Your GDPR Rights

You have the right to request a copy of the personal data we hold about you. This is called a Subject Access Request (SAR).

We will respond within 30 days and provide you with:

• Confirmation that we process your data
• A copy of the personal data we hold
• Information about how and why we process it
• Who we share it with
• How long we retain it

If you are a Wapai business owner, you can export all your data instantly from Settings → GDPR → Export My Data.

If the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

To update your business information, log in and go to Settings → Business Profile. For data that cannot be self-corrected, email us at support@wapai.com.

You can ask us to delete your personal data in certain circumstances:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent (where processing was based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed

Business owners can delete all customer data instantly from Settings → GDPR → Delete All Customer Data.

To delete your entire business account and all associated data, email support@wapai.com. We will complete this within 30 days.

Note: Some data may be retained where we have a legal obligation (e.g. financial records under UK accounting law).

You can ask us to temporarily halt processing of your data while a dispute is being resolved — for example, if you have contested the accuracy of your data or objected to our processing.

To request restriction, email support@wapai.com explaining the basis for your request.

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON).

Use Settings → GDPR → Export My Data to download all your data as a JSON file instantly. You can then import this into another service or keep it for your records.

You have the right to object to:

• Direct marketing: If we ever send marketing communications, you can opt out at any time
• Legitimate interests processing: Where we process data based on legitimate interests, you can object and we will assess whether those interests override your rights
• Research and statistics: You can object to your data being used for analytical purposes

To exercise this right, email support@wapai.com with "Right to Object" in the subject line.

Wapai uses AI to generate responses to your customers' messages. This is not fully automated decision-making in the GDPR sense — a human (you, the business owner) remains in control and can override any AI response.

We do not make legally significant decisions about individuals based solely on automated processing without human review.

To exercise any of your rights:

1. Self-service: Many rights can be exercised directly in Settings → GDPR
2. Email: Contact support@wapai.com with the subject "GDPR Rights Request"
3. We will respond within 30 days (we aim for 5–10 working days in practice)
4. We may ask you to verify your identity before processing your request
5. All requests are free of charge (unless requests are manifestly unfounded or excessive)

If you are unhappy with how we handle your personal data or your rights request, you have the right to lodge a complaint with the UK's supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you approach the ICO — please contact us first at support@wapai.com.