Privacy Policy

This Privacy Policy explains how WappPilot ("we," "us") collects, uses, and shares information when you use our sales and marketing platform ("the Service"). It covers two kinds of data: information about you as a user of the Service, and Customer Data your Workspace uploads or generates (such as your contacts' phone numbers, emails, and conversation history) — for Customer Data, we act as a processor on your Workspace's behalf, and your own privacy notice to your customers governs your collection of it.

• Account information: name, email, password (hashed), and role, when you register or are invited to a Workspace.
• Workspace & billing information: business profile details, subscription plan, and payment metadata (card/payment details are handled by our payment processor, not stored by us).
• Customer Data you provide: contacts, leads, conversations, message content, templates, media you upload, and calling-campaign configuration — this is your data, described further in Section 5.
• Usage data: log-in activity, IP address, device/browser information, and audit-log events (e.g. who changed a setting), used for security and to operate the Service.
• Communications: messages you send us for support, and content of automated emails the Service sends on your behalf (verification, password reset, team invites, billing notices).

• To provide, maintain, and secure the Service, including authenticating you and enforcing your plan's limits.
• To send transactional emails (verification, password reset, team invites, billing/usage notices).
• To detect, investigate, and prevent fraud, abuse, and security incidents (e.g. failed-login lockouts, audit logging).
• To provide customer support and respond to your requests.
• To improve the Service — we do not sell your data or your Workspace's Customer Data to third parties.

To operate the Service we share data with the following categories of third parties, only as needed to provide the feature you use:

• Messaging channel providers — Meta (WhatsApp, Facebook, Instagram) and LinkedIn, to deliver messages/posts you send through those channels.
• AI providers (e.g. Anthropic, OpenAI) — to generate reply suggestions and AI assistant/voice-agent responses, where those features are enabled for your Workspace.
• Email delivery — an SMTP/transactional email provider, to send verification, reset, invite, and campaign emails.
• Payment processing — a third-party payment processor (e.g. Razorpay), to handle subscription billing; we do not store full card details.
• File storage — cloud object storage (local disk or S3-compatible storage), to host media you upload.
• Infrastructure — our hosting provider, to run the application and database.

Each sub-processor only receives the data necessary to perform its function and is bound by its own terms/DPA where applicable.

Contacts, leads, conversations, and other Customer Data you upload belong to your Workspace. You are responsible for having a lawful basis to collect and process it, and for honoring data-subject requests (access, correction, deletion, opt-out) from your own customers. We process Customer Data only as instructed by your Workspace, to provide the Service.

We retain account and Customer Data for as long as your Workspace is active. If a Workspace is cancelled or deleted, we delete or anonymize associated data within a reasonable period thereafter, except where we must retain records to comply with legal, tax, or security obligations (e.g. audit logs of security-relevant events).

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights for your own account, contact us using the details below; if you are a contact of one of our Workspaces (not a WappPilot account holder yourself), please contact that business directly, as they control your data.

We use industry-standard measures to protect data in transit and at rest, including encrypted storage of sensitive credentials (e.g. connected channel access tokens), hashed passwords, role-based access control, and tenant data isolation so one Workspace can never read another's data. No system is perfectly secure, and we cannot guarantee absolute security.

We use essential cookies/local storage to keep you signed in and remember your preferences (e.g. theme). We do not use third-party advertising trackers on the application itself.

Your information may be processed in a country other than your own. Where required, we rely on appropriate safeguards for such transfers as required by applicable law.

The Service is intended for business use by adults and is not directed at children under 16.

We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date.

For privacy questions or to exercise your rights, contact privacy@wappilot.local.