PRIVACY POLICY

(Wapzio acting as Data Fiduciary)

Document key: PRIVACY · Version: 2.0 · Effective: 03/10/2026

2.1 Scope — read this first

This Privacy Policy explains how Anantkamal Software Labs ("Wapzio") handles personal data for which Wapzio itself decides the purpose and means — that is, where Wapzio is the Data Fiduciary under the DPDP Act, 2023.

It covers: website visitors, prospects and enquirers, account holders and their authorised Users, billing contacts, support requesters, applicants, and persons whose data appears in Wapzio's own security and audit logs.

Partners. If you were onboarded through a Wapzio partner (a reseller or agency), you still sign up directly under Wapzio's own Terms and this Privacy Policy, and Wapzio is the Data Fiduciary for your account data. Your partner can see your name, email address, phone number, plan and account status, and can block or remove your account. Your partner cannot read your messages, contacts or templates. Partners are bound by confidentiality, credential-security and data-handling terms with Wapzio, and their acceptance of those terms is recorded.

It does not cover personal data that Wapzio processes on behalf of a Client — for example, a Client's contact lists, WhatsApp Recipients, conversation content and campaign audiences. For that data, the Client is the Data Fiduciary and Wapzio is only a Data Processor. That relationship is governed by the Data Processing Agreement, and the Client's own privacy notice governs the Recipient's rights.

If you received a WhatsApp message sent through Wapzio and want it stopped or your data deleted: the business that messaged you controls that data. Reply STOP to that conversation, and contact that business directly. Wapzio cannot delete a business's records on your instruction, but we will forward your request to the relevant Client and record it — write to privacy@wapzio.com with the sending business name and the number that contacted you.

2.2 What we collect

We do not knowingly collect data of children under 18 for the Services. We do not collect Aadhaar numbers. We do not use personal data to train general-purpose AI models.

2.3 Why we process it, and on what basis

Where we rely on consent, you may withdraw it at any time with the same ease as it was given, by writing to privacy@wapzio.com or using the in-product controls. Withdrawal does not affect processing already carried out, and does not affect processing on another lawful basis — in particular we will continue to retain security, audit and billing records where the law requires it.

2.4 Who we share it with

• Sub-processors and service providers — cloud hosting, email delivery, payment gateway, error monitoring, analytics, support desk, communications. The current list is published at https://www.wapzio.com/legal/subprocessors with vendor name, service, purpose, data categories and processing location.
• Your partner — if you signed up through a Wapzio partner, that partner sees your name, email, phone number, plan and account status, to support and manage you as its client. The partner is named in the notice you were shown at sign-up.
• Professional advisers — lawyers, auditors, insurers, under duties of confidence.
• Authorities — where required by a valid legal process. See our Law Enforcement Request Policy.
• Corporate transactions — an acquirer or successor in a merger, restructuring or sale of assets, subject to confidentiality and this Policy.

We do not sell personal data. We do not share personal data with data brokers or for third-party advertising.

2.5 Where it is processed

Primary hosting is in India — AWS ap-south-1 (Mumbai). Some sub-processors may process data outside India. Where they do, we apply contractual and technical safeguards and comply with section 16 of the DPDP Act and any restriction notified by the Central Government on transfers to particular countries. Logs required to be retained under the CERT-In Directions are maintained within India. The processing location of each sub-processor is stated in the sub-processor list.

2.6 How long we keep it

Set out in full in the Retention Schedule (Part 4 §6). In summary:

2.7 Security

We maintain reasonable security safeguards appropriate to the risk, including: encryption in transit (TLS 1.2+) and at rest; role-based access control and least privilege; multi-factor authentication for administrative access; secrets management; network segmentation; centralised, tamper-evident logging; vulnerability management and dependency scanning; encrypted backups with tested restoration; a documented incident-response process; and personnel confidentiality and security training. No system is perfectly secure; we do not guarantee absolute security.

2.8 Personal data breach

If a personal data breach occurs, we will:

• notify CERT-In within 6 hours of noticing the incident, where it falls within the reportable categories in the CERT-In Directions dated 28 April 2022;
• notify the Data Protection Board of India and each affected Data Principal without delay, with the information required by the DPDP Rules, and send the Board a detailed report within 72 hours (or any longer period the Board allows);
• require every partner to tell us without delay of any suspected unauthorised access to, or disclosure of, client or partner data, so that we can meet these duties;
• notify affected Clients without undue delay where their data is affected, so they can discharge their own obligations; and
• record the incident, containment steps, root cause and remediation in our incident register.

2.9 Your rights

Subject to identity verification and lawful exceptions, you may:

Response timelines. We acknowledge every request within 72 hours and respond substantively within 30 days. A grievance will be resolved within [90] days at the outside, in accordance with the DPDP Rules. Under the IT (Intermediary Guidelines) Rules, 2021 we acknowledge a grievance within 24 hours and dispose of it within 15 days.

If you are not satisfied, you may complain to the Data Protection Board of India in accordance with the DPDP Act.

Note: Making a false or frivolous grievance, impersonating another person, or suppressing material information when exercising a right is a breach of the duties of a Data Principal under section 15 of the DPDP Act and may attract a penalty.

2.10 Cookies

See the Cookie Policy at §6 of this Part.

2.11 Children

The Services are not offered to persons under 18. We do not knowingly process children's personal data as a Data Fiduciary. Where a Client's use would involve children's data, the Client is responsible for obtaining verifiable parental consent under section 9 of the DPDP Act and must not use the Services for tracking, behavioural monitoring or targeted advertising directed at children. Our AUP prohibits it. If we learn we hold a child's data without lawful basis, we will delete it.

2.12 Automated decision-making

We use automated risk scoring to detect spam, fraud and abuse, which may result in rate limiting or suspension of an Account. A human reviews any decision to suspend or terminate an Account, and the Client may appeal under clause 1.10.5 of the Terms.

2.13 Changes

We will update this Policy as law or processing changes. Every version carries a version number, effective date and archived copy. Material changes are notified at least 30 days in advance by email and in-product notice.

2.14 Google and YouTube account data

This section applies only if you choose to connect a Google account to Wapzio in order to publish to your own YouTube channel. Connecting a channel is optional, is never done without your authorisation through Google's own consent screen, and nothing in this section applies to an account that has not connected one.

What we access. When you connect a channel we request permission to upload videos to it (youtube.upload), to read your channel's basic details so we can show you which channel is connected and what has been published (youtube.readonly), and to read your basic Google profile name and picture so the connected account is identifiable in the interface (userinfo.profile).

What we store. The access and refresh tokens Google issues, your channel identifier and channel name, and a record of each video published through Wapzio. We do not store your Google password. We do not download, copy or retain the contents of your channel.

How we use it. Google user data is used solely to provide the publishing features you asked for: uploading a video you submitted, showing the connection status, and displaying your publishing history. We do not use it for advertising, we do not sell it, and we do not transfer it to any third party except where required to provide the service or by law. We do not use it to train machine-learning models, and no human reads it except where required for security or to resolve a support request you raised.

Limited Use. Wapzio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can disconnect a channel at any time from Social Media → Connect Platforms inside Wapzio, which deletes the stored tokens. You can also revoke Wapzio's access directly at Google's security settings page.

Retention. Tokens are deleted as soon as you disconnect the channel or close your Wapzio account. Records of videos you published are retained with the rest of your account data under the retention periods in §2.6 above.

By using the YouTube publishing feature you also agree to the YouTube Terms of Service. Google's handling of your information is governed by the Google Privacy Policy.

2.15 Contact us