Privacy Policy

Last updated November 7, 2026

Wayla is a career assistant that students and early-career people text on WhatsApp for help with internships, research and jobs. It is operated by Tinkly LLC (“we”, “us”). This policy covers the assistant you text and this website, heywayla.com, and explains what we collect, how we use it, and the choices you have.

What we collect

• Account details: your phone number, your name, and, if you sign up on our website, your date of birth, which we use to confirm you are old enough to use Wayla.
• Sign-up answers: if you sign up on our website, your answers to the short questionnaire (such as your school, year, fields and what you want next) and, if you choose to add it, the summary you paste from ChatGPT, Claude or another AI about yourself. We pass these to the assistant, which keeps them and saves the career-related facts in them as notes, such as your studies, work, projects, goals and constraints, so it knows you from your first text. It leaves out details about your health, relationships, religion, politics or sexuality, and anything about other people.
• Account settings: the choices you make on your account page, such as your quiet hours, which apps Wayla may use and whether our team may review emails it drafts for you.
• Messages: the WhatsApp messages and texts you send us, our replies, and delivery details such as timestamps and whether a message was delivered.
• Things you tell us: short notes the assistant saves so it can help you later, such as your school, goals, experience, projects, skills, target companies, deadlines and interviews, plus your timezone, a short summary of how you like to text, and a career plan the assistant keeps with you (the role you are aiming for and your next milestones).
• Files and background you share: if you text us a PDF, such as your resume or a LinkedIn “Save to PDF” export, we keep its text. If you share your GitHub username, we store the username and read your public GitHub profile and repositories.
• Connected accounts: if you choose to connect an account such as Google, Notion or Slack, we store the access token that service gives us, along with basic details such as which service it is and when you connected it. Tokens are encrypted on our server.
• People you reach out to: when you reach out to someone with the assistant’s help, such as a professor, recruiter or alum, it keeps a short record of who they are, their organization, where things stand (for example sent, replied or meeting set), a follow-up date and short notes, so it can remind you and help you follow up. It also counts toward the reply counts described under “How we use it.”
• Emails the assistant writes for you: a copy of every email draft the assistant saves for you and every email it sends after you approve it, including the recipient, subject and message.
• Search profile: a short list of search terms, roles that fit you and things you said you don’t want, which the assistant builds from your saved notes so it can match you to postings, programs and labs.
• Working summary: a short private summary the assistant writes from your saved notes, plan, outreach, shared files and recent texts: what you’re aiming for, your strengths and gaps toward it, constraints you’ve mentioned and what you’ve tried. It rewrites the summary as it learns more and uses it only to tailor advice. Ask the assistant to show it to you, and tell it what’s wrong to have it corrected.
• Technical details: when you open a link to connect an account, our server logs your IP address and browser type for security. We also record how many AI requests the assistant made for you each day and what they cost, so we can keep the service running reliably. When you sign in on our website, we set one cookie that keeps you signed in, and we keep a record of the sign-in code we sent you until it expires. We do not use advertising or analytics cookies.

How we use it

We use your information only to run the assistant for you: replying to your messages, remembering context you shared, sending follow-ups you asked for or that relate to your search, and finding information in accounts you connected when it helps with a request.

When at least three students have reached out to the same person, such as a professor, the assistant may tell other students how many of those outreaches got a reply. It shares only those counts, never who reached out or what they wrote. If you delete your data, your outreach stops counting.

To write replies, your messages and relevant context are sent to an AI model provider. We only use providers that do not store your data or use it to train models.

Public information

To recommend people, labs, programs and roles, we use publicly available information about researchers, professionals, organizations and opportunities. We use it only to suggest who and what to look into, and we don’t sell it. We never send your messages or information about you to public data sources. If you want public information about yourself removed from what we use, email us.

Connected accounts

You choose whether to connect any account, and you can connect them one at a time. The assistant uses a connected account only when it helps with something you asked or a follow-up related to your search. Here is exactly what each connection lets the assistant do:

• Google: search and read your Gmail, save email drafts in your Gmail, send an email from your Gmail after you approve it, see your Google Calendar events, search your Google Drive, and read a Google Doc or PDF in your Drive after you say it’s ok, such as your resume. If you say it’s ok, it also reads a few emails you sent to learn how you write, so drafts sound like you.
• Notion: search and read the Notion pages you choose to share when you connect, and inside those pages, create new pages and databases (such as an application tracker), add and edit text, check off to-dos, and add or update database rows. It cannot see or change pages you did not share.
• Slack: search messages you can see in your Slack workspace, and send a Slack message as you after you approve it.

On your account page you can turn each app on or off. When an app is off, the assistant will not use it or offer to connect it, and it disconnects the app if it was connected. Gmail, Google Calendar and Google Drive share one Google sign-in, so if you turn off only some of them, the Google connection stays and the assistant does not use the ones you turned off.

The assistant never deletes anything in your connected accounts. It only creates or changes things in three ways: saving email drafts, sending emails or Slack messages you approve, and editing the Notion pages you shared when you ask it to or when it follows from something you asked (for example, keeping a tracker you asked it to maintain up to date). It tells you what it changed. It only sends an email after it shows you the exact recipient, subject and message, and only sends a Slack message after it shows you the exact message and the person or channel it goes to. You approve each one by text. It never sends an email or Slack message on its own.

• We do not copy your emails, events, files, pages or messages into our database. They are read at the moment they are needed and passed to the AI model to write a reply. There are two exceptions: we keep a copy of each email draft the assistant saves and each email it sends for you, and if you ask the assistant to use your resume or LinkedIn export from your Drive, we keep its text the same way we keep a resume you text us. And if you let the assistant learn how you write from emails you sent, we keep a short description of your writing style (such as your usual greeting, sign-off, length and tone), not the emails themselves.
• Our replies are saved with your conversation, so if a reply mentions something from a connected account, such as the time of an interview, that reply is saved. The assistant may also save a short note based on what it finds, the same way it saves things you tell it.
• We do not sell data from connected accounts or use it for advertising. We do not use it to evaluate, fine-tune, train or improve AI models, and we do not let any AI model provider use it for those purposes.
• People do not read data from your connected accounts, except with your permission (see “How we improve the assistant” below), for security reasons, or when required by law.

Wayla’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we improve the assistant

Our team reviews conversations to fix problems and make the assistant more helpful. We use AI tools, including Claude by Anthropic, to help with these reviews.

• Before a review, we hide every reply that used information from your connected accounts, so reviewers do not see it.
• Emails the assistant writes for you are reviewed only if you say yes. The assistant asks you once, the first time it writes an email for you. You can change your answer at any time on your account page or by texting the assistant.
• Reviews are used only to improve Wayla. They are never used to train AI models.

Who we share it with

We do not sell your information. We share it only with service providers that help us run the assistant:

• WhatsApp, run by Meta, to send and receive WhatsApp messages. WhatsApp’s own terms and privacy policy apply to your use of WhatsApp.
• Sendblue, to send and receive text messages. Sendblue keeps its own copy of messages under its own privacy policy.
• Cloudflare, which runs our website and stores the details you give when you sign up on it.
• OpenRouter and the model hosts it routes to, to generate replies, limited to hosts that do not store or train on your data.
• DigitalOcean, which hosts our servers and database.
• GitHub, when you share your username, so we can read your public profile.
• Anthropic, whose AI tools our team uses to review conversations as described above, under settings that do not allow Anthropic to train models on them.
• The services you connect, such as Google, Notion or Slack, when the assistant reads from them for you, or when it saves a draft or sends an email or Slack message you approved. A Slack message you approve is visible to the people in that conversation or channel, like any message you send.

Other students never see your information, only the reply counts described above. We may also share information if required by law. We do not sell your personal information or share it for advertising. Our servers are in the United States.

How long we keep it

We keep your account details, sign-up answers, account settings, messages, saved notes, search profile, working summary, usage records, files you shared, outreach records, your writing style description and copies of emails the assistant wrote for you while you use the assistant. Backups are kept for 3 days. If you ask us to delete your data, we delete it from our systems, and it ages out of backups within 3 days. We keep only your phone number as an empty contact record, so that STOP keeps working and we do not text you by mistake.

Your choices

• Text STOP at any time to stop all messages. Text START to turn them back on.
• On your account page, set quiet hours when Wayla won’t text you first, turn connected apps on or off, change whether our team may review emails it drafts, or delete your account.
• Ask the assistant to disconnect any connected account at any time. You can also remove access from the service itself, such as your Google account permissions. Deleting your data also removes every connection.
• Ask the assistant what it knows about you at any time. Ask it to delete your data, or delete your account on your account page, and after you confirm, it deletes your messages, saved notes, search profile, working summary, usage records, files you shared, outreach records, copies of emails it wrote, your sign-up answers and connected accounts right away.

You have the right to know what personal information we have about you, to correct it, and to delete it. California residents have these rights under the California Consumer Privacy Act, and we honor them for everyone. We respond to requests within 45 days.

Message frequency varies. Message and data rates may apply.

Security

Data is encrypted in transit, account tokens are encrypted at rest, WhatsApp sign-in codes are stored only in scrambled form, and access to our servers is restricted.

Children

Wayla is not meant for anyone under 16, and we do not knowingly collect information from them. If you believe someone under 16 is using Wayla, email us and we will delete their data.

Changes

If we change this policy in a meaningful way, we will update this page and let you know by message.

Contact

Wayla is operated by Tinkly LLC. For privacy questions or requests, email hello@heywayla.com or text the number you use with Wayla.