Privacy Policy

Effective: TODO: DD Month YYYY · Version 0.1-draft

1. Who this policy covers

This Privacy Policy explains how vyaparlekha ("WA Suite", "we", "us", "our") collects, uses, shares, and protects personal data in connection with WA Suite (the "Service"), available at https://whatsapp.autoinning.com. It applies both to you as a registered account holder or teammate ("Account Data") and, separately, to the phone numbers and names you upload as contacts to message through the Service ("Contact Data") — see §3 for why we treat these differently.

2. Account Data we collect

• At signup: business/company name, your mobile number, email address, username, and password (stored as a salted hash, never in plain text).
• As you use the Service: templates, campaigns, chatbot flows, canned replies, and internal notes you create; team member details you add; support/billing correspondence.
• Billing: your chosen plan, billing cycle, and invoice history. Payments are processed by Razorpay — we do not collect or store your card, UPI, or bank details ourselves; see §5.
• Technical: IP address and basic request metadata (used for login/session security and rate-limiting against abuse), and a session cookie required to keep you logged in.

3. Contact Data — your customers' data, not ours

When you upload a contact list or a WhatsApp conversation happens through the Service, we process the phone numbers, names, message content, tags, and any custom fields you've defined, on your behalf and under your instructions. For this Contact Data, WA Suite acts as a data processor and you (the account holder) act as the data controller — you're responsible for having lawful consent from your contacts before messaging them (see §7 of our Terms of Service), and for handling any request from one of your contacts to access, correct, or delete their data.

4. How we use Account Data

• To create and operate your account, authenticate logins, and enforce plan limits.
• To send transactional email — welcome messages, OTP verification, password resets, and payment/invoice receipts.
• To process payments and generate GST invoices for paid plans.
• To detect and prevent abuse (e.g. rate-limiting repeated login/signup attempts).
• To respond to support requests and, where required, resolve billing or account disputes.
• To comply with legal obligations, including tax/invoicing records and the IT Rules 2021 grievance process.

5. Who we share data with

We don't sell personal data. We share only what's needed with the following categories of service providers, each processing data under their own terms:

• WhatsApp Business Solution Provider (currently Gupshup): your Contact Data's phone numbers, names, and message content, solely to deliver and receive WhatsApp messages on your behalf.
• Razorpay: billing details needed to process a payment (name, email, amount) — Razorpay collects your card/UPI/bank details directly and we never see or store them.
• Email delivery (SMTP provider): your email address and message content, solely to send transactional email.
• Hosting/infrastructure providers: whatever's needed to run the Service, under standard hosting agreements.
• Legal/regulatory: where required by law, court order, or a valid request from a government authority.

6. Data retention

We retain Account Data for as long as your account is active, and for a reasonable period after closure to comply with tax/accounting record-keeping obligations and resolve any outstanding disputes. Contact Data is retained until you delete it, opt a contact out, or close your account, after which it's deleted or anonymised within a reasonable period — except where we're required to retain transactional records (e.g. message logs relevant to a billing dispute) for longer.

7. Your rights

Subject to India's Digital Personal Data Protection Act, 2023 and other applicable law, you may request access to, correction of, or erasure of your Account Data, and may withdraw consent for optional processing at any time (this may limit or end your ability to use the Service). To exercise these rights, contact us using the details in §10. If your request concerns Contact Data — i.e. you're one of our customers' contacts, not an account holder — please contact that business directly; we act only as their processor and will assist them in fulfilling a valid request.

8. Data security

Passwords are stored as salted hashes, not plain text. Access to production data is limited to what's needed to operate the Service. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

9. Cookies

We use a single essential session cookie to keep you logged in — it's required for the Service to function and isn't used for advertising or cross-site tracking. We don't currently use third-party analytics or advertising cookies.

10. Grievance Officer & contact

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and for data-protection queries under the Digital Personal Data Protection Act, 2023, contact:

TODO: Grievance Officer Name
vyaparlekha
Pune, Maharastra, India
Email: TODO: grievance@yourdomain.com

11. Children's data

The Service is intended for use by businesses and their authorised staff, not by children. We don't knowingly collect personal data from individuals under 18 as account holders.

12. International data transfer

Our service providers are primarily based in India. Where any processing occurs outside India, we take reasonable steps to ensure it's subject to appropriate safeguards consistent with applicable law.

13. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Effective" date above and, for material changes, make reasonable efforts to notify account owners by email or in-app notice before the change takes effect.