Privacy Policy

Last updated: August 22, 2026

fromCom ("we", "our", "the app") is a personal productivity tool that helps you keep track of commitments and action items from your WhatsApp conversations. Your privacy is fundamental to how we built this app.

The Short Version

This section is a plain-language summary. The full legal policy below governs your use of fromCom.

Message content is deleted within 24 hours. To find your tasks, your chats are processed on our servers. We actively delete message content within 24 hours of processing. We do not archive your conversations, and we never use them to train AI models.
Photos, videos and files are never stored. Media from your chats is not saved on our servers at all. Voice notes are transcribed so tasks can be found in them; the transcript is treated like any other message content and deleted within 24 hours.
What we keep is what you see. The action items fromCom extracts (tasks, follow-ups, meetings) and the contact names and photos needed to display them are stored, encrypted, on servers in the European Union until you delete them or delete your account.
Everything is hosted in the EU. Our servers run in the European Union (AWS and Supabase, EU regions). Pseudonymized message text is sent to our AI providers for processing under terms that prohibit them from training on your data.
Analytics is off until you opt in. If you enable it, we collect usage, performance, and device data linked to your account. It never includes the content of your messages, and you can turn it off at any time in Settings.
Deleting everything is one action. "Unlink Account & Delete Data" in Settings removes your data from your device and our servers, including the connection to your WhatsApp account.

How fromCom Works

fromCom maintains a secure connection to your WhatsApp account from our servers, which is what lets fromCom keep working for you when the app is closed and notify you when something needs your attention.

Once you link your account:

Messages from your chats flow through our servers so fromCom can find action items in them.
Our AI classifies which conversations are relevant for finding commitments. Conversations classified as not relevant are not processed further.
All message content, relevant or not, is actively deleted from our servers within 24 hours.
The result of processing is your list of action items. That list, not your conversations, is what fromCom stores for you.

You authorize this connection yourself during setup, and you can disconnect it at any time in the app or from your WhatsApp settings.

What Data We Collect

Account Data: When you sign in with Google or Sign in with Apple, we collect your email address and assign your account a random identifier (UUID). We use this data to operate your account and to respond to your support requests.

Message Content (transient): The content of messages in your WhatsApp chats is processed on our servers to classify conversations and extract action items. It is actively deleted within 24 hours and is never used for any other purpose.

Voice Notes and Media: Voice notes are transcribed so that action items can be found in them; transcripts are deleted within 24 hours like all other message content. Photos, videos, and files from your chats are not stored on our servers.

Contacts: To show you who each task relates to, we store the names and profile photos of your WhatsApp contacts, and the name or label associated with each action item, encrypted, linked to your account. We do not upload your device's address book; if you grant the Contacts permission, address-book names are used for display on your device only.

Tasks and Action Items: The action items fromCom extracts (tasks, follow-ups, meetings, and questions) are stored encrypted in our EU-hosted database, linked to your account, so your tasks are preserved between sessions and across reinstalls.

App Usage Analytics (opt-in): Analytics is disabled until you explicitly opt in (you are asked after sign-in), and you can turn it off at any time in Settings. When enabled, we collect usage and interaction data, performance and diagnostics data, and device and app information, linked to your account ID and email address. Analytics never includes the content of your messages or any identifier of the people you are messaging with.

How We Use Your Data

To provide the service: To operate your account, classify your conversations, extract tasks, follow-ups, and commitments, keep your action items available between sessions, and send you notifications you have enabled.
To improve the app: If you have opted in to analytics, we use usage, performance, and device data to understand how features are used, identify bugs, and improve the experience.
To communicate with you: To respond to your support requests or inquiries.

Legal Basis for Processing (GDPR & UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using your data is as follows:

Performance of a Contract: Processing your messages to find action items, storing those action items, and operating your account are the core of the service you sign up for. This processing begins only after you deliberately link your WhatsApp account and runs only for as long as it stays linked.
Consent: We collect app usage analytics only if you have explicitly opted in; you can withdraw this consent at any time in Settings. Linking your WhatsApp account is itself an explicit action you take, and unlinking withdraws it.
Legitimate Interests: We may process limited technical data based on our legitimate interest in securing our service, provided those interests are not overridden by your data protection rights.

AI Processing

Where it happens: Conversation classification and task extraction run on our servers in the EU, calling AI models from Anthropic (Claude), OpenAI, and xAI via their APIs.
Before sending (pseudonymization): Direct identifiers are replaced before message text is sent to the AI provider. Names become anonymous tokens, phone numbers are stripped, and internal messaging identifiers are never included. Message content is sent in pseudonymized form, which means it may still contain information that could identify individuals or topics; we minimize this by sending only the message spans needed for the analysis.
No training, minimal retention: Our AI providers process data under commercial API terms that prohibit using your data to train their models. Providers may retain API data briefly (typically up to 30 days) solely for abuse and safety monitoring, after which it is deleted.
AI makes mistakes: Extracted items may be incomplete or inaccurate. fromCom is a helper for staying on top of your commitments, not a system of record.

Messages From Other People

Your chats include messages from people other than you. fromCom processes these messages as part of providing you the service, relying on your role as the recipient and controller of your own received communications. This is consistent with how email clients, search, spam filters, and assistant features have long operated. We cannot obtain consent from the other participants on your behalf. We minimize their exposure through pseudonymization, the 24-hour deletion of message content, and contractual terms with our AI provider that prohibit training and retention.

Messages Sent Through fromCom

Some features let you send WhatsApp messages, such as approving a suggested reply or scheduling a message. Messages are sent from your own WhatsApp account only after your explicit action; fromCom never sends messages on its own.

Data Storage & Security

EU data residency: Our infrastructure runs in the European Union: the messaging connection on AWS (EU region), our database and backend on Supabase (EU-hosted), and our analytics platform PostHog (EU-hosted).
Encryption at rest: Action items and contact labels are stored encrypted in our database. Data cached on your device is stored in an encrypted database (SQLCipher, AES-256) with the key protected by your device's secure hardware.
Encryption in transit: All traffic uses HTTPS (TLS 1.2+).
Active deletion: Message content is deleted from our servers within 24 hours of processing. Media is not stored at all.

Push Notifications

If you enable notifications, we send them when fromCom finds something for you or a reminder is due. A notification may include the title of the action item and the name of the contact it relates to. You can disable notifications at any time in your device settings.

International Data Transfers

Your account, task, and analytics data are stored in the European Union. Limited data is transferred to processors based in the United States, in each case under Standard Contractual Clauses or an equivalent lawful transfer mechanism:

Anthropic (Claude): receives pseudonymized message text (direct identifiers stripped) for classification and task extraction.
OpenAI: receives pseudonymized message text (direct identifiers stripped) for classification and task extraction.
xAI: receives pseudonymized message text (direct identifiers stripped) for classification and task extraction.
Google: Sign in with Google and push notification delivery (Firebase Cloud Messaging).
Apple: Sign in with Apple and push notification delivery (APNs).

Data Retention

Message content and transcripts: deleted from our servers within 24 hours of processing.
Media: not stored on our servers.
Account, task, and contact data: retained for as long as your account is active. Deleted permanently when you delete your account.
App usage analytics: retained only for as long as necessary to fulfill the purposes outlined in this policy, after which it is permanently deleted.
Local data on your device: remains until you delete it or uninstall the app.

Data Deletion

You can delete all your data at any time:

Go to Settings → Unlink Account & Delete Data.
This disconnects your WhatsApp account, permanently deletes your account data, action items, and stored contact information from our servers, and removes all data, encryption keys, and preferences from your device.
If you wish to request the deletion of your analytics data, contact us.

Your Privacy Rights

Depending on your location (including the EEA, UK, and certain US states like California), you have specific rights regarding your personal data. You can exercise most of these rights directly within the app:

Right to Access: You can view your processed data (action items, settings) directly within the app.
Right to Deletion (Erasure): You can delete all your data, on your device and on our servers, via the "Unlink Account & Delete Data" setting.
Right to Rectification: You can edit or delete individual action items directly within the app.
Right to Object/Withdraw Consent: You can disable analytics in Settings, or disconnect your WhatsApp account entirely at any time.
Right to Portability: You can export your action items from the app where export features are supported.

If you wish to exercise any rights regarding the data we store, or if you have questions about your rights, please contact us at privacy@fromcom.ai. You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

Permissions

The app may request the following permissions, all of which are optional:

Contacts: To display names from your address book alongside action items. Address-book data stays on your device and is never uploaded to our servers.
Calendar: To create calendar events from action items that have due dates. Calendar data stays on your device and is never uploaded to our servers.
Reminders: To create reminders from action items that have due dates. Reminders data stays on your device and is never uploaded to our servers.
Notifications: To notify you about new action items and due reminders, as described above.

Third-Party Services

We use the following third-party services to operate fromCom:

Anthropic API (Claude), OpenAI API, and xAI API: AI classification and task extraction. Message excerpts are pseudonymized before being sent. Per each provider's commercial API terms, your data is not used for model training; providers may retain it briefly for abuse and safety monitoring only.
Amazon Web Services (EU region): hosts the messaging connection infrastructure.
Supabase (EU-hosted): our backend and database. Stores your account data, action items, and contact display data, encrypted.
PostHog (EU-hosted): app analytics, received only if you have opted in.
Google: Sign in with Google and push notification delivery via Firebase Cloud Messaging.
Apple: Sign in with Apple and push notification delivery via APNs.
Meta (Facebook): advertising measurement for our own ads, received only if you have opted in to analytics. See the Advertising Measurement section below.

We do not sell your personal data. We share limited, pseudonymous data with Meta solely to measure our own advertising, as described in the Advertising Measurement section below.

Children's Privacy

fromCom is intended for adults. Our Terms of Use require users to be at least 18 years old. fromCom is not directed at children under 13, and we do not knowingly process the personal data of anyone under 18. If we learn that we have collected data from a minor, we will delete it.

Website Advertising

We use Google Ads (tag ID AW-18162621883) on our website to measure how visitors arrive at fromCom and to evaluate the effectiveness of our advertising.

When the Google tag loads, Google receives your IP address and browser metadata. With your consent, Google may also store cookies on your device to attribute ad clicks to conversions. Without consent, conversion signals are sent in aggregated, redacted form: no cookies, no personal identifiers.

Visitors in the EEA, the United Kingdom, and Switzerland must opt in via the cookie banner shown on first visit before any advertising cookies are set. Visitors elsewhere are measured by default and can opt out at any time using the "Cookie settings" link in the footer.

App Advertising Measurement

If you have opted in to analytics in the app, we also use Meta (Facebook) technology to measure whether our advertising on Meta platforms leads to app installs and subscriptions.

For this purpose we share with Meta: a random identifier generated on your device by the Meta SDK, a one-way hashed (irreversible) version of your account identifier, your device's operating system version and the app version, and subscription lifecycle events, such as a subscription starting, renewing, being cancelled, or being refunded, together with the plan name.

We never share your messages, contacts, phone number, or email address with Meta. We do not collect or use your device's advertising ID.

If you turn analytics off in the app's settings, we delete these identifiers from our servers and stop sending events. Deleting your account has the same effect. Data Meta has already received is retained and processed by Meta under its own privacy policy.

Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the jurisdiction in which fromCom is legally established, without regard to its conflict of law provisions. Any disputes arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in that location.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy, contact us at:
privacy@fromcom.ai