Privacy Policy

Two kinds of data, two roles

Account data: information about you and your team (names, emails, phone numbers, billing details, usage). For this data we decide why and how it is processed, so we are the data fiduciary (controller).

Customer data: the contacts, messages and templates you upload or send through the platform. You decide whom to message and why, so you are the data fiduciary and we process it only on your instructions, as your data processor.

Information we collect

We collect only what we need to run the service:

• Account and profile: name, email address, phone number, organization name, password (stored only as a one-way hash).
• Billing: billing name, address and GSTIN you provide, plan and payment history. Card and UPI details are handled by our payment gateway; we never see or store them.
• WhatsApp connection: your WhatsApp Business Account and phone number IDs, and an access token, stored encrypted.
• Customer data you upload: contact names, phone numbers, custom fields, opt-in status, message templates, campaign and inbox messages, and delivery/read receipts from WhatsApp.
• Usage and device data: log-in times, IP address, browser type and actions in the app, used for security and to improve the product.

How we use it

To create and secure your account, deliver your messages through the WhatsApp Business Platform, process payments and issue invoices, send service emails (verification, password reset, receipts, alerts), provide support, prevent abuse and fraud, and meet legal obligations such as tax record-keeping.

We do not sell personal data, and we do not use your customer data to advertise to anyone or to train models.

Who we share it with

We share data only with service providers that help us run the platform, under contracts that require them to protect it:

• Meta Platforms (WhatsApp Business Platform): to send and receive your WhatsApp messages.
• Cashfree Payments: to process payments and AutoPay mandates.
• MongoDB Atlas and Amazon Web Services: database and application hosting.
• Cloudinary: storage of images and media you upload for templates.
• Google (Gmail SMTP): sending transactional emails such as verification and receipts.

Your responsibilities for customer data

You must have a lawful basis, and where required valid consent, to message every contact you upload, and you must honour opt-outs. Contacts who reply STOP are automatically unsubscribed from your campaigns.

If one of your contacts asks us about their data, we will refer them to you and help you respond.

How long we keep data

We keep your data while your account is active. If you delete your account, it is locked immediately and all account and customer data is permanently erased 30 days later. Payment records and invoices are kept for 8 years because Indian tax law requires it.

Security

Data is encrypted in transit (HTTPS) and WhatsApp access tokens are encrypted at rest. Passwords are hashed, accounts lock after repeated failed sign-ins, and access to production systems is restricted to authorized staff.

Your rights

You can access and correct your information in the app, download a full export of your workspace (Settings → Data & privacy → Export data), and delete your account (Settings → Data & privacy → Delete account). You can also withdraw consent, nominate another person to exercise your rights, and raise a grievance with us. Unresolved grievances may be escalated to the Data Protection Board of India.

Grievance officer & contact

Grievance officer: Smit Vaghasiya, Wapnexa, Bhimjipura, Nava Vadaj, Ahmedabad, Gujarat 380013, India. Email: smit@wapnexa.in. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

Changes to this policy

If we make material changes we will notify account owners by email before they take effect.