Sendov0.1.1

Privacy policy

Last updated:

Quami is a trade name of Multi Inversiones de Desarrollo e Innovación, Sociedad Anónima. This policy explains what personal data MIDI, S.A. (“Quami”, “we”) collects through the Sendo website and the Sendo Connect service, why we use it, how long we keep it, who we share it with and how you can exercise your rights.

Legal name
Multi Inversiones de Desarrollo e Innovación, Sociedad Anónima
NIT
120177366
Address
8 Avenida 10-69 Residenciales del Norte, Zona 17, Guatemala, Guatemala 01017
Phone
+502 5944 7562
Email
hello@quami.dev

Who we are#

MIDI, S.A. is a company based in Guatemala. We publish Sendo, an open-source WhatsApp library, and run Sendo Connect, an optional paid service. MIDI, S.A. is responsible for the personal data described in this policy, except where we say we act on behalf of a customer.

For any privacy question, write to hello@quami.dev.

What this policy covers#

The open-source package and registry (@quami/sendo and the components you copy into your project) run inside your own app, on your servers and with your own database. The messages, contacts and tokens they handle never reach Quami. You, not Quami, are responsible for that data and for telling your users how you use it.

Messages relayed by Sendo Connect#

When a business uses Sendo Connect, Meta sends the WhatsApp webhooks for its numbers to Quami’s relay, which forwards them to that business’s app. For that content, Quami acts on behalf of the business (our customer), which decides why and how its end users’ data is processed and is responsible for it towards them.

If you wrote on WhatsApp to a business that uses Sendo, that business’s privacy policy applies to your messages. Data deletion explains how to reach it or us.

What data we collect#

Connect panel accounts. Your email address (you sign in with a one-time code we email to you), the projects you create, your API keys (stored only as hashes), your signing secrets (stored in an encrypted vault), the webhook URL you register and the WhatsApp numbers connected to each project.

Billing. Your plan, invoices and payment status. Payments are processed by Recurrente: your card details are entered on and held by Recurrente, never by Quami.

Relayed webhooks. The body of each webhook Meta sends for a connected number (it can include message text, media references, phone numbers and profile names of the people writing to the business) is held encrypted only while its delivery is pending, and deleted on success or when the 24-hour retry window ends. Bodies are never logged. For each delivery we keep metadata: timestamp, project, number, status code, attempt count and latency.

WhatsApp access tokens. When a customer connects a number through Embedded Signup, the business access token Meta issues is returned once to the customer’s server and is never stored by Connect.

The live demo. What you type in the demo is sent to our server and kept in your browser’s session storage, which is cleared when you close the tab. When the demo uses an AI model, the conversation is sent to a model provider through Vercel AI Gateway to generate the reply. The server keeps no transcript. To limit abuse and cost it counts messages per IP address per day in a Redis store; those counters expire after 2 days. Please don’t type personal information into the demo.

Website visits. Our hosting provider (Vercel) processes technical request data, such as IP address, browser and requested URL, to serve and protect the site. The site sets one cookie, sendo-lang, only when you choose a language, to remember it for a year; the light or dark theme you pick stays in your browser’s local storage. We use no analytics, advertising or third-party tracking scripts.

Email you send us. If you write to us, we keep your message and address to answer you and to keep a record of the request.

Why we use it, and on what basis#

We don’t sell personal data, don’t use it for advertising and don’t use relayed messages to train AI models.

How long we keep it#

Who we share it with#

We share personal data only with the providers that run the service for us, under their data processing terms, and with authorities when the law requires it:

International transfers#

Most of our providers are based in, or store data in, the United States, so your data may be processed outside your country. We choose providers with recognised security practices and rely on their contractual safeguards, such as standard contractual clauses where they apply.

Security#

Webhook bodies are encrypted while they wait for delivery, API keys are stored as hashes and signing secrets in an encrypted vault. All traffic uses HTTPS, every relayed webhook is signed with the customer’s own secret, and access to production systems is limited to the people who run the service. No system is perfectly secure: if a breach affects your data, we will notify you and the authorities as the law requires.

Your rights#

You can ask us to access, correct, delete or give you a copy of your personal data, to object to or restrict a use of it, and to withdraw consent where we rely on it. Write to hello@quami.dev from your account’s email address (or tell us how to identify you). We answer within 30 days.

If your data is messages you sent to a business that uses Sendo Connect, contact that business first: it controls that data. You can also complain to the data protection authority in your country, where one exists.

Children#

Sendo and Sendo Connect are services for businesses and developers. They are not directed to children under 13 (or the minimum age in your country), and we don’t knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy#

We will post any change here and update the date at the top. If a change materially affects Connect customers, we will also email them before it takes effect.

Contact#

Questions about this policy or your data: hello@quami.dev or +502 5944 7562. MIDI, S.A., Guatemala.