Legal

Privacy Policy

Last updated: September 9, 2026

Garhwal Tech Solutions ("we", "us", "our") operates WhatsApp Chat CRM, a multi-tenant WhatsApp Business CRM platform available at wachatcrm.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have — whether you are a business using the Service ("you", "Account Owner"), a staff member of that business, or a customer of that business communicating with them over WhatsApp.

By using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.

1. Who this policy covers

The Service is used by businesses ("Tenants") to manage their own customer conversations, contacts, and support workflow on WhatsApp. This means two different kinds of people's data pass through the Service, and we act differently toward each:

• Tenant account data — the business itself, its owner, managers, and staff accounts. We are the data controller for this data (see §2).
• End-customer data — the Tenant's own customers, whose names, phone numbers, and message content the Tenant stores and manages inside the Service to run their own business. Here, the Tenant is the data controller and we act only as a data processor on their behalf, under their instructions, strictly to provide the Service. If you are someone's customer and want to exercise a data right over information a business holds about you in this Service, please contact that business directly first — see our Data Deletion page for how to reach us if that is not possible.

2. Information we collect

2.1 Account & registration information

• Organization/workspace name, work email address, and password (stored only as a salted bcrypt hash — we never store your plain-text password).
• Mobile number and country code, collected at registration to support account verification and security notifications.
• Role and permissions within your workspace (owner, manager, or staff), and any staff/manager accounts you create.

2.2 WhatsApp Business & Meta/Facebook data

To send and receive WhatsApp messages, the Service connects to your own WhatsApp Business Account (WABA) on Meta's official WhatsApp Cloud API, either by:

• you providing your own WABA ID, phone number ID, System User access token, and Meta App Secret directly ("Manual Setup"); or
• "Continue with Facebook" (Embedded Signup), where Meta hands us a short-lived authorization code and, during that flow, the WhatsApp Business Account and phone number you selected. We exchange that code for an access token used solely to operate your WhatsApp connection, and we record the Facebook user ID of the person who completed that authorization solely so that, if that person later removes this app from their Facebook account, we can identify and revoke the correct connection (see our Data Deletion page).

We do not request or store your Facebook password, and Embedded Signup does not give us access to your personal Facebook profile, friends list, posts, or any Facebook data beyond what WhatsApp Business onboarding requires.

2.3 Customer & conversation data (processed on a Tenant's behalf)

• Contact records a Tenant creates or that arrive via WhatsApp/Instagram/Facebook Lead Ads: name, phone number, email, address, notes, tags, and assignment history.
• Message content and metadata sent/received through the Tenant's connected WhatsApp number, including text, media (images/documents), delivery/read status, and template messages.
• Support tickets, tasks, canned responses, and internal notes Tenant staff create around a conversation.

2.4 Billing information

We record your subscription plan, trial/expiry dates, and payment status. Where a third-party payment processor is used to collect payment, that processor handles your card/payment instrument details directly — we do not store your full card number.

2.5 Technical & usage data

• Login sessions and devices (platform, a human-readable device label, IP-derived rate-limiting — see §7), used for security features like "sign out this device" / "sign out everywhere."
• Push notification tokens (Firebase Cloud Messaging), if you enable desktop/mobile alerts.
• Standard server logs (timestamps, request paths, error traces) for debugging and abuse prevention.
• Browser local storage, used to keep you signed in and remember dashboard preferences — see §8.

3. How we use information

• To provide, operate, and maintain the Service, including sending/receiving WhatsApp messages on your behalf through your own connected WhatsApp Business Account.
• To authenticate you, secure your account, and enforce role-based access between your workspace's owner, managers, and staff.
• To send transactional emails: registration verification codes, password resets, and service notices.
• To send push notifications you have opted into (new message alerts).
• To bill and manage your subscription, and enforce plan limits.
• To monitor, secure, and improve the Service, including rate-limiting abuse and investigating security incidents.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, or a Tenant's customer data, to third parties.

4. How we share information

• Meta / WhatsApp Cloud API — messages you send/receive necessarily pass through Meta's infrastructure as the WhatsApp service provider; Meta's own policies govern their handling of that data.
• Your own configured integrations — if you set up a third-party webhook (e.g. n8n, your own CRM), we forward inbound message events to the URL you configured, at your instruction.
• Service providers we use to run the platform: email delivery (SMTP), push notifications (Firebase Cloud Messaging), and hosting infrastructure. These providers only process data as needed to provide their service to us.
• Legal requirements — if required to comply with a legal obligation, protect our rights, or investigate fraud or abuse.
• Business transfers — if we're involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, subject to this policy's commitments continuing to apply.

5. Data retention

We retain account and conversation data for as long as your account is active, plus a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. A Tenant can delete individual contacts/conversations from within the dashboard at any time. See our Data Deletion page for how to request full account deletion.

6. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights:

• If you are a Tenant (Account Owner, manager, or staff), contact us at info@wachatcrm.com or use our Data Deletion page.
• If you are someone's customer and your data is held inside a Tenant's workspace, please contact that business directly — they control that data. If that isn't possible, reach us via the same Data Deletion page and we will assist as their data processor.

7. Security

We use industry-standard safeguards including encrypted password storage (bcrypt), signed and tenant-scoped access tokens, HMAC-verified webhooks, and role-based access control between account owners, managers, and staff. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Cookies & local storage

The dashboard uses browser local storage (not third-party tracking cookies) to keep you signed in and remember interface preferences. This data stays on your device and is not used for cross-site tracking or advertising.

9. Children's privacy

The Service is intended for business use and is not directed at children under 18. We do not knowingly collect personal information from children.

10. International data transfers

We are based in India, and our infrastructure and service providers may process data in India or other countries. By using the Service, you consent to your information being processed in these locations.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and for material changes, we will provide additional notice (e.g. by email or an in-app notice).

12. Contact us

Garhwal Tech Solutions
Parasiya Road, Chhindwara, MP 480001, India
Email: info@wachatcrm.com