Wabzen ("we", "us") is a software service operated by [not set] that lets businesses connect their own WhatsApp Business account and use it to talk to their customers: a shared inbox, message templates, campaigns and a developer API. This policy explains what personal data we handle, why, and the choices you have. It applies to our website, the Wabzen dashboard and our API.
In short: we use your data only to run the service for you. We do not sell personal data, we do not use WhatsApp or Meta data for advertising, and we do not share it with anyone except the service providers listed below and where the law requires it.
1. Who is responsible
For the account data of the businesses that sign up (our customers) and their team members, [not set] decides how data is used and is responsible for it (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023).
For the messages, contacts and other data a business handles about its own customers through Wabzen, the business is responsible, and we process that data only on its instructions to provide the service. If you are the customer of a business that uses Wabzen, please contact that business first about your data; we will help it respond.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash), role, two-factor settings, phone number if you choose WhatsApp sign-in codes | You, when you sign up or are invited |
| Business details | Business name, legal name, GSTIN, billing address, state, billing email and phone | The workspace owner |
| WhatsApp Business account data | WhatsApp Business account ID, business portfolio ID, phone numbers and their display name, quality rating and messaging limit, message templates, an access token for the account (encrypted) | Meta, when you connect your account through Embedded Signup and grant permission |
| Messages and contacts | Messages and media sent and received through your WhatsApp number, delivery and read statuses, your customers' WhatsApp numbers, profile names, tags, consent (opt-in / opt-out) and any fields you add; for numbers also used in the WhatsApp Business app, the contacts and chat history you choose to share | Meta's WhatsApp Business Platform, you and your team, files you import |
| Payment data | Plan, subscription status, invoices, payment and subscription IDs from our payment gateways. Card, UPI and bank details are entered on the payment gateway's page and never reach us | You and our payment gateways |
| Usage and security data | IP address, browser and device type, sign-in history, active sessions, API request logs (method, path, status, time - not request contents) | Your browser and API clients |
We do not collect your Facebook profile, friends, photos or posts. Facebook Login is used only to connect a WhatsApp Business account.
3. Data from Meta (WhatsApp Business Platform)
When a business connects its WhatsApp Business account, Meta gives us access through the permissions whatsapp_business_management and whatsapp_business_messaging. We use this access only to:
- list and connect the business's phone numbers and keep their status, quality and limits up to date;
- send the messages the business asks us to send, and receive its customers' messages and delivery statuses;
- create, sync and send the business's message templates;
- manage the business profile shown on WhatsApp when the business edits it.
We do not sell this data, use it to build advertising profiles, share it with data brokers, or use it for any purpose other than providing the service to that business. Access ends when the business disconnects the account in Wabzen, removes our app in Meta Business Suite, or deletes its workspace. We comply with the Meta Platform Terms and Developer Policies.
4. How we use data
- To provide the service: show your inbox, send and receive messages, run campaigns you schedule, deliver events to the webhook URLs you set.
- To keep accounts secure: sign-in checks, two-factor codes, alerts about new devices, blocking abusive traffic.
- To bill: subscriptions, GST invoices and estimates of what Meta will charge you.
- To support you and send service emails (password resets, invitations, alerts about your WhatsApp account). We do not send marketing email without your consent.
- To meet legal obligations, such as tax records and lawful requests from authorities.
We process personal data on the basis of your consent and for the legitimate uses permitted by law, including performing the contract with you.
5. Who we share data with
- Meta Platforms - messages and templates are sent through the WhatsApp Business Platform, which Meta operates. Meta's own terms and privacy policy apply to WhatsApp.
- Payment gateways (such as Razorpay, PhonePe and Cashfree) - to take subscription payments.
- Hosting, database, email and monitoring providers that store or process data for us under contract and only on our instructions.
- Authorities, when Indian law requires it.
If [not set] is reorganised or sold, data may pass to the successor, which must keep to this policy.
6. Where data is stored
We store data on servers in India. Meta processes WhatsApp messages on its own global infrastructure, and some service providers may process data outside India; where this happens, we rely on their contractual commitments to protect it.
7. How long we keep it
- Account, business, message and contact data: for as long as the workspace exists, unless the business deletes it sooner. When a workspace is deleted, its data is removed from our live systems within 30 days and from backups when they expire.
- Raw technical event data from Meta: 30 days.
- Sign-in history: 180 days. API request logs: 30 days by default.
- Invoices and payment records: as long as Indian tax law requires (generally 8 years).
8. Security
Connections use HTTPS. WhatsApp access tokens and webhook secrets are encrypted at rest (AES-256-GCM); passwords and API keys are stored only as one-way hashes. We offer two-factor sign-in, session management and IP blocking, keep each business's data separate, and limit staff access to what support requires. No system is perfectly secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.
9. Your rights
You may ask to access, correct or delete your personal data, withdraw consent, or nominate someone to act for you, as provided by the Digital Personal Data Protection Act, 2023. Team members can change their name and password in Settings; workspace owners can edit business details and request deletion of the whole workspace in Settings. For anything else, write to [not set]. See also how to delete your data.
10. Cookies and local storage
The dashboard stores your session and preferences (such as dark mode) in your browser's local storage. We use no advertising or third-party tracking cookies. Payment gateways may set their own cookies when you pay.
11. Children
Wabzen is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children's data.
12. Changes
We will post changes here and update the date above. If a change is significant, we will tell workspace owners by email before it takes effect.
13. Contact and grievances
[not set], [not set]. Email: [not set]. Phone: [not set].
Grievance Officer: [not set] - [not set]. We acknowledge complaints within 24 hours and resolve them within 15 days.