Privacy Policy | Wachatr

Information We Collect

When you use Wachatr, we may collect the following types of information to deliver our services:

Business account information — your name, email address, password hash, and company details.
Customer contact data — phone numbers, names, email addresses, and metadata of your business contacts.
Communication data — content of chat messages, media, notes, and comments sent and received through the platform.
Connected store data — order status, inventory details, and customer names synced from integration partners (e.g., Shopify, WooCommerce).
Billing & transaction data — billing name, address, GST details, transaction references, and subscription logs. Note: credit card details are processed directly by our secure payment partners and are not stored on our servers.
Appointment payment data — when a business collects payment for bookings, we store the booking details, the amount and currency, the payment status, refund status, and the reference IDs issued by the business's payment gateway. We never receive or store card numbers, CVV, UPI IDs or bank account details; these fields are removed from gateway notifications before they are saved.
Technical data — IP addresses, device identifiers (the push-notification token of your device), browser types, app crash logs, and websocket logs. We do not collect advertising identifiers.

How We Use Data

The information we collect is used to:

Deliver, configure, and operate the Wachatr platform services.
Enable real-time message routing via WhatsApp Business API (Meta Graph API) and other connected channels.
Provide AI-powered message analysis and intelligent auto-replies (via OpenRouter and OpenAI), when a business switches these on.
Process subscriptions and billing transactions.
Deliver real-time push alerts and live chat list updates.
Improve system security, performance, and stability.

Data Ownership

Your data belongs to you:

Businesses retain full ownership and control of their customer databases and communications.
Wachatr does not sell, rent, trade, or monetize customer data to third parties.

WhatsApp Coexistence & Address Book Sync

For accounts utilizing WhatsApp Coexistence Mode:

Manual Request Only — Contact address book and chat history sync is only initiated via explicit user action and consent. We never perform automatic background syncing of your mobile device's address book.
No Reuse or Monetization — Any contact details or message history imported through coexistence is owned entirely by your business. We do not reuse, analyze, copy, or share this data outside of your organization for any purpose.

Mobile Application Disclosures

For users accessing the Wachatr mobile application (available on iOS and Android):

Phone Contacts — The mobile app reads your phone's address book only when you tap "Import from my phone's contacts" and allow access. It shows your contacts on your phone so you can pick who to import; only the contacts you pick (name, phone number and email) are uploaded to your business's contact list on Wachatr. Nothing is read or uploaded in the background. Before importing, you confirm the people agreed to receive messages from your business.
Required Device Permissions — The mobile app requests standard device permissions strictly necessary to deliver notifications (new message push alerts), access the camera or photo library (for chat media attachments), and read/write storage (to cache messages and assets locally). We do not collect or store this data outside of the chat messages you send.
Technical Logging — We collect basic hardware details, app crash logs, and websocket connectivity events to ensure app performance and stability. The app contains no advertising or analytics SDKs and does not collect advertising identifiers.

Payments Collected by Businesses

Businesses on Wachatr can ask their customers to pay when booking an appointment. For these payments:

The business is the merchant — payment goes directly into the business's own Razorpay or Cashfree account. Wachatr does not receive, hold or transfer the money, and the gateway's fees are charged to the business by the gateway.
The business controls its customers' data — Wachatr processes booking and payment records on the business's behalf, only to confirm bookings, send reminders, handle refunds and reconcile payments.
Gateway credentials — the API keys a business connects are encrypted at rest and used only to create orders, verify payments and issue refunds for that business.
Retention — payment records are kept while the business's account is active, because refunds, disputes and accounting depend on them, and are deleted with the account. The payment gateway keeps its own records under its own privacy policy.

Lead Forms, Automations and Messages Sent for Businesses

Businesses use Wachatr to reply to people who contact them and to run automations. For this data the business decides why and how it is used (it is the data fiduciary / controller); Wachatr processes it on the business's behalf.

Lead forms — when a business connects Facebook Lead Ads, the answers a person submits on that business's form are delivered to us by Meta and saved in the business's contact list. If the business has switched it on, the person then receives a WhatsApp message, an email and/or an SMS from that business about their enquiry. The business is responsible for telling people, on its form, that it will contact them.
Unsubscribing — every follow-up email sent from a lead form carries an unsubscribe link; once used, that business sends that address no more follow-up emails. Text messages are sent through the business's own SMS provider and must follow telecom rules (in India, TRAI's DLT registration of sender IDs and templates).
Automation run history — when a business's automation (a "flow") runs, we record which steps ran, whether each succeeded, and any error, so the business can see what happened and fix problems. This history is kept for 30 days.
Data received by automations — when another system sends data to a business's automation (a "webhook"), we keep that data encrypted so it can be processed again if a step fails, or processed later if the automation was switched off when it arrived. It is deleted 7 days after it has been processed, or after 30 days if it never is, and immediately if the business chooses to discard it.
Run history and received data are visible only to the business's own users, and are deleted with the automation and with the business's account.

Google User Data

When you connect Google Sheets, Wachatr reads and writes only the spreadsheets you choose, to import leads and export data as you configure. Wachatr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models. You can disconnect Google at any time from Integrations, which stops all access.

Data Sharing & Sub-processors

We share personal and technical data only with sub-processors necessary to run the service:

Messaging Channels — Meta Platforms, Inc. (WhatsApp Business API, Facebook, Instagram) for message delivery.
Payment Gateway — Razorpay processes payments for Wachatr subscriptions and add-ons.
Appointment Payment Gateways — Razorpay and Cashfree, using the business's own account, to create orders, confirm payments and issue refunds for bookings.
Connected Apps — Composio, and the apps a business chooses to connect through it (for example Gmail, Google Sheets or a CRM), using the business's own Composio account. Data is sent only when a business's automation runs an action in one of those apps.
Email and SMS Providers — the email sender (for example the business's own mailbox over SMTP, Brevo, SendGrid, Mailgun, Postmark or Amazon SES) and SMS provider (for example MSG91, Twilio, Fast2SMS, Gupshup or Textlocal) that a business connects, used to deliver that business's reminders, confirmations, campaigns and follow-ups.
AI Models — OpenAI, and OpenRouter (which forwards each request to the model provider selected, for example OpenAI, Google or DeepSeek), for the optional AI features a business switches on. Data is sent through their business APIs, whose terms do not allow it to be used to train their models. Requests through OpenRouter go only to providers that do not store them (OpenRouter's "no data collection" setting); OpenAI may keep requests for up to 30 days to detect abuse.
Real-time Sockets & Alerts — Pusher (live updates in the app) and Expo push notifications, delivered through Google Firebase Cloud Messaging and the Apple Push Notification service, for new-message alerts on your phone.
Website Analytics & Advertising — Google Analytics and the Meta Pixel on our public website, login and sign-up pages, to measure visits and the results of our own ads (see "Cookies & Analytics" below). They are not loaded on the pages inside your account that show your customers' data.
E-commerce Partners — Shopify and WooCommerce, strictly to retrieve order status when requested by your store integrations.
Infrastructure Providers — Amazon Web Services (AWS S3, Mumbai region; files are private and shared only through short-lived links) for file attachments, and our hosting provider's servers for the application and database.
Legal Authorities — if required by law or to protect user safety.

Cookies & Analytics

Our public website uses cookies from Google Analytics and the Meta Pixel to count visits, understand which pages are useful, and measure the results of our own advertising. These cookies are not needed for the site to work. You can block or delete them in your browser settings, or use Google's opt-out add-on, and manage Meta ad settings in your Facebook account. Inside your Wachatr account we use only the cookies needed to keep you signed in and secure; ad and analytics tags are not loaded there, except to record that a sign-up or purchase was completed.

Your Rights & Data Deletion

Wachatr honors your granular privacy rights under global regulations (such as GDPR and CCPA):

Access & Portability — you can request copies of your account data.
Granular Consent — you can opt-out of optional AI autopilot configurations or third-party connections.
Deleting your organization — tap "Delete account" in the mobile app's Settings, or email support@wachatr.com from your account's email address. We confirm the request, then delete your organization and its customer contacts, messages and files within 30 days, except records we must keep by law (such as invoices). "Delete Account" in your profile removes only your own login.
Requests from a business's customers — if you are a customer of a business that uses Wachatr, please contact that business first; it controls your data. We will help the business answer your request, and you can also write to us. When a Shopify store sends Shopify's request to erase a customer's data, we erase that customer's data automatically.

Data Security

We take security seriously and implement the following measures:

Secure SSL/TLS encryption in transit.
Encryption of sensitive credentials (API keys, Meta tokens) at rest using advanced cryptographic methods.
Encryption at rest of the data businesses' automations receive from other systems, with automatic deletion on a fixed schedule.
Role-limited access control for internal support.

Grievance Officer

For any complaint or question about your data or this policy, write to our Grievance Officer: Stalin Dsouza, support@wachatr.com. We acknowledge complaints within 48 hours and resolve them within one month.

Your Consent

By using Wachatr, you consent to data processing strictly for service delivery purposes as outlined in this policy.