Privacy Policy

Sndesh is a service of Aptiva AI LLP (“Sndesh”, “we”, “us”). It lets small businesses in India send WhatsApp campaigns and reminders to their own customers from their own WhatsApp Business Account, using the official WhatsApp Business Platform operated by Meta. This policy explains what data we handle, why, and the choices you have. For anything privacy-related, contact [email protected].

• Business account data: name, email address, business name and category, provided when a business signs up and uses Sndesh.
• WhatsApp Business data: when a business connects its WhatsApp Business Account through Meta’s Embedded Signup, we receive its WhatsApp Business Account ID, phone number ID, display phone number, message template names and review statuses, and an access token. Tokens are stored encrypted; we never see or store the business’s Facebook password.
• Customer contact data uploaded by businesses: phone numbers, names, and optional attributes (such as tags or appointment details) that a business imports or collects through its consent pages, together with opt-in attestations and opt-out records.
• Message delivery data: delivery, read, and failure events for campaign messages, received from Meta’s webhooks, including message identifiers and pricing categories. We do not receive or store the content of customers’ personal chats; coexistence-mode events are used solely to reflect the business’s own activity back to it.
• Payment data: order identifiers, payment identifiers, amounts, and wallet ledger entries from our payment provider (Razorpay). We never receive or store card numbers, UPI PINs, or bank credentials.
• Technical data: server logs, IP addresses on consent-page submissions (recorded as part of the opt-in evidence), and audit trails of account actions.

We use this data only to operate Sndesh: sending the campaigns a business asks us to send, showing delivery reports, collecting per-campaign fees, preventing spam and abuse (including enforcing opt-outs and sending limits), meeting legal obligations, and providing support. We do not sell personal data, and we do not use customer contact lists for advertising or for any purpose other than the instructing business’s campaigns.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP), each business using Sndesh is the data fiduciary for the customer contacts it uploads; Sndesh acts as a data processor on that business’s instructions. Businesses must only upload contacts who have consented to receive their WhatsApp messages; Sndesh records an explicit attestation at import time and maintains append-only opt-in and opt-out logs. If you are a customer of a business that uses Sndesh, direct requests about your data to that business; we honour their instructions and honour your opt-outs automatically.

We share data only with the parties needed to run the service:

• Meta Platforms (WhatsApp Business Platform): message sends, templates, and account status flow through Meta’s APIs, governed by Meta’s own terms and privacy policy.
• Razorpay: for processing payments and wallet top-ups.
• Infrastructure providers: hosting and database services; our primary database runs in the Mumbai (ap-south-1) region.

We may disclose data where required by law or to protect the safety and integrity of the service.

Personal data is stored in India (Mumbai region). WhatsApp access tokens are encrypted at rest with keys held outside the database; traffic is encrypted in transit; access is role-restricted and logged. Wallet accounting is append-only and auditable.

We keep data while an account is active and as needed for the purposes above. When a business closes its account (or asks us to), we delete its customer contacts, campaign and message records within 30 days, and revoke and delete its WhatsApp tokens immediately. Payment and tax records are retained for the period required by Indian law. Full instructions are on our data deletion page.

Business account holders may access, correct, export, or delete their data at any time by writing to [email protected] from their registered email. Customers of businesses can reply STOP (or बंद) to any message to stop receiving campaigns from that business immediately, and may contact the business or us for anything further. We respond to grievances within the timelines set by the DPDP Act.

We will post any changes to this policy on this page with a new “last updated” date. Material changes will be notified to account holders by email or WhatsApp.