Privacy Policy

1. Information we collect

We collect information in a few different ways:

• Account information. When you register, we collect your business name, email address, and password (stored as a one-way hash, never in plain text).
• WhatsApp connection data. When you connect a WhatsApp Business number, we store the access credentials Meta issues for that number (encrypted at rest) so the Service can send and receive messages on your behalf.
• Conversation data. Messages sent and received through a connected number — including any information your customers share with your bot — are stored so you can view your Inbox, build flows around past answers, and so your AI Assistant (if enabled) can reference them.
• Payment information. Subscription payments are processed by Razorpay. We receive confirmation that a payment succeeded and basic transaction metadata (amount, plan, date) — we never see or store your card or bank details directly.
• Usage data. Standard technical logs (IP address, browser type, pages visited, timestamps) collected automatically to keep the Service secure and working.

2. How we use this information

• To operate the Service — deliver messages, run your bot flows, keep your Inbox in sync.
• To process payments and manage your subscription.
• To respond when you contact support.
• To detect, prevent, and investigate abuse, fraud, or security issues.
• To send you service-related email (billing receipts, renewal notices, account activity) — never marketing email without your consent.

3. AI processing

If you enable an AI Assistant step in a bot, the relevant parts of a customer's message — and any business data you've connected for it to reference — are sent to our AI provider (currently Google Gemini) to generate a reply. This happens per-message, in real time; it is not used to train the AI provider's general models beyond whatever that provider's own standard API terms specify.

4. Who we share information with

We don't sell your data. We share it only with the services that make the Service work:

• Meta / WhatsApp Business Platform — to send and receive messages on your connected number.
• Razorpay — to process subscription payments.
• Google (Gemini API) — to power the AI Assistant feature, when you use it.
• Our email provider — to deliver transactional email (receipts, password resets, support replies).
• Law enforcement or regulators, only when legally required to.

5. Data security

Sensitive credentials (like WhatsApp access tokens) are encrypted at rest. Every tenant's data is isolated from every other tenant's — no business can see another business's conversations, contacts, or account details. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.

6. Data retention

We keep account and conversation data for as long as your account is active, and for a reasonable period after cancellation in case you reactivate or need an export. You can request deletion of your account and associated data at any time (see "Your rights" below).

7. Your rights

You can request access to, correction of, or deletion of your personal data by contacting us (see below). If you're a customer messaging a business that uses wabot, requests about your own data should generally go to that business first, since they control the conversation — we'll assist them in fulfilling it.

8. Children's privacy

The Service is intended for businesses and is not directed at children under 18.

9. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify account owners by email.

10. Contact us

Questions about this policy or your data can be sent through our Contact section.

[Legal entity name], [registered business address] — to be completed with the business's actual registered details.