Privacy Policy

1. Company Information

2. Information We Collect

We collect the following categories of personal data:

• ›Identity & Contact Data: Name, email address, phone number
• ›WhatsApp Message Content: Messages sent and received via WAFlows, processed through Meta's official WhatsApp Cloud API
• ›Payment Information: Billing details and transaction IDs processed by Razorpay — we do not store card or bank details on our servers
• ›Usage Data: Pages visited, features used, session duration, and interaction logs
• ›Technical Data: IP address, browser type, device information, and operating system
• ›Cookies & Tracking Data: Session cookies and authentication tokens (essential only — see Cookie Policy)

3. How We Use Your Information

We use your data to:

• ›Provide and operate the WAFlows platform
• ›Send WhatsApp messages via Meta's official WhatsApp Cloud API on your behalf
• ›Process billing and subscription payments via Razorpay
• ›Authenticate and manage user sessions via Clerk
• ›Analyse product usage to improve features and performance
• ›Send service updates, security alerts, and support responses
• ›Comply with applicable laws and legal obligations

4. Third-Party Services

We use the following third-party services, each with their own privacy policy and data practices.

5. WhatsApp Message Content

WhatsApp message content is processed through Meta's official WhatsApp Cloud API in accordance with Meta's data policies and WhatsApp Business Terms. We do not sell, rent, or use message content for advertising purposes. Message content is stored only to provide the service (e.g., message history in your inbox) and is subject to the retention policy below.

6. Payment Data

All payment processing is handled exclusively by Razorpay, a PCI DSS compliant payment gateway. We never store credit card numbers, debit card details, or bank account information on our servers. We retain only transaction IDs and billing metadata (plan name, amount, date) for invoice and support purposes.

7. Data Retention

• ›Account Data: Retained for 2 years after account deletion, then permanently deleted
• ›Message Logs: WhatsApp message logs retained for 90 days, then purged
• ›Payment Records: Retained as required by Indian tax and accounting laws (minimum 7 years under GST regulations)

8. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside India, including the United States (Vercel application hosting) and Singapore (Neon PostgreSQL on AWS ap-southeast-1). We ensure appropriate safeguards are in place for such transfers in compliance with the DPDP Act 2023 and GDPR where applicable.

9. Cookie Policy

We use only essential cookies required for operation of the service, including authentication session cookies managed by Clerk. We do not use advertising cookies, third-party tracking cookies, or behavioural analytics cookies. Essential cookies cannot be opted out of without affecting service functionality.

10. Children's Privacy

WAFlows is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us at support@userex.in and we will delete it promptly.

11. Applicable Laws

This Privacy Policy is governed by and compliant with:

• ›Digital Personal Data Protection Act, 2023 (DPDP Act) — India's primary data protection legislation
• ›Information Technology Act, 2000 and IT Amendment Act, 2008
• ›IT (Reasonable Security Practices and Procedures) Rules, 2011
• ›GDPR — for users in the European Union and European Economic Area
• ›Meta WhatsApp Business Policy — governing all use of the WhatsApp Business API
• ›Razorpay Data Standards — governing payment data handling and PCI DSS compliance

12. Your Rights under DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights:

• ›Right to Access: Request a summary of personal data we hold and how it is processed
• ›Right to Correction: Request correction of inaccurate or incomplete personal data
• ›Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• ›Grievance Redressal: File a grievance with our Grievance Officer (details below) for resolution within 30 days
• ›Right to Nominate: Nominate a representative to exercise your rights in the event of death or incapacity

To exercise any of these rights, email support@userex.in with the subject "Data Rights Request — [your registered email]".

13. Grievance Officer

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email to your registered address or by posting a prominent notice on the WAFlows platform at least 30 days before the change takes effect. Continued use of the service after the effective date of changes constitutes acceptance of the updated policy.