Privacy Policy

Account Information: When you sign up for Wappora, we collect:

• Full name and email address
• Business name and business type
• Phone number (including WhatsApp Business number)
• Password (stored as a bcrypt hash — we never store plain text)
• Billing address and payment information (processed via our payment gateway, not stored on our servers)

WhatsApp Business Account Data: When you connect via Meta Embedded Signup:

• WhatsApp Business Account ID (WABA ID)
• Phone Number ID
• Meta access tokens (stored encrypted)
• Business display name and profile information

Customer & Conversation Data:

• Customer contact information (names, phone numbers) you import or that are captured through WhatsApp interactions
• WhatsApp conversation messages processed through the Meta Cloud API
• Campaign performance metrics (delivery, read, click rates)
• Chatbot interaction logs for AI quality improvement

Technical Data:

• IP address, browser type, and device information
• Usage logs, feature access patterns, and session data
• Error logs and diagnostic information

We use your data exclusively to provide, maintain, and improve the Wappora platform:

• Service Delivery: Powering your AI chatbot, managing campaigns, and processing WhatsApp messages through the Meta API
• AI & Knowledge Base: Processing documents you upload (PDF, Word, Excel) to build your business-specific AI knowledge base using RAG
• Account Management: Sending account-related emails, managing your subscription, and providing customer support
• Analytics: Generating performance reports visible only to you
• Platform Improvement: Aggregated, anonymized usage data to improve features (never linked to individual businesses)
• Legal & Security: Fraud prevention, abuse detection, and legal compliance

Wappora is an official Meta Business Solution Provider (BSP). All integrations use the Meta WhatsApp Business Cloud API.

• You connect your WhatsApp Business number via Meta's Embedded Signup — no QR code scanning, no WhatsApp Web access
• Messages pass through Meta's infrastructure before reaching our platform
• Meta acts as a data processor for message transit — refer to Meta's Privacy Policy for their practices
• Customer messages are temporarily stored on our servers to enable AI processing and agent handoff
• Access tokens are stored encrypted using AES-256 and rotated per Meta's requirements

• Multi-Tenant Isolation: Every business's data is logically isolated — no business can access another's data
• Encryption at Rest: Sensitive fields encrypted using AES-256 before storage
• Encryption in Transit: All data transmitted using TLS 1.3
• Access Controls: Role-based access control (RBAC) ensures only authorized team members access specific data
• Infrastructure Security: Servers hosted on ISO 27001-certified cloud infrastructure with regular security audits
• Backups: Automated encrypted backups with point-in-time recovery

In the event of a security incident affecting your data, we will notify you within 72 hours.

We never sell your data. We share data with third parties only in these limited circumstances:

• Meta / WhatsApp: Required for API operations — message delivery, template management, and WABA administration
• AI Model Providers: Conversation context sent to AI inference APIs. We use DPAs and no data is used to train general models
• Payment Processors: Billing handled by PCI-DSS compliant gateways (e.g., Razorpay). We do not store card details
• Infrastructure Providers: Cloud hosting providers acting as data processors under contractual obligations
• Legal Requirements: If required by law, court order, or to protect user safety

• Essential Cookies: Session management and authentication — cannot be disabled
• CSRF Tokens: Security cookies protecting against cross-site request forgery
• Preference Cookies: Storing UI preferences (theme, language, dashboard layout)

We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking. See our full Cookie Policy.

Under India's Digital Personal Data Protection Act (DPDPA) 2023 and other applicable regulations, you have:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your account and associated data
• Right to Portability: Receive your data in a machine-readable format
• Right to Withdraw Consent: Withdraw consent for non-essential data processing
• Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer

To exercise these rights, email privacy@wappora.com. We will respond within 30 days.

• Account Data: Retained for the duration of your subscription plus 90 days after cancellation
• Conversation Logs: Retained for 12 months by default; configurable per plan
• Billing Records: Retained for 7 years as required by Indian tax law
• Uploaded Documents: Deleted immediately upon request or within 30 days of account termination
• Anonymized Analytics: May be retained indefinitely as aggregated, non-identifiable data

Upon account deletion, we will purge all personal data within 30 days, except where legal retention obligations apply.

Wappora is a business platform intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware a minor has created an account, we will immediately suspend and delete the account and associated data. Contact privacy@wappora.com if you believe a minor is using our platform.

Wappora is incorporated and operated in India. We comply with:

• Digital Personal Data Protection Act (DPDPA), 2023
• Information Technology Act, 2000 and IT (Amendment) Act, 2008
• IT (Reasonable Security Practices and Procedures and SPDI) Rules, 2011
• Telecom Commercial Communications Customer Preference Regulations (TCCCPR)
• Meta's WhatsApp Business Policy and Meta Platform Terms

Our Data Protection Officer can be reached at dpo@wappora.com.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered account holders
• Display a notice in your Wappora dashboard for 30 days

Your continued use of the platform after changes take effect constitutes your acceptance of the updated policy.

For any privacy-related questions, requests, or concerns:

We aim to respond to all privacy requests within 30 calendar days.