Privacy Policy

1. Scope & Roles (Controller vs. Processor)

This Privacy Policy explains how inframindhq.online (“WhatsFlow”, “we”, “us”, or “our”) collects, uses, protects, and discloses personal information and business data when you visit our website, register for an account, or utilize the WhatsFlow software-as-a-service platform.

Under applicable data protection laws:

• WhatsFlow as a Data Controller: We act as a Data Controller with respect to our direct customers’ account information, business contact details, billing metadata, and usage preferences necessary to administer your subscription.
• WhatsFlow as a Data Processor: We act as a Data Processor on behalf of our business customers with respect to the recipient phone numbers, contact lists, and message payloads uploaded to or routed through the WhatsFlow automated flows. The customer remains the Data Controller for their end-user recipient data.

2. Information We Collect

To provide flat-rate automated WhatsApp messaging, customer dashboards, and campaign tracking, WhatsFlow collects and processes the following categories of information:

3. Why We Collect & How We Use Your Data

We use the information collected strictly for legitimate business operations and contractual delivery:

• Service Provisioning: Authenticating accounts, hosting industry workflow templates, establishing live WhatsApp connections, and executing automated keyword replies and booking schedules.
• Message Routing & Campaign Dispatch: Delivering scheduled broadcasts and dynamic conversation flows to your contacts via either the self-hosted gateway client or Meta Cloud API webhooks.
• Administrative Verification: Performing manual review of prospective business signups to ensure messaging compliance, prevent abusive spam, and verify valid commercial use cases.
• Billing Administration: Tracking plan thresholds, calculating agreed overage limits, verifying setup fees, and processing renewal orders through Razorpay.
• Customer Care & Diagnostics: Resolving support tickets, debugging message failure codes, and monitoring server performance.

4. Third-Party Sub-Processors & Data Processors

We share data with trusted third-party service providers solely to the extent necessary to deliver the WhatsFlow platform. We do not sell personal data to advertisers or data brokers. Our principal sub-processors are:

5. Data Retention & Deletion Procedures

We retain your information only as long as necessary to maintain active platform services, fulfill legal obligations, and resolve commercial disputes:

• Active Accounts: Uploaded contact lists, customer profiles, automation workflows, and active connection tokens remain stored while your business subscription remains active.
• Message Logs: Conversational message logs, campaign delivery statistics, and webhook delivery records are retained for operational reporting during your subscription term.
• Account Cancellation & Deletion Requests: Customers may request full deletion of their account, uploaded contact lists, and message histories at any time by emailing support@inframindhq.online. Upon receipt of a verified request or upon subscription termination, customer data is permanently removed from active production databases within thirty (30) days.
• Backups & Statutory Records: Routine system backups are rotated and securely overwritten within sixty (60) days. Certain billing metadata and invoice receipts may be preserved longer strictly to comply with statutory accounting and tax reporting obligations in India.

6. Cookies, Client-Side Storage, & Analytics Tracking

We believe in minimal, purposeful client data collection. Our implementation is structured as follows:

• Essential First-Party Session Cookie: WhatsFlow uses a strictly necessary, HTTP-only, secure session cookie namedsaas_auth_session. This cookie is used solely to authenticate logged-in users, maintain authorized workspace sessions, and prevent Cross-Site Request Forgery (CSRF). It does not track user activity across external websites.
• Browser Local Storage: We utilize client-side local storage exclusively for non-sensitive interface preferences and to maintain session isolation for visitors interacting with the landing page live simulator (e.g., demo_visitor_id).
• Zero Third-Party Tracking Cookies: WhatsFlow does NOT deploy third-party advertising cookies, cross-site tracking beacons, or marketing pixels (such as Google Ads tracking, Facebook Pixel, or external retargeting scripts).
• First-Party Operational Analytics: Campaign delivery statistics (messages queued, delivered, read, or failed) are computed internally directly within our own database to give organization administrators operational transparency. This telemetry is never syndicated to external analytics brokers.

7. Your Privacy Rights & Data Subject Access

Depending on your location, you possess comprehensive rights regarding your personal and business data:

• Right to Access: You may request an electronic copy of the personal and business records we hold about your account.
• Right to Rectification: You may correct inaccurate or incomplete profile information through your dashboard settings or by notifying our support team.
• Right to Erasure (“Right to be Forgotten”): You may request permanent deletion of your organization’s account, uploaded contacts, and messaging records.
• Right to Data Portability: You may export your contact lists and campaign histories in standard CSV/Excel format directly from the dashboard.
• Right to Restrict or Object to Processing: You may request that we limit or cease specific data processing activities.

To exercise any of these privacy rights, please submit a written request to support@inframindhq.online. We verify the identity of the requester to safeguard account integrity and process valid requests within thirty (30) days without charge.

8. High-Level Technical & Organizational Security Measures

We implement robust, multi-layered safeguards designed to prevent unauthorized access, accidental alteration, or disclosure of customer data:

• Encryption in Transit: All data transmitted between client browsers, WhatsFlow application servers, and external APIs is encrypted using modern Transport Layer Security (TLS 1.2 and TLS 1.3 / HTTPS).
• Multi-Tenant Isolation: Customer accounts and contact lists are logically segmented at the database level using strict organization scoping (orgId). Workspaces cannot access or query another organization’s records.
• Access Controls: Administrative access to cloud infrastructure is restricted based on the principle of least privilege, enforcing multi-factor authentication (MFA) and encrypted SSH keys.
• Cryptographic Password Security: User credentials are encrypted using salted bcrypt password hashes; raw passwords are never written to logs or readable databases.
• Cloud Security Hardening: Relational databases and microservices are hosted within Google Cloud Platform’s enterprise environment, featuring automated patch management and DDoS mitigation.

9. International Data Transfers

WhatsFlow’s core server infrastructure, computational microservices, and databases are hosted on Google Cloud Platform in the us-central1 (Iowa, USA) cloud region.

If you access our services from India, the European Union, the United Kingdom, or other international territories, your information is transferred to, stored, and processed in Google Cloud data centers located in the United States. Google Cloud Platform complies with leading international privacy and security standards (including ISO/IEC 27001, SOC 1/2/3, and PCI-DSS Level 1) and implements standard contractual clauses to safeguard cross-border transfers.

10. Children’s Privacy

WhatsFlow is a commercial B2B software tool intended strictly for use by businesses, professionals, and adults aged 18 or older. We do not knowingly solicit, collect, or process personal information from children under the age of 18. If we discover that personal data of a minor has been mistakenly collected, we will immediately delete the relevant records from our active servers.

11. Modifications to this Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in our software architecture, service offerings, or relevant statutory requirements. When revisions occur, we will update the “Last Updated” date at the top of this document. In the case of significant changes, we will provide additional notice, such as sending an email update or displaying an informational banner within the customer dashboard.

Your continued use of WhatsFlow following the publication of revised terms constitutes your informed acknowledgment and acceptance of the updated Privacy Policy.

12. Contact Information & Data Protection Inquiries

For questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our data team: