Privacy Policy

1. Introduction

Welcome to WatEase ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp Business platform and related services.

By using WatEase, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and business details
• WhatsApp Business Account Data: WhatsApp Business Account ID, phone number ID, access tokens
• Payment Information: Billing address and payment method details (processed securely by our payment providers)
• Communications: Messages, support tickets, and feedback you provide to us

2.2 Automatically Collected Information

• Usage Data: How you interact with our platform, features used, and actions taken
• Device and Connection Information: IP address, browser type, operating system, and device identifiers. We record your IP address and browser user-agent each time you create an account, sign in, or take a security-sensitive action on your account
• Log Data: Access times, pages viewed, app crashes, and system activity
• Cookies and Tracking: We use cookies and similar technologies to track activity and improve our services

2.3 WhatsApp Platform Data

• Message Data: Content and metadata of WhatsApp messages sent and received through our platform
• Contact Information: Phone numbers and contact details of your customers
• Media Files: Images, videos, documents, and other files shared through WhatsApp
• Analytics Data: Message delivery status, read receipts, response times, and engagement metrics

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Services: To operate and maintain our platform, process transactions, and deliver WhatsApp messaging services
• Account Management: To create and manage your account, verify your identity, and provide customer support
• WhatsApp Integration: To connect your WhatsApp Business Account, send and receive messages, and manage message templates
• Analytics: To analyze usage patterns, measure performance, and improve our services
• Marketing: To send you promotional materials, newsletters, and service updates (with your consent)
• Security and Fraud Prevention: To protect accounts from unauthorised access. We record the IP address, browser user-agent, and timestamp of account creation, sign-in, and other security-sensitive activity so we can detect and investigate account takeover, credential-stuffing and abuse, apply rate limits, and help you verify whether activity on your account was yours. We rely on our legitimate interest in keeping the platform secure
• Compliance: To comply with legal obligations, enforce our terms, and protect against fraud
• Communication: To respond to your inquiries, provide technical support, and send important notices

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

• Meta/WhatsApp: We share necessary information with Meta to enable WhatsApp Business API integration
• Service Providers: We work with third-party service providers for hosting, payment processing, analytics, and email delivery
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred
• Legal Requirements: We may disclose information when required by law, court order, or government request
• Protection: To protect our rights, property, safety, and that of our users and the public
• Consent: With your explicit consent for any other purpose

We do not sell your personal information to third parties.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Audit logging of account activity, with access restricted to authorised personnel
• Secure data centers with physical and network security
• Employee training on data protection and security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal, tax, and accounting obligations
• Resolve disputes and enforce our agreements
• Meet WhatsApp Business Platform data retention requirements

When you close your account we retain your data for 30 days (in case you reactivate), then permanently delete or anonymize it from active systems. Encrypted backups may carry residual data for up to 30 additional days before they are purged on rotation. Statutory exceptions (tax, accounting, dispute records) are kept for the period the law requires and no longer. You can request immediate deletion via our data-deletion page at any time. Security and audit logs, including the IP addresses described in Section 2.2, follow the same retention as the rest of your account data and are removed when your account data is purged.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (right to be forgotten). See our Data Deletion Instructions for step-by-step guidance
• Data Portability: Request a copy of your data in a machine-readable format
• Restriction: Request restriction of processing of your personal information
• Objection: Object to processing of your personal information for certain purposes
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis
• Opt-out: Unsubscribe from marketing communications at any time

To exercise these rights, please contact us at support@watease.com. We will respond to your request within 30 days.

8. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on contract performance, legitimate interests, legal obligations, or your consent
• Data Protection Officer: Contact our DPO at support@watease.com for privacy concerns
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
• International Transfers: We use standard contractual clauses approved by the European Commission for data transfers outside the EEA

9. DPDPA Compliance (Indian Users)

WatEase is incorporated in India and processes personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. If you are a Data Principal located in India, you have the following rights:

• Right to Notice: Receive a clear, plain-language notice describing the personal data we process and the purposes for which it is processed
• Right to Consent: Provide free, specific, informed, unconditional, and unambiguous consent before we process your personal data, where consent is the basis of processing
• Right to Access: Obtain a summary of the personal data being processed and the processing activities undertaken
• Right to Correction and Erasure: Request correction of inaccurate or misleading data, completion of incomplete data, updating of data, and erasure of personal data that is no longer necessary for the purpose for which it was collected
• Right to Grievance Redressal: Have a readily available means to raise grievances with our Grievance Officer (see Section 16 below)
• Right to Withdraw Consent: Withdraw consent at any time, with the same ease as it was given. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal
• Right to Nominate: Nominate another individual who shall, in the event of your death or incapacity, exercise these rights on your behalf
• Right to Lodge Complaints: Approach the Data Protection Board of India under Section 28 of the DPDPA if your grievance is not resolved by our Grievance Officer within the statutory timeline

We process personal data lawfully, for specified purposes, and in a manner consistent with the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. To exercise any of the rights above, contact our Grievance Officer at the address listed in Section 16.

10. CCPA Compliance (California Users)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Authorized Agent: You may designate an authorized agent to make requests on your behalf

To exercise your CCPA rights, email us at support@watease.com. We will verify your identity before processing your request.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for basic platform functionality and security
• Performance Cookies: Help us understand how visitors interact with our platform
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Collect anonymous usage data to improve our services

On our public website these non-essential technologies include Google Tag Manager and Google Analytics, Microsoft Clarity (which records how pages are used, including session replay) and the LinkedIn Insight Tag.

Only essential cookies, which are required to sign you in and keep your session secure, are set without asking. Everything listed above loads only after you accept on our cookie banner; if you decline, or simply ignore the banner, those technologies are never loaded. You can change your mind at any time using the “Cookie preferences” link in the site footer, which withdraws consent and stops them immediately. You can also control cookies through your browser settings, though disabling essential cookies may affect the functionality of our platform.

12. Children's Privacy

WatEase is a business-to-business commerce platform intended for use by businesses and the individuals authorised to act on their behalf. Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact our Grievance Officer (Section 16) and we will take steps to delete it promptly. Where required under the DPDPA 2023, we obtain verifiable parental consent before processing the personal data of a child or a person with disability who has a lawful guardian.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by data protection authorities
• Other legally approved transfer mechanisms

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending you an email notification (for material changes)
• Displaying a prominent notice on our platform

Your continued use of our services after changes become effective constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

16. Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, WatEase has appointed a Grievance Officer to address questions, concerns, and complaints relating to the processing of your personal data and our compliance with applicable Indian law.

Response timelines:

• Acknowledgement of your grievance within 48 hours of receipt
• Substantive response and, where appropriate, resolution within 30 days, in line with Rule 5(9) of the IT Rules, 2011
• If a complaint cannot be resolved within 30 days, we will explain the reason and provide a revised timeline

If your grievance is not satisfactorily resolved by our Grievance Officer, you may approach the Data Protection Board of India under Section 28 of the DPDPA, 2023 for further redressal.

17. WhatsApp Business Platform Privacy

WatEase integrates with Meta's WhatsApp Business Cloud API and complies with the relevant privacy and data protection requirements:

• We act as a data processor for messages sent through WhatsApp on your behalf
• Note: WhatsApp Business Cloud API messages are server-mediated by Meta — they are not end-to-end encrypted between you and the customer the way the consumer WhatsApp app is. Treat sensitive content accordingly.
• We only access message metadata necessary to provide our services
• We comply with WhatsApp Business Data Processing Terms
• You remain the data controller for messages sent to your customers

For more information about WhatsApp's privacy practices, please review the WhatsApp Privacy Policy.

17.1 WhatsApp Data Retention

Messages, contacts, and webhook events received through the WhatsApp Business Platform are retained for the duration of your active subscription plus thirty (30) days for account-recovery purposes. After that window, message bodies are permanently deleted from active systems and anonymized in archival logs. Encrypted backups carry residual data for an additional thirty (30) days before rotation. Statutory exceptions (tax records, dispute logs) are kept for the period the law requires and no longer.

17.2 WhatsApp Data Deletion & Deauthorization

You can revoke WatEase's access to your WhatsApp Business Account at any time. The data path is:

• In-app disconnect: Settings → Integrations → WhatsApp → Disconnect. Tokens are revoked, webhooks unsubscribed, and the account row soft-deleted within seconds.
• Facebook → Settings → Business Integrations → Remove app: Meta delivers a Deauthorize signed_request to /api/v1/whatsapp/deauthorize-callback. We HMAC-verify it, log an audit event, and disable any WhatsApp accounts owned by your Facebook user_id.
• Data Deletion Request: Meta delivers a signed_request to /api/v1/whatsapp/deletion-callback. We respond with a confirmation_code + status URL, then asynchronously erase your WhatsApp messages, contacts, templates, automation flows, analytics, webhook events, and anonymize the WhatsApp identifiers on associated customer records. Cross-channel data (email, Instagram, Messenger) is preserved unless you separately request its deletion.
• Self-service: Visit our Data Deletion page to file a request directly.

All four paths are idempotent — duplicate revocations return the same audit row rather than re-running cleanup. Status URLs returned to Meta are public and rendered as a human-readable confirmation page.

18. Google User Data (Google API Services)

WatEase integrates with Google Ads so that you can manage your own advertising from within WatEase. You connect your own Google Ads account using Google OAuth 2.0, and we access it only with your explicit authorization. WatEase's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

18.1 Data We Access

With the https://www.googleapis.com/auth/adwords scope you grant, we access only the Google Ads accounts you authorize, and only the following:

• The list of Google Ads accounts your Google login can access (account ID, name, currency, time zone)
• Campaigns, ad groups, ads, keywords, assets, budgets and conversion actions in those accounts
• Performance metrics for those entities (impressions, clicks, cost, conversions)
• Google Ads optimization recommendations available on the account

We do not access your Gmail, Drive, Calendar, Contacts, Photos or any other Google service through this integration, and we do not read your personal Google profile data.

18.2 How We Use This Data

Google Ads data is used solely to provide the user-facing features you asked for:

• Displaying your campaign performance in WatEase dashboards and reports
• Creating and managing campaigns, ad groups, ads, keywords and budgets at your instruction
• Uploading offline/WhatsApp conversions you record in WatEase back to your Google Ads account, so your own bidding can optimize on real outcomes
• Showing and, at your request, applying Google's optimization recommendations

We do not use Google user data for advertising to you, for credit or lending decisions, or for any purpose unrelated to these features. We do not use Google user data to develop, improve or train generalized AI/ML models.

18.3 Data Sharing and Transfer

We do not sell, rent or transfer Google user data to third parties. We never share it with data brokers, advertisers or AI/ML training services. It is disclosed only:

• Back to Google, when carrying out an action you initiated (for example creating a campaign or uploading a conversion)
• To our infrastructure providers strictly for hosting and storage, under contractual confidentiality and data-protection obligations
• Where required by law, or with your explicit consent

Google Ads data is isolated per tenant; it is never pooled across customers or exposed to other WatEase users.

18.4 How We Protect This Data

• OAuth refresh and access tokens are held server-side only — they are never returned in API responses, never exposed to your browser, and never written to application logs
• All traffic to Google APIs and to WatEase is encrypted in transit using TLS/HTTPS
• Access is tenant-scoped and role-restricted; only authorized users of your account can view or act on your Google Ads data
• Administrative access is limited to authorized personnel on a need-to-know basis and is audit-logged

18.5 Data Retention and Deletion

Google Ads data is cached only as long as needed to render your dashboards and reports, and is refreshed from Google rather than kept as a permanent record. You can remove it at any time:

• In-app disconnect: AdMax → Google Ads → Settings → Disconnect. We immediately delete the stored OAuth tokens and the connected-account configuration, and stop all access to your Google Ads account.
• Revoke from Google: remove WatEase at myaccount.google.com/permissions; our stored tokens become invalid immediately.
• On account closure: tokens and cached Google Ads data are deleted within thirty (30) days, with encrypted backups rotating out within a further thirty (30) days.
• Self-service: you may also request erasure via our Data Deletion page.

Disconnecting does not alter or delete anything inside your Google Ads account — campaigns you created remain under your control in Google Ads.