Privacy Policy

aiwavo ("aiwavo", "we", "us", or "our") provides a WhatsApp broadcast messaging platform that lets businesses ("Customers", "you", when referring to a registered account holder) manage contacts, message templates, and campaigns sent to their own end customers ("Contacts") over WhatsApp. This Privacy Policy explains what data we collect, why, how it's used, and the choices available to you. It applies to our website, application, and the WhatsApp messaging services we provide.

1. Information We Collect

1.1 Account & Company Information

When a company is onboarded and its team members are created, we collect: company name, business email, phone number, GST number, website, address, and logo; and, for each user, name, email address, mobile number, role, and profile photo.

1.2 Contact Data You Upload

As a Customer, you may upload or add your own end customers as Contacts to send WhatsApp messages to. This typically includes a Contact's name and phone number, and any groups or tags you assign for organization. You are responsible for having a lawful basis and appropriate consent to provide us with this data and to message these Contacts — see Section 6.

1.3 WhatsApp Business Account Data

To send messages on your behalf, you connect your own WhatsApp Business Account (WABA) via Meta. We store the identifiers Meta issues for that connection (WABA ID, phone number ID) and an access token that authorizes us to send messages through Meta's WhatsApp Business Platform on your behalf. Access tokens are encrypted at rest and are never displayed back to you or any other user after being saved.

1.4 Message & Campaign Data

When you create message templates and send campaigns, we store the template content, the campaign's target audience (a group, a tag, or all Contacts), and, for each message sent, its delivery status (queued, sent, delivered, read, or failed) as reported back to us by Meta. We do not read or use the content of your messages for any purpose other than sending them and showing you their delivery status.

1.5 Billing Information

We keep records of payments made for your subscription — amount, currency, payment method, transaction/reference numbers, and invoice details. We do not process card payments ourselves and do not store card numbers or other card details on our servers.

1.6 Usage & Log Data

We keep an audit log of significant account actions (for example, who created or paused a team member, updated a connection, or changed a setting) for security and accountability purposes, along with standard application logs and a session cookie used to keep you signed in.

2. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the platform, including sending WhatsApp messages you request on your Contacts' behalf;
• Authenticate accounts and enforce role-based access within your company;
• Show you delivery, read, and failure status for campaigns you send;
• Detect and process opt-outs when a Contact replies to stop receiving messages (see Section 6);
• Send transactional emails, such as account verification and activation emails;
• Maintain security, investigate misuse, and keep an audit trail of account activity;
• Bill for and administer subscriptions; and
• Comply with legal obligations and enforce our terms.

We do not sell personal data, and we do not use your Contacts' data to advertise to them on our own behalf.

3. Third Parties We Share Data With

We share data only as needed to operate the service:

• Meta / WhatsApp Business Platform. Message content, recipient phone numbers, and template data are transmitted to and processed by Meta in order to deliver your messages, in accordance with Meta's own Business/WhatsApp Business Data Processing Terms. Meta acts as an independent data controller/processor for this processing.
• Email delivery providers. We use a transactional email provider (such as Brevo) or SMTP relay to send account verification, password-setup, and notification emails.
• Hosting infrastructure. Application data is hosted on our infrastructure provider's servers.

We do not share your data with third parties for their own independent marketing purposes.

4. Data Security

WhatsApp access tokens, SMTP/API credentials, and other sensitive configuration values are encrypted at rest. Passwords are hashed and are never stored or transmitted in plain text — including during account creation, where new team members set their own password via a verified, single-use, time-limited link rather than receiving a password by email. Access to company data is scoped so that one company's users, contacts, and campaigns are never visible to another company.

5. Data Retention

We retain account, contact, and campaign data for as long as your account is active, or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your company's account and associated data as described in Section 7.

6. Your Contacts' Rights and Opt-Outs

Any individual who receives a WhatsApp message through our platform can stop receiving messages at any time by replying with a standard opt-out keyword (such as STOP, UNSUBSCRIBE, or CANCEL) to the sending number. We record this opt-out and future campaigns will automatically exclude that Contact until they opt back in. Customers are responsible for ensuring their own use of the platform, and the Contacts they upload, complies with applicable messaging consent laws in their jurisdiction.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data, or to object to or restrict certain processing. To exercise any of these rights, contact us using the details in Section 10.

8. Cookies

We use a single essential session cookie to keep you signed in after login. We do not use third-party advertising or tracking cookies on this application.

9. Children's Privacy

Our platform is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of the rights described above, contact us at privacy@aiwavo.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.