Privacy Policy

From Customers: account email, name, organization name, billing address, GSTIN (if provided), Razorpay / Stripe customer IDs, and dashboard usage telemetry.

From End Users (via the Customer's WhatsApp Business Account): phone number in E.164 format, display name (as reported by WhatsApp), inbound and outbound message content and metadata, opt-in / opt-out audit rows, and (where the Customer configures it) contact tags + custom attributes uploaded by the Customer.

Automatically: IP address, user-agent, session identifiers, and interaction analytics — used only for security, abuse prevention, and product improvement.

We process Customer data to operate, maintain, and improve the Service — including provisioning your WhatsApp Business Account, routing messages between you and your End Users, billing, and producing dashboard analytics. We do not sell Customer or End User data, and we do not use End User message content to train machine-learning models.

AI features (reply suggestions, knowledge bot, template spam-check) send the relevant conversation excerpt or template draft to our AI sub-processor (currently Anthropic PBC, US). Excerpts are not retained by the sub-processor and are not used to train their models under our zero-retention API agreement.

For Customers, processing is based on contract (the Terms of Service) and legitimate interest in operating the Service. For End Users, processing is based on the consent they gave to the Customer (captured by the Customer's opt-in flow) and the contract between the Customer and the End User (where applicable).

Customers are the data fiduciary / controller for their End Users under DPDP / GDPR. Waxiomatic is the data processor.

Production data is stored in our Mumbai (ap-south) region on PostgreSQL with row-level security enforcing strict per-organization isolation. Media uploads (template attachments, knowledge-base PDFs) are stored on MinIO by default, with optional customer-managed multi-cloud S3 (AWS S3 / Cloudflare R2 / Backblaze B2 / Wasabi / DigitalOcean Spaces / Linode / IDrive / Storj) per Customer choice.

Backups are encrypted at rest and replicated to Backblaze B2 (US-West) for disaster recovery. Backups are retained for 30 days and then permanently deleted.

Customer account data: kept for the duration of the subscription plus 30 days after cancellation (export window), then permanently deleted.

End User contacts & messages: retained as long as the Customer maintains them. The Customer can delete a contact at any time; deletions cascade to the consent audit trail (which we preserve in immutable archive for 7 years for regulatory purposes, as required by DPDP § 8).

Webhook + impression logs: 30 days, then aggregated and deleted.

Audit logs (security events): 1 year.

We use a small set of trusted sub-processors:

• Meta Platforms, Inc. — WhatsApp Business Cloud API delivery (Ireland)
• Anthropic PBC — AI inference for copilot / knowledge bot / spam check (USA, zero-retention agreement)
• Razorpay Software Pvt Ltd — INR payments (India)
• Stripe, Inc. — USD payments (USA)
• Hetzner Online GmbH — primary VPS hosting (chosen Mumbai-adjacent region)
• Cloudflare, Inc. — DNS, CDN, DDoS protection
• Backblaze, Inc. — encrypted backup storage (USA)

We will notify Customers at least 30 days in advance of any new sub-processor and provide an opportunity to object.

Under DPDP / GDPR, you have the right to access, correct, and delete the personal data we hold about you. To exercise these rights:

• Customers: visit your dashboard at /dashboard/settings, or email [email protected].
• End Users: contact the Customer (business) you interacted with — they hold your contact record. If the Customer is unresponsive, contact our Grievance Officer for escalation.

We respond to verified requests within 30 days, as required by DPDP § 11.

We follow industry-standard security practices: TLS 1.3 in transit, AES-256 at rest, short-lived API tokens, scoped API keys, immutable audit logging, principle of least privilege on staff access. Webhook signing uses HMAC-SHA256. Stored credentials (WhatsApp access tokens, integration secrets) are encrypted at rest using libsodium sealed boxes with per-organization key derivation.

We undergo a third-party penetration test annually (results available on request under NDA) and are in the SOC 2 Type I readiness phase.

We rely on Standard Contractual Clauses (SCCs) for transfers from the EU/UK to our US sub-processors. For DPDP-covered data, transfers outside India occur only to sub-processors with adequate safeguards as listed in §6.

We use first-party cookies for authentication (BetterAuth session cookies). Analytics cookies are off by default and only set after explicit consent via the cookie banner. We use Plausible (self-hosted) for privacy-preserving site analytics, optionally Google Analytics 4 if the Customer has provided their own GA4 ID and consent is granted.

The Service is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us data through a Customer's WhatsApp interaction, contact the Customer or our Grievance Officer.

We may update this policy. Material changes will be notified via email to Customers at least 30 days in advance. The current version is always at this URL with the “Last updated” date in the header.

For privacy questions, email [email protected]. For grievance escalation under DPDP / IT Rules 2011, see the Grievance Officer page.