Privacy Policy

WAPI (“we”, “the platform”) provides WhatsApp CRM software to businesses in India — estate agents, clinics, salons, restaurants, gyms, coaching centres and dealerships among them. This policy explains what data we hold, why we hold it, and how you get it removed.

Two kinds of people, two different roles

This distinction matters for everything below.

• Our customers are the businesses that sign up for an account. For their account data, we are the controller.
• Their customers are the people who message those businesses on WhatsApp. For that conversation data, the business is the controller and we are only the processor. We hold it on their behalf, act on their instructions, and never use it for our own purposes.

If you are a buyer who messaged a business through WhatsApp and you want your data removed, contact that business directly. They control it. If you cannot reach them, write to us at wapirealty@gmail.com and we will pass the request on.

What we collect

Account data

• Company name, business hours and timezone
• Each team member’s name, email address and role
• A one-way hash of each password (bcrypt). We never store or have any way to recover the password itself.

WhatsApp connection

When a business connects its own WhatsApp Business number through Meta Embedded Signup, we store the WhatsApp Business Account ID, the Phone Number ID, the connected number, the verified business name and an access token issued by Meta.

The access token is encrypted at rest with AES-256-GCM. A copy of our database on its own cannot be used to send messages as any customer.

Conversation data

Held on behalf of the business, as described above:

• Contact phone number and name as WhatsApp reports it
• Message content, in both directions, including images, PDFs and video
• Delivery and read receipts
• A lead score derived from the buying intent detected in messages (for example, asking about a site visit or a budget)
• Opt-out status — whether the person has asked to stop receiving messages, when, and how

Business content

Property inventory entered by the business, including addresses, prices, and builder or owner contact details. Inventory that is sent to a buyer over WhatsApp is limited to property type, configuration, size, facing, amenities and photographs. Addresses, prices, and owner or builder details are never included in an automated reply.

What we do not do

• We do not sell personal data. There is no circumstance in which we would.
• We do not use conversation content to advertise to anyone.
• We do not share one customer’s data with another. Every record is scoped to a single company and that scope is derived from the signed-in session, never from anything a browser can send us.
• We do not run third-party advertising or analytics trackers in the application.

Who else processes data

We use these providers to run the service:

• Meta Platforms — the WhatsApp Business Cloud API carries every message. Meta’s own terms and privacy policy apply to that transport.
• Render — application hosting, Singapore region
• Neon — PostgreSQL database, Singapore region
• Supabase — storage for photos, brochures and other media sent or received over WhatsApp, Singapore region
• Resend — transactional email only (address verification, password reset, team invitations). No marketing email.

Data is stored in Singapore. If you require storage inside India, contact us before signing up.

Security

• All traffic is served over HTTPS
• WhatsApp access tokens are encrypted at rest with AES-256-GCM
• Passwords are hashed with bcrypt and are not recoverable
• Sessions use signed, httpOnly cookies
• Incoming webhooks from Meta are rejected unless they carry a valid SHA-256 signature
• Roles restrict access within a company: employees can see conversations, inventory and leads, but not billing, team management or the WhatsApp connection

No system is perfect. If you believe you have found a vulnerability, please write to wapirealty@gmail.com before disclosing it publicly.

How long we keep data

• Account and conversation data is kept for as long as the account is open.
• Email verification links expire after 24 hours, password reset links after 1 hour, and team invitations after 7 days.
• When an account is closed, its data — contacts, conversations, media, inventory and team members — is deleted within 30 days.

Deleting your data

Email wapirealty@gmail.com from the address on the account and ask us to delete it. We will confirm, then remove the workspace and everything scoped to it within 30 days.

Disconnecting a WhatsApp number from the WhatsApp Connection page removes the stored access token immediately. Conversation history is kept unless you also ask for deletion.

You may also revoke WAPI’s access from your own Meta Business Manager at any time, without asking us. Doing so stops us being able to send or receive on your behalf.

Buyers who ask to stop

Any person messaging a business through WAPI can reply STOP (or similar wording, in English or Hinglish) to opt out. Opt-out is recorded against that contact and blocks broadcasts, automated replies and manual sends until they opt back in. This is enforced by the platform, not left to each business to remember.

Changes

If we change this policy in a way that materially affects our customers, we will email the account owner before it takes effect.

Contact

wapirealty@gmail.com