Privacy Policy

1. Scope & Roles

We act as a data controller (and, under India’s Digital Personal Data Protection Act, 2023, a data fiduciary) when we process data about our own website visitors, trial users, and admin users. We act as a data processor / service provider (and, under DPDP, a data processor) when we process data about our customers' end users (“End Users”) on behalf of our customers (“Customers”). Customers remain responsible for notices, consents, and lawful bases required in the countries where they and their End Users are located, including GDPR / UK GDPR, Malaysia PDPA, Indonesia’s UU PDP, Canada’s PIPEDA and CASL, US state privacy laws such as CCPA/CPRA, UAE PDPL, and India’s DPDP Act, as applicable.

2. Data We Collect

• Account & organization data – names, emails, organization details, roles, country/timezone settings, and billing-related information.
• WhatsApp & communication data – phone numbers (with country codes), WhatsApp IDs, message content and metadata (status, timestamps, pricing and conversation categories, quality and error codes), and commerce data where provided by integrations.
• Integration data – API keys or tokens and event data from third-party tools such as Shopify, WooCommerce, payment gateways, and others configured by Customers.
• Technical & usage data – IP address, device and browser information, log data, and limited cookie data used for authentication, experience, and (on public marketing pages only) Google Analytics page-view measurement. We do not send inbox, dashboard, or invite-token URLs to Google, and we do not send waitlist form fields or email query parameters as analytics events.

3. How We Use Data

We use personal data to:

• Provide, operate, and support the Services for our Customers worldwide.
• Send and receive WhatsApp messages and campaigns on behalf of Customers, in accordance with WhatsApp and Meta policies.
• Configure and maintain third-party integrations requested by Customers.
• Monitor delivery, performance, and quality, and provide analytics dashboards.
• Secure our platform, prevent abuse, and enforce our Terms of Service.
• Issue invoices and collect applicable taxes in the billed currency.
• Comply with legal obligations and respond to lawful requests.

4. Legal Bases (Where Applicable)

Where required by law, we rely on performance of contract, legitimate interests (such as security and service improvement), legal obligation, and consent (for certain marketing and messaging activities). Customers are responsible for establishing a lawful basis to message their End Users under Meta’s rules and the privacy and electronic-marketing laws that apply to those End Users.

5. Sharing & International Transfers

We may share data with infrastructure providers, Meta/WhatsApp, Google Analytics (on public marketing pages), and other third-party services explicitly connected by Customers (for example Shopify or a payment provider). WatsBerry is operated from India. Some recipients may be located outside your country, including India, the United States, and the European Economic Area. When required, we implement reasonable safeguards for such transfers. Meta processes WhatsApp traffic according to Meta’s own terms and may process data in the countries where Meta operates.

6. Data Retention

We retain data for as long as necessary to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Customers can control retention for some data (for example archiving or deleting conversations). After account closure, we delete or anonymize data within a reasonable period, subject to legal requirements in India and other applicable jurisdictions.

7. Security

We use reasonable technical and organizational measures to protect personal data, including access controls, encryption in transit, encryption of sensitive tokens at rest, and auditing of critical actions. See our Security Policy for details. No system is completely secure, but we strive to follow industry best practices.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict personal data, object to certain processing, withdraw consent, or lodge a complaint with a supervisory authority. Because we usually act as a processor for End User data, End Users should contact the relevant Customer (the business messaging them) to exercise those rights. Account holders and website visitors may contact us at [email protected]. Where appropriate, we assist Customers in responding to End User requests.

9. Changes

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. We encourage you to review it periodically.