Privacy Policy

• People who sign up and use the WocTok dashboard or API: our customers and their team members.
• People who exchange WhatsApp messages with a business that uses WocTok. For those messages we work for that business: it decides who to message and why, and it is responsible for having your consent. If you have a question about why a business messaged you, ask that business first. We'll help if you write to us.

• Account details: your name, email address and password (kept only as a hash by our sign-in provider), your business's name, and your team members' emails and roles.
• WhatsApp account details: the IDs of your WhatsApp Business Account and phone numbers, their display names, and the access token Meta issues so we can act for you. Tokens are encrypted before they're stored.
• Messages: the messages your business sends and receives through WocTok, including text and media files, the phone numbers and WhatsApp profile names of the people you message, delivery and read statuses, and what Meta charged for each message.
• Contacts and templates: contact lists you upload or create, and the message templates you write.
• Payments: wallet top-ups go through Cashfree Payments. We keep the order number, amount, status, and the email and phone number sent with the payment. Card, UPI and bank details go only to Cashfree; we never see or store them.
• Activity records: a log of important actions in your workspace, such as who connected a number or started a bulk send, with the time and IP address. It lets you see who did what, and lets us look into misuse.
• API keys: we keep only a hash of each key, never the key itself.
• Cookies: only the ones that keep you signed in. We don't use advertising or analytics cookies.

When you connect a number through Meta's sign-up window, we receive an access token for your business and the IDs of your WhatsApp account and phone number. We don't receive or keep your Facebook profile.

• To run the service: send and receive your messages, submit your templates to Meta, show delivery reports and analytics, and keep your team's inbox up to date.
• To bill you: take the monthly number fee and message charges from your wallet, and keep payment records.
• To keep accounts secure: check that webhooks really come from Meta, spot misuse, and investigate problems.
• To support you, and to tell you about changes to the service, your account or your bill.
• To meet legal obligations, such as keeping tax and accounting records.

We don't sell personal data or use it for advertising. We use the content of your messages only to provide WocTok to your business.

When you connect a WhatsApp number, Meta gives us access to your WhatsApp Business Account so we can send messages, manage templates, and receive messages and delivery updates for you. We use this data only to provide WocTok to your business, as Meta's Platform Terms require, and share it only as described below. You can remove our access at any time: see Data deletion.

We share data only with the companies that help us run the service, and only what each one needs:

• Meta Platforms (WhatsApp Business Platform), to deliver your messages and templates. Meta handles this data under its own terms and privacy policy.
• Supabase, our database, sign-in and file storage.
• Vercel, which hosts the application.
• Cashfree Payments, which processes wallet top-ups.

These companies may store data outside India. We also disclose data when the law requires it, for example to comply with a valid order from a court or government authority, or to protect someone's safety.

• Media files (photos, documents, voice notes) are deleted automatically after your workspace's retention period. You choose it, from 7 to 60 days; it's 60 days unless you change it.
• Messages, contacts, templates and activity records stay while your account is open, so your history and reports stay available.
• When an account is closed, we delete its data within 30 days. Payment and billing records are kept for as long as tax and accounting law requires.

All traffic to and from WocTok is encrypted with HTTPS. WhatsApp access tokens are encrypted with AES-GCM before they're stored. The database itself lets each business read only its own data. API keys are stored as hashes, and every webhook from Meta is checked against its signature before anything is saved.

No system is completely secure. If a breach affects your data, we'll tell you, and the authorities, as the law requires.

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, and withdraw any consent you've given us. Under India's Digital Personal Data Protection Act, 2023, you can also nominate someone to use these rights for you, and raise a grievance with us.

Write to jsquare613@gmail.com. We reply within 30 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

Data deletion explains how to remove a number, remove our access to your WhatsApp account, or close your account and have everything deleted.

WocTok is for businesses. It isn't meant for anyone under 18, and we don't knowingly collect data about children through the dashboard.

When we change this policy, we update the date at the top. If a change makes a real difference to how we use your data, we'll tell account owners by email or in the dashboard before it takes effect.

JSQUAREDIGITAL MARKETING PRIVATE LIMITED
C/o Fathimathul Haseena, Kankanady Bypass Road, Kankanady, Mangaluru, Dakshina Kannada, Karnataka 575002
jsquare613@gmail.com