WAFollow

Legal

Privacy Policy

Last updated 19 August 2026. This policy explains what WAFollow does with personal data, both for our own website and for data we process on behalf of our customers.

1. Who we are

WAFollow ("WAFollow", "we", "us") operates the WhatsApp marketing and automation platform at https://wafollow.in. For questions about this policy or your personal data, contact privacy@wafollow.in.

2. Our two roles: controller and processor

When you visit our website, create a WAFollow account, or contact support, we act as a data controller for that information. When you use WAFollow to message your own customers, we act as a data processor on your behalf: you decide whose data is uploaded, why messages are sent, and how long records are kept. We process that data only to provide the service and according to your instructions.

3. Data we collect as a controller

  • Account data: name, business name, email address, password hash, phone number, role, and workspace membership.
  • Billing data: plan, invoices, and payment status. Card details are handled by our payment provider — we never store full card numbers.
  • Usage data: log-in events, feature usage, IP address, browser and device type, and error diagnostics.
  • Support data: messages, attachments, and correspondence you send us.
  • Marketing data: your email address if you subscribe, plus open and click events for our own emails.

4. Data we process as a processor for customers

  • Contact records: phone numbers, names, tags, custom fields, and consent state you upload or capture.
  • Message content: messages sent and received through your connected WhatsApp Business Account, including media and delivery status.
  • Meta credentials: WhatsApp Business Account ID, phone number ID, and access tokens obtained through Meta Embedded Signup, stored encrypted and scoped to your workspace.
  • Automation and campaign metadata: workflow runs, campaign membership, and analytics aggregates.

5. Why we use data (and our legal bases)

  • Contract: to create accounts, deliver the platform, send messages you request, and bill you.
  • Legitimate interests: to secure the platform, prevent abuse and spam, debug faults, and improve features.
  • Consent: for optional marketing emails and non-essential cookies. You may withdraw consent at any time.
  • Legal obligation: to keep tax and accounting records and respond to lawful requests.

We do not sell personal data, and we do not use your customers' message content to train our own general-purpose models.

6. WhatsApp and Meta

WAFollow integrates with the official WhatsApp Business Cloud API. Messages you send and receive are transmitted through Meta's infrastructure and are also subject to Meta's own terms and privacy policy. WAFollow accesses your WhatsApp Business Account only with the permissions you approve during Meta Embedded Signup, and only for the workspace that granted them. You can revoke that access at any time in WAFollow or in Meta Business settings. WAFollow does not use unofficial WhatsApp automation, scraping, or device emulation.

7. Sub-processors

We use a small set of vetted providers to run the platform: cloud hosting and database infrastructure, Meta for WhatsApp message delivery, a payment processor for subscriptions, transactional email delivery, error monitoring, and an AI provider for optional assistant features. Each is bound by contractual confidentiality and data-protection terms. The current list is available on the compliance page and on request.

8. International transfers

Data may be processed outside your country by the providers above. Where personal data leaves the EEA, UK, or India, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

9. Retention

  • Account and billing records: for the life of the account and up to 7 years afterwards where tax law requires.
  • Message and contact data: for as long as your workspace keeps it. You can delete records at any time; deletion propagates to backups within 30 days.
  • Logs and diagnostics: typically 30–90 days.
  • On account closure: workspace data is deleted or irreversibly anonymised within 30 days unless you ask for a shorter window.

10. Security

We use TLS in transit, encryption at rest, row-level database isolation between workspaces, least-privilege access for staff, audit logging, and regular dependency and security scanning. Details are on the security page.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. Email privacy@wafollow.in and we will respond within 30 days. If you are an end customer of a WAFollow user, please contact that business first — they control the data; we will support them in responding. You may also submit a request through our data deletion page.

12. Children

WAFollow is a business tool and is not directed at anyone under 18. We do not knowingly collect their data.

13. Cookies

See our cookie policy for the cookies we set and how to control them.

14. Changes

We will post material changes on this page and, where required, notify account owners by email at least 14 days before they take effect.

15. Contact

WAFollow · privacy@wafollow.in · https://wafollow.in. You also have the right to complain to your local data protection authority.