1. Scope of This Policy

This Privacy Policy applies to personal data processed by Waprexo ("we", "us" or "our") when you visit our website, create an account, or use our WhatsApp Business API platform and related services (the "Service"). It is published in accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, as applicable.

By using the Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Information you provide

• Account details: name, email address, phone number, business name, password (stored in encrypted form) and two-factor authentication settings.
• WhatsApp Business details: your WhatsApp Business Account ID, phone number ID, business profile and access tokens needed to connect to Meta's Cloud API.
• Billing details: plan, invoices, wallet recharges and transaction references. Card and UPI details are handled by our payment gateway; we do not store your full card number or CVV.
• Communications: messages you send us through the contact form, email, WhatsApp or support tickets.

Information collected automatically

• Usage and device data: IP address, browser type, device information, pages visited and actions taken in the dashboard.
• Login history: sign-in times, IP addresses and devices, used to keep your account secure.
• Cookies: as described in the Cookies section below.

3. How We Use Information

• To create and manage your account and provide the Service.
• To connect to Meta's WhatsApp Cloud API and send, receive and display messages on your behalf.
• To process payments, maintain your wallet balance and issue invoices.
• To provide customer support and respond to your enquiries.
• To send service-related notices such as security alerts, low wallet balance and policy updates.
• To monitor, secure and improve the Service, and to detect and prevent fraud, spam and abuse.
• To comply with legal obligations and enforce our Terms & Conditions.

We do not sell your personal data.

4. Your Customers' Data

When you use the Service, you may upload or receive personal data about your own customers, such as names, phone numbers, message content, tags and custom fields ("Customer Data"). For Customer Data, you are the data fiduciary (controller) and Waprexo acts as a data processor on your instructions. You are responsible for having a lawful basis and valid opt-in consent to message these individuals, and for responding to their requests. We process Customer Data only to provide the Service to you.

5. Sharing & Disclosure

We share information only as needed to run the Service:

• Meta Platforms, Inc. / WhatsApp: message content, phone numbers and related data are transmitted through Meta's WhatsApp Business Platform. Meta's handling of that data is governed by its own terms and privacy policy.
• Service providers: hosting, email delivery, payment gateways and analytics providers who process data on our behalf under confidentiality obligations.
• Legal requirements: where required by law, court order or a government authority, or to protect the rights, property or safety of Waprexo, our users or the public.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.

6. Cookies

We use essential cookies to keep you signed in, protect forms against misuse (CSRF protection) and remember your preferences. We may also use basic analytics to understand how our website is used. You can block or delete cookies in your browser settings, but parts of the Service such as login may not work without essential cookies.

7. Data Security

We use reasonable technical and organisational safeguards to protect personal data, including encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, role-based access for team members and login history monitoring. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please keep your password confidential and enable two-factor authentication.

8. Data Retention

We keep personal data for as long as your account is active or as needed to provide the Service. After account closure, we delete or anonymise personal data within a reasonable period, except where we must retain certain records (such as invoices and transaction records) to meet legal, tax or accounting requirements, or to resolve disputes.

9. Your Rights

Subject to applicable law, you may:

• access and obtain a summary of the personal data we hold about you;
• correct, complete or update inaccurate personal data;
• request erasure of your personal data, subject to legal retention requirements;
• withdraw consent you have given, without affecting processing already carried out;
• nominate another person to exercise your rights in case of death or incapacity;
• raise a grievance with us, and if unresolved, with the Data Protection Board of India.

You can update most account information from your dashboard. For other requests, contact our Grievance Officer below. We may need to verify your identity before acting on a request.

10. Children's Privacy

The Service is intended for businesses and is not directed to anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

11. Grievance Officer

If you have any questions, concerns or complaints about this policy or how we handle your data, please contact our Grievance Officer:

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or through the dashboard.