Privacy Policy

1. Scope & Categorization of Roles

Under international privacy frameworks, Watsabble operates in two distinct legal capacities:

• Watsabble as a Data Controller: When you register for an account, subscribe to a plan, or contact our team, we collect your direct identity, email, company details, and billing records to administer your contract.
• Watsabble as a Data Processor (Service Provider): When you upload customer phone numbers, contacts, CRM data, or conduct messaging over WhatsApp, you (the Tenant) remain the Data Controller. Watsabble processes this data strictly on your behalf and in accordance with your documented instructions and our Data Processing Addendum (DPA).

2. Categories of Information We Collect

A. Information You Provide to Us

• Account & Identity: Name, business email, organization name, phone number, and encrypted password credentials.
• WhatsApp Integration Tokens: Meta WABA ID, Phone Number ID, and System User Tokens required to route API calls.
• Billing & Transactional: Tax identification (GST/VAT), billing address, and transaction histories. Note: Sensitive card details are processed directly by our PCI-DSS certified gateway (Razorpay) and are never stored on our application servers.

B. Information Processed on Your Behalf (Tenant Data)

• End-customer phone numbers, WhatsApp display names, conversation transcripts, interactive flow form submissions, order records, and contact custom attributes.

C. Technical & Telemetry Data

• IP addresses, browser type, geographic region (derived from headers such as Cloudflare CF-IPCountry), access timestamps, and error diagnostics.

3. Legal Bases for Processing (GDPR Article 6)

For individuals situated in the European Economic Area (EEA) and the United Kingdom, we process personal data under the following lawful bases:

• Performance of a Contract (Art. 6(1)(b)): To provision your multi-tenant workspace, connect your WhatsApp channels, dispatch automated flows, and execute order checkouts.
• Compliance with Legal Obligations (Art. 6(1)(c)): To maintain tax, accounting, and anti-fraud financial audit trails.
• Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure integrity, prevent brute-force attacks, mitigate platform abuse, and deliver critical feature updates.
• Consent (Art. 6(1)(a)): For non-essential performance telemetry or opt-in marketing newsletters.

4. Sub-Processors & International Data Transfers

Watsabble utilizes carefully vetted third-party sub-processors to deliver mission-critical components:

For cross-border transfers originating from the EEA to jurisdictions without an adequacy decision, transfers are protected under the European Commission's approved Standard Contractual Clauses (SCCs).

5. Your Data Rights (GDPR, CCPA & DPDPA)

Regardless of your geography, Watsabble honors universal data subject rights:

• Right of Access & Portability: You may request an export of all personal data held in machine-readable JSON format.
• Right to Rectification: You may correct inaccurate or incomplete profile records at any time.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and associated tenant records, subject to statutory tax retention periods.
• Right to Restrict or Object: You may object to data processing grounded on legitimate interests or revoke marketing consents.
• CCPA "Do Not Sell or Share My Information": Watsabble does not sell or share personal information for cross-context behavioral advertising. We have never sold consumer data and will never do so.

6. Security Safeguards & Data Retention

We implement industry-grade technical and organizational defense mechanisms:

• Encryption: All data in transit is encrypted using TLS 1.3. Database records and backups are encrypted at rest using AES-256.
• Tenant Isolation: Strict architectural tenancy scopes prevent cross-workspace data bleed or query contamination.
• Retention Policy: Account data is retained for the active lifecycle of your workspace. Upon tenant termination, workspace records are marked for purge and permanently scrubbed within 30 days.

7. Data Protection Officer (DPO) & Grievance Redressal

In compliance with GDPR Article 37 and Section 12 of the India Digital Personal Data Protection Act (DPDPA 2023), our designated Data Protection & Grievance Officer can be contacted directly at: