WappoPrivacy Policy
This policy explains what personal data Wappo (the "Service"), operated by Rajni ("we", "us", the "Operator"), collects, why, who it is shared with and the choices you have. It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 of India, and applies to everyone who uses the Service.
1. Two kinds of people, two roles
- Business customers (people who sign up and use the dashboard). For their account data, we decide how it is used, so we are the data fiduciary / controller.
- End customers (people who send a WhatsApp message to a business that uses the Service). The business decides why and how their messages are used and we process them on the business's behalf as a processor. If you are an end customer and want your data corrected or deleted, please ask the business you messaged. You may also write to us (see section 11) and we will pass your request on or act on it where we can.
2. What we collect
From business customers:
- Account data: name of business, email address, password (stored only as a one-way hash), role and team members you add.
- Business settings: description, services, questions, notes, links, time zone, alert contact details and pipeline stages.
- Usage and billing data: plan, usage counters, payment status and references. We do not store card numbers; payments are handled by Razorpay, Stripe or PayPal.
- The WhatsApp link: a session credential created when you scan the QR code, stored on our server so the bot stays connected.
- If you connect Google Calendar: your Google account email and an access (refresh) token, stored encrypted, plus the calendar events we create for bookings and the free/busy times we read to offer slots.
- Technical data: sign-in times, IP address in security logs, an audit log of administrative actions.
- Approximate location: when you visit our website or billing page we use your IP address to work out your country, only to show prices in the right currency (rupees in India, dollars elsewhere). The lookup runs on our own server with an offline database; your address is not sent to anyone for this and is not stored for this purpose.
About end customers (on behalf of the business):
- Phone number and WhatsApp display name.
- The content of messages exchanged with the business's number, and the answers given to the business's questions.
- Appointment details and any notes the business adds.
We do not intentionally collect sensitive personal data. Businesses must not ask customers for card numbers, passwords or government identity numbers through the bot.
3. Why we use it (purposes)
- To provide the Service: run the bot, store leads, send alerts, book appointments and show your dashboard.
- To secure the Service, prevent abuse and keep records of administrative actions.
- To bill you, apply plans, process referrals and respond to support requests.
- To improve reliability. We do not sell personal data, and we do not use end customers' messages for advertising.
4. Legal basis and consent
We process business customers' data to perform our agreement with them and, where required, with their consent, which they may withdraw by closing their account. Businesses are responsible for having a lawful basis (such as the customer contacting them first, or consent) for messaging their own customers and for any broadcast they send.
5. Who we share data with
Only the providers needed to run the Service, under their own terms and privacy policies:
| Provider | Why |
|---|---|
| Meta / WhatsApp | The messaging network through which messages travel. |
| Google (Gemini AI) | Generates answers, onboarding suggestions and hand-off briefings. The text of the relevant conversation and your business notes are sent to the model to produce a reply. |
| Google (Sign-in and Calendar) | Only if you connect a calendar. We use the access only to read free/busy times and create or delete booking events. |
| Razorpay, Stripe and PayPal | Payment processing for subscriptions. |
| Resend or another email provider | Sends alert emails, if you enable email alerts. |
| Cloud hosting provider | Servers and storage on which the Service and its database run. |
We may also disclose data if required by law, a court or a government authority, or to protect rights, safety and the integrity of the Service. If the Service is ever sold or transferred, data may move with it under the same protections.
Google user data. Our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. Calendar data is used only to provide the booking feature you ask for, is not used for advertising and is not shared except as needed to provide the Service.
6. Cookies
The public website sets no cookies. The dashboard sets one essential, HttpOnly session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.
7. How long we keep data
- Account and business data: for as long as your account exists.
- When a business deletes its account (or asks us to), we delete its workspace, chats, leads, team and WhatsApp and Google links. Encrypted backups may retain copies for up to 90 days before they are overwritten.
- Billing records and the audit log may be kept for as long as the law or legitimate accounting needs require.
8. Security
Each business's data is kept in its own workspace. Passwords are hashed, Google tokens are encrypted, webhooks are signed, traffic uses HTTPS, and administrative actions are logged. No system is perfectly secure; if a breach affecting your personal data occurs we will notify the affected persons and the Data Protection Board of India as the law requires.
9. Your rights
Subject to law you may: ask what data we hold about you and how it is used; ask us to correct or complete it; ask us to erase it; withdraw consent; nominate someone to exercise your rights if you die or become incapacitated; and complain to us about how your data is handled. Business customers can export contacts and delete their data from the dashboard. For anything else, contact us as below.
10. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data has reached us, tell us and we will delete it.
11. Contact and grievance officer
For privacy requests and complaints, contact the Operator and grievance officer. We aim to acknowledge within 3 working days and resolve within 30 days.
- Operator: Rajni
- Email: [email protected]
- Phone / WhatsApp: +91 87008 25077
- Address: 592/22-B Nakul Gali, 60 Feet Road, Vishwas Nagar, East Delhi, Delhi 110032, India
12. Changes
We may update this policy. The date at the top shows the latest version, and for significant changes we will notify business customers by email or in the dashboard.