Privacy

Parrot links your WhatsApp to an AI agent you choose. This page says what we store, where it lives and who can see it. Last updated 8 November 2026.

Who is responsible

Vishisht Choudhary, vishisht.choudhary@tum.de. Write to that address for anything on this page, including deleting your data.

What we store about your account

• Your email address, and a salted hash of your password (never the password itself).
• Hashes of your login sessions and of the API keys you give your agents, with their names and permissions.
• Your plan status and a Stripe customer ID if you pay. Card details go to Stripe, never to us.
• A short technical log per account (for example "machine started", "plan active") so we can fix problems.
• For each message your agent sends: the chat it went to, the time, and a fingerprint of the text (not the text). This enforces the sending limits that protect your number, and is deleted after 48 hours.

This lives in a Postgres database at Neon in Frankfurt, Germany.

Your WhatsApp messages

Your WhatsApp runs on a small machine of its own, with its own disk, at Fly.io in Frankfurt. Nothing from other accounts runs on it. Your WhatsApp login keys and messages are stored on that disk encrypted (AES-256-GCM) with a key that is never written to the disk: it is sent to the machine each time it starts. The disk itself is also encrypted by Fly.io.

Messages are not copied into our database, not used to train anything, not sold and not read by us. They are only passed on when your agent asks for them with its API key, and only within that key's permissions.

To be straight about the limits: while your machine is running, it has to hold the key and your messages in memory to work. Someone with control of our hosting (us, or Fly.io) could in principle read that memory. Sealing even that is on our roadmap (confidential computing), but it is not in place yet.

Cookies

One cookie, to keep you logged in. No analytics, no tracking, no ads.

Who processes data for us

• Fly.io: runs our server and your WhatsApp machine (Frankfurt).
• Neon: our account database (Frankfurt).
• Vercel: serves this website and forwards requests to our server.
• Stripe: payments, if you take a plan.
• Resend: sends our emails (confirmation, QR links).
• WhatsApp (Meta): your messages travel through WhatsApp as they always do; Parrot connects as one of your linked devices.

How long we keep it

Disconnecting in your dashboard deletes your WhatsApp machine and its disk straight away. When a plan or the free week ends without a plan, your machine and its disk are deleted too. Your account record stays until you ask us to delete it; email us and we do it within 30 days. Payment records are kept by Stripe as tax law requires.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and take it elsewhere. We process your data to provide the service you signed up for (Art. 6(1)(b) GDPR) and keep minimal logs to keep it secure (Art. 6(1)(f)). You can complain to a data protection authority, for example the Bavarian one (BayLDA).