Privacy Policy

1. Who this policy covers

Ematrix WhatsApp Cloud is used by businesses (our "customers") to send and receive WhatsApp messages such as one-time passwords, appointment and booking notifications, and opted-in marketing messages.

• For customer account data (people who sign in to the dashboard or use our API), Ematrix decides how the data is used and is responsible for it.
• For end-recipient data (the people our customers message), the business sending the message decides why and how it is processed. Ematrix processes that data only on the business's instructions to deliver the service.

2. Data we process

• Account data: name, email address, organization details, role, and a securely hashed password.
• Messaging data: recipient WhatsApp phone numbers, message templates, message content and variables, delivery and read statuses, and replies received from recipients.
• Contact and consent data uploaded by businesses: names, phone numbers, tags, opt-in and opt-out records.
• Technical data: IP addresses, browser/user-agent information, API request logs and security events used to operate and protect the service.
• WhatsApp Business Account identifiers and access credentials connected by businesses (stored encrypted).

One-time passwords are stored only as irreversible cryptographic hashes and are never readable by our staff.

3. How we use data

• To send, deliver and track WhatsApp messages requested by our customers.
• To honour opt-outs and consent preferences, including STOP requests.
• To authenticate users, prevent fraud and abuse, and secure the platform.
• To provide analytics, usage metering and support to our customers.
• To comply with legal obligations.

We do not sell personal data and we do not use message content for advertising.

4. Sharing

• Meta Platforms — messages are transmitted through the WhatsApp Business Platform (Cloud API) and are subject to WhatsApp's own terms and privacy policy.
• Infrastructure providers that host our servers and databases under confidentiality obligations.
• The business you interact with — delivery statuses and replies are made available to the business that sent the message.
• Authorities, where required by law.

5. Retention

• Message content is purged after 90 days by default; delivery metadata may be kept longer for reporting and billing.
• Raw webhook payloads are purged after 14 days. API request logs are deleted after 180 days.
• Account data is kept while the account is active and deleted on request, subject to legal requirements.
• Opt-out records are kept as long as needed to keep honouring them.

6. Security

Data is encrypted in transit (HTTPS/TLS). Access tokens and webhook secrets are encrypted at rest with AES-256-GCM. Access is restricted by role, every organization's data is isolated, and administrative actions are audit logged.

7. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may request access to, correction of, or erasure of your personal data, and withdraw consent. To stop receiving WhatsApp messages from a business, reply STOP to that business. If you received messages from a business using our platform, you can also contact that business directly. See our Data Deletion page.

8. Children

The service is intended for businesses and is not directed at children under 18.

9. Changes

We may update this policy. The effective date above shows the latest version.

10. Contact and grievances

Ematrix Institute of I.T., 1st Floor, Khan Complex, Main Road, near HDFC Bank, Srinagar, Jammu & Kashmir 191121, India. Email: info@ematrixsoftwaresolutions.com. We aim to respond to privacy requests and grievances within 30 days.