Privacy Policy

1. Two different roles we play

This distinction matters, because it determines who you should contact about a given piece of data.

• For our own customers — we are the controller. When a business signs up for Watx, we decide how their account, billing and usage data is handled. This policy governs that data directly.
• For our customers’ customers — we are a processor. When a business connects their WhatsApp or Instagram account, the messages and contact records that flow through Watx belong to that business. They decide what to collect and why; we only store and process it on their instructions. If you messaged a business on WhatsApp and want your data removed, contact that business first — they control it. We will help them action it, and we will act on a direct request too (see §11).

2. What we collect

From the business that signs up

From the business’s own customers, on the business’s behalf

3. Data from Meta platforms

Because Meta requires apps to be specific about this, here is exactly what we take from each Meta surface and why.

Access tokens. Connecting any of these stores an access token so we can act on the business’s behalf. Every token is encrypted with AES-256-GCM before it is written to the database, is never returned to any browser, and is deleted the moment the business disconnects the channel or removes our app from their Meta settings.

4. Data from connected stores

A business can connect its own Shopify or WooCommerce store. Shopify treats a shopper’s name, email and phone as protected customer data, so here is exactly what we take and why.

We do not take shipping or billing addresses. Where an address block appears in a store’s webhook, we read it only to recover a name or phone number the order itself did not carry. No address is ever stored.

Marketing consent is respected as the store records it. A reminder about an unfinished checkout is only sent when the shopper agreed to marketing at checkout. Where the store does not say either way, we treat that as no.

Deletion is automatic. If Shopify tells us a shopper has asked to be erased, we remove their name, email and phone from that store’s orders and checkouts, and delete the contact entirely when it exists only because of that store. If the app is uninstalled, Shopify asks us to erase the store 48 hours later and we delete its orders, checkouts, products and delivery records.

5. Why we use it

• To provide the service — deliver messages, run the inbox, execute the automations and flows a business has built. This is the performance of our contract with the business.
• To keep it secure — detect abuse, verify webhook signatures, rate-limit, and investigate incidents. This is our legitimate interest in a safe service.
• To bill — process subscriptions and comply with tax and accounting law.
• To support — answer questions, which sometimes means an authorised engineer looking at a specific record with the business’s knowledge.

What we never do: we do not sell personal data, we do not share it with advertisers or data brokers, we do not use message content for our own marketing, and we do not use it to build profiles of the people a business talks to.

6. AI features

Watx includes an optional AI assistant. A business chooses which of two ways it runs on, and the choice decides where conversation content goes.

The assistant only runs when it is switched on. A workspace that never enables it sends no conversation content to any AI provider in either mode. A workspace that does enable it should assume that the messages the assistant reads in order to answer are sent to the provider for that mode.

Businesses may also upload documents (PDF, Word, plain text) or point us at a public web page to build the assistant’s knowledge base. That content is stored in the workspace, converted into search embeddings, and used only to answer that workspace’s own conversations.

We do not train AI models on your data. We do not use WhatsApp Business data, Instagram data, message content, contact records or anything derived from them to train, fine-tune or develop any machine-learning model — including in aggregated or anonymised form. This is both our policy and a requirement of Meta’s WhatsApp Business Solution Terms.

7. Google services integration

Watx allows businesses to optionally connect their Google account to access specific Google services. These integrations are entirely opt-in: no Google data is accessed unless a business explicitly authorises the connection from within the Watx settings.

These four are the only Google scopes Watx requests. All of them are classified by Google as sensitive; Watx deliberately does not request any restricted scope, including Gmail read access and any Google Drive scope.

How we use Google data. Data obtained through Google APIs is used only to provide the specific feature you have enabled. It is not used for advertising, not shared with any third party for their own purposes, and not used to train or improve any AI model. We do not combine Google user data with data obtained from other sources for profiling purposes.

Revoking access. You can disconnect a Google integration at any time from the Watx Settings page. Doing so immediately revokes our access token and stops any further access to your Google data. You can also revoke access directly from your Google Account permissions page.

Watx’s use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

8. Who we share it with

We use a small number of service providers. Each processes data only to deliver its part of the service.

We also disclose data where the law requires it — a valid court order or a binding request from a competent authority — and to a successor entity in a merger or acquisition, in which case this policy travels with the data.

9. What we send to Meta

Mostly nothing beyond the messages a business chooses to send.

10. How long we keep it

A business can delete individual contacts, conversations or messages from inside the product at any time, without waiting for any of the above.

11. Deleting your data

If you are a Watx customer

Disconnect a channel from Settings to remove its tokens immediately. To delete the whole workspace, email info@watx.in from the address on the account. We action verified requests within 30 days.

If you messaged a business that uses Watx

That business controls your data. Contact them first. If you cannot reach them, or they do not respond, write to us at info@watx.in with enough detail to identify the records — the business’s name and the phone number or Instagram handle you used — and we will locate and delete them.

If you removed our app from your Meta or Instagram settings

Meta notifies us automatically, and we delete the stored connection and its access tokens without you needing to do anything else. Meta will show you a confirmation code and a link to a status page confirming this.

12. How we protect it

• All traffic is encrypted in transit over HTTPS.
• Every third-party access token, API key and webhook secret is encrypted at rest with AES-256-GCM. Tokens are never sent to a browser.
• Every database query is scoped to a single workspace, enforced both by row-level security policies and by explicit checks in application code. One business cannot read another’s data.
• Inbound webhooks are rejected unless their HMAC signature verifies against the raw request body, so a forged message cannot enter the system.
• Requests to URLs supplied by users — page crawling, custom API actions — are filtered to block access to internal network addresses.
• Access to production data by our staff is limited to the few people who need it for support, and every administrative change made to an account is recorded.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator within the timeframes the law sets.

13. Your rights

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything inaccurate;
• delete it;
• restrict or object to how we use it;
• port it to another service in a machine-readable format;
• withdraw consent, where we relied on consent.

Email info@watx.in. We respond within 30 days and do not charge for reasonable requests. We may need to verify your identity first — the alternative is a deletion endpoint anyone can point at anyone.

If we act as a processor rather than a controller for the data in question (see §1), we will forward your request to the business that controls it and support them in answering it.

14. International transfers

We are based in India, but our providers operate globally, so your data is processed outside India. Specifically:

• our application servers and queues are in Mumbai, India;
• our database and uploaded files are in Seoul, South Korea, on Supabase’s AWS ap-northeast-2 region — this includes contacts, messages and media;
• Meta, Stripe, Google and any AI provider operate globally and may process data in the United States, the European Union and elsewhere.

Where data leaves a jurisdiction that restricts transfers, we rely on the transfer terms in each provider’s data processing agreement — Standard Contractual Clauses or the provider’s equivalent mechanism — and we require protection equivalent to this policy from every provider we use.

15. Children

Watx is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18, the age at which India’s Digital Personal Data Protection Act 2023 stops treating a person as a child. If you believe a child’s data has reached us, tell us and we will delete it.

16. Changes to this policy

We update this page when the product changes. Material changes are announced in the app and by email to workspace owners at least 30 days before they take effect. The “last updated” date at the top always reflects the current version.

17. Contact and complaints

If you are unhappy with our response you can complain to your local data protection authority — in India, the Data Protection Board; in the EU or UK, your national supervisory authority.