Privacy Policy

1. Introduction

WhatsPilot ("we", "our", "us", or "Platform") values your trust and is committed to protecting the privacy of our website visitors, customers, and registered workspace users. This Privacy Policy governs your use of the WhatsPilot software, website (https://whatspilot.app), APIs, and associated web services (collectively, the "Platform").

By creating an account, connecting a WhatsApp instance, or purchasing a subscription, you consent to the practices described in this policy.

2. Information We Collect

• Account Information: When you register, we collect your full name, work email address, telephone number, business/workspace name, and hashed password credentials.
• Authentication Data: If you sign in via Google OAuth or Firebase Phone OTP, we receive your verified email, display name, profile avatar, and verified phone number from Google/Firebase.
• Billing Information: Payments are processed via authorized payment gateways (Razorpay). We store transaction records, plan tiers, and payment receipts. We never store raw credit/debit card numbers or CVVs on our servers.
• WhatsApp Session & Messaging Metadata: WhatsApp session keys and authentication states are encrypted and stored in isolated storage volumes to sustain your connection. Customer contacts, broadcast campaign queues, auto-reply rules, and CRM stage assignments are stored securely within your tenant workspace.
• System & Device Logs: IP address, browser type, operating system, referrer URLs, and diagnostic logs for security and performance optimization.

3. How We Use Your Information

We process your data for the following lawful commercial purposes:

• To initialize, host, and maintain your WhatsPilot tenant workspace, WhatsApp session routing, and broadcast queues.
• To generate digital receipts, fulfill subscriptions, and verify payment transactions.
• To provide customer support, bug fixes, and critical account security notifications.
• To prevent fraudulent activity, spam campaigns, and violations of our Terms of Service.

4. Third-Party Service Providers

We work with vetted third-party infrastructure providers who process data strictly under confidentiality agreements:

• Payment Processors: Razorpay Software Private Limited and Cashfree Payments India Private Limited for encrypted, PCI-DSS compliant payment processing.
• Cloud & Hosting Infrastructure: Cloud server hosting and persistent volume storage under strict firewall rules.
• Authentication & Telemetry: Google LLC / Firebase for OAuth identity verification and OTP dispatch.

5. Data Retention and Security

We implement industry-standard encryption protocols (TLS 1.3 / HTTPS), hashed credentials (bcrypt), and role-based tenant isolation. Workspace data is retained as long as your account is active or as required by applicable Indian tax and financial record-keeping laws. You may request permanent workspace data deletion by contacting our privacy desk.

6. WhatsApp Multi-Device Connection & Zero-Knowledge Security

We understand that your WhatsApp account holds sensitive customer and business communications. Our connection architecture adheres to strict zero-knowledge principles:

• Native Multi-Device Pairing: QR code pairing connects via the official WhatsApp Multi-Device protocol — exactly like logging into WhatsApp Web. We never require passwords, 2FA recovery codes, or administrative access to your personal phone.
• Zero Access to Personal Chats: WhatsPilot only processes incoming and outgoing business messages routed through your configured campaigns, pipelines, and AI auto-responders. We do not read, index, download, or train AI models on personal, family, or unassociated contacts.
• AES-256 GCM Vault Storage: Session keys and cryptographic handshake tokens are stored inside isolated database vaults encrypted with AES-256 GCM. No employee or contractor can view or export your session credentials.
• Instant Revocation via Your Phone: You retain complete cryptographic ownership. You can terminate WhatsPilot's connection at any instant directly from your physical mobile device by navigating to WhatsApp > Linked Devices > Log Out.

7. GDPR & International Privacy Rights (EU, UK, & Global Users)

If you are an individual residing in the European Economic Area (EEA), United Kingdom, Switzerland, or other jurisdictions with comprehensive data protection laws, you hold the following statutory rights under the General Data Protection Regulation (GDPR):

• Right to Access & Portability: You may request an export of all personal data and workspace contact records we hold about you in a structured, machine-readable format (JSON/CSV).
• Right to Rectification: You may correct inaccurate or incomplete account and billing information at any time from your settings or via our support desk.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the permanent deletion of your workspace, customer contacts, broadcast logs, and session credentials.
• Right to Restrict or Object to Processing: You may withdraw consent for telemetry, analytics, or automated communications at any time.

To exercise any of these rights, submit a request via our Contact Desk. We respond to all verified requests within 30 days without fee.

8. Cookies & Tracking Technologies Policy

We use strictly necessary cookies to keep you securely signed in to your workspace and remember your preferences. With your consent, we also use anonymized analytical cookies (Google Analytics 4) to understand how visitors navigate our documentation and tools.

• Strictly Necessary Cookies: Required for account authentication, workspace routing, and CSRF protection. Cannot be disabled.
• Analytical Cookies (GA4): Aggregated and anonymized usage metrics. Activated only upon user consent via our cookie consent banner.
• Zero Cross-Site Ad Tracking: We do not run third-party advertising cookies, data broker pixels, or cross-site tracking beacons.

You can adjust or revoke your cookie choices at any time via the cookie settings popup on our website.

9. Non-Affiliation Disclaimer

WhatsPilot is an independent product. WhatsPilot is neither affiliated with, nor authorized, sponsored, or endorsed by WhatsApp Inc., Meta Platforms, Inc., or any of their subsidiaries.

10. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000, GDPR, and international data protection standards, questions, data requests, or grievances can be directed to our Privacy Officer: