Privacy Policy

This policy explains how WBChatFlow ("we", "us") handles personal data when a business ("you", "your workspace") uses our shared WhatsApp inbox platform, and when your customers message your WhatsApp Business number through it.

Two kinds of people's data pass through the platform: yours and your team's (as the business using our service), and your customers' (the people who message your WhatsApp number). For your customers' data, we act as a processor on your instructions - you remain responsible for it as described in section 4.

Account data - from you and anyone you invite to your workspace: name, email address, a bcrypt-hashed password (we never store or can see your plain-text password), and role (admin or agent).

Your customers' data - collected on your behalf when someone messages your connected WhatsApp number: their phone number, WhatsApp profile name, the content of messages they send and receive, and, where they arrived via a Click-to-WhatsApp ad or post, which ad or post referred them. We also derive a lead status (e.g. new, replied) from this activity to power your dashboard.

What we don't collect - we do not run advertising or analytics trackers on this site, and we do not collect data about you or your customers beyond what is needed to operate the service described here.

• To route and display conversations in your shared inbox.
• To generate automatic replies - either keyword-matched (Normal plan) or AI-generated from your knowledge base (Advance plan, see section 5).
• To send messages you or your team authorize to your customers.
• To track where a lead came from and how far along it is, for your dashboard.
• To authenticate you and keep your account secure.
• To comply with our legal obligations.

You are the data controller (data fiduciary) for your own customers' personal data. That means it is your responsibility - not ours - to have a lawful basis and, where WhatsApp requires it, opt-in consent before messaging someone. WhatsApp's Business Messaging Policy requires this independently of this platform, and messaging without consent can get your number restricted by Meta.

We process your customers' data only as needed to provide the service to you, under your instructions.

On plans with the AI assistant enabled, the text of an inbound message is sent to our AI infrastructure provider, Groq, to generate a reply grounded in the knowledge base you provide. Groq processes that message text under its own privacy terms in order to return a response to us. Message text is not sent to Groq for workspaces on the keyword-only (Normal) plan.

We share personal data only with the following categories of service providers, and only as needed to run the platform:

• Meta / WhatsApp - every message is sent and received through the official WhatsApp Business Platform (Cloud API); this is required for the service to function at all.
• Groq - processes message text to generate AI replies, only for workspaces with the AI assistant enabled (see section 5).
• Supabase - stores workspace data in its managed PostgreSQL service.

We do not sell personal data, and we do not share it for third-party advertising.

• Passwords are hashed with bcrypt and never stored in plain text.
• Sessions are authenticated with signed, expiring tokens (JWT).
• Inbound WhatsApp webhooks are cryptographically verified against Meta's signature, so only genuine WhatsApp traffic is accepted.
• Data is transmitted over encrypted (HTTPS) connections.
• Every workspace's data is logically separated from every other workspace's.

We retain your workspace's data for as long as your account is active, so your team can see conversation history. You can request deletion or an export of your data at any time by writing to wbchatflow@gmail.com; we will act on that request within the timeframe required by applicable law.

If you are a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:

• request a summary of the personal data we process about you;
• request correction or erasure of that data;
• withdraw consent, where our processing relies on it;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• lodge a grievance with our Grievance Officer, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact our Grievance Officer at wbchatflow@gmail.com.

Some of the service providers listed in section 6 may store or process data outside India. Where that happens, we rely on the safeguards required under applicable data protection law and each provider's own contractual commitments.

We don't use advertising or analytics cookies. The app stores your session token in your browser's local storage solely to keep you signed in - it isn't shared with anyone else or used to track you across other sites.

This service is intended for use by businesses and is not directed at individuals under 18. You must not use the platform to knowingly collect or process personal data from anyone under 18 without the consent required by applicable law.

We may update this policy from time to time. We'll update the date at the top of this page, and for material changes, we'll notify workspace admins directly.

Questions about this policy, or requests relating to your data, can be sent to wbchatflow@gmail.com. For DPDP Act grievances specifically, contact the WBChatFlow privacy team at wbchatflow@gmail.com.