this guide has the Arabic text.

Where the data is

• Contacts, chats and automation answers are stored in your own WordPress database. Chat photos and files are in a private folder on your server that opens only through the inbox.
• Every message also goes through Meta, under Meta’s terms.
• Nothing of your customers’ data reaches wapiconnect.net. Our server only receives your license key, your site’s address and the plugin version, for the daily license check.
• Notifications to your phone travel encrypted through your phone’s push service (Apple’s or Google’s, for example).
• If you use an AI step, the customer’s question and recent messages go to the AI provider you chose, with your own key. Card numbers, IBANs and Kuwait Civil ID numbers are hidden in that copy first; the message in your inbox stays as the customer wrote it.
• Deleting the plugin removes its scheduled tasks and your AI key, but keeps your WhatsApp data, so you can install it again without losing anything. To remove everything too, add define( 'WAPI_DELETE_DATA_ON_UNINSTALL', true ); to wp-config.php before you delete the plugin.

The privacy URL of your Meta app

Meta asks every app for a public privacy policy before it can go Live. In your Meta app open App settings → Basic and fill in “Privacy Policy URL” with the address of your store’s privacy-policy page, for example https://your-store.com/privacy-policy/. WordPress → Settings → Privacy shows which page is your policy.

Meta may also ask how people can request that their data be deleted. Explain it on a page of your store, for example by e-mail or a WhatsApp message to you, and handle such requests with the erase tool above. Then switch your app to Live, as in the webhook guide.

Check that it worked

• Send “stop” to your business number from another phone: you get the confirmation reply, and in Contacts that number shows “Unsubscribed”.
• Run Tools → Export Personal Data for a test customer: the file has a “WhatsApp contact” part.
• Your privacy policy page has a WhatsApp section, and its address is in your Meta app.

Common problems