Privacy policy

For your account details (owner and employee names, emails, phone numbers, billing details) we are the Data Fiduciary.

For the data your business brings into the Service (your customers' contacts, chats, leads and invoices) your business is the Data Fiduciary and we act as a Data Processor, processing it only to provide the Service on your instructions.

• Account data: name, email, phone number, company name, address, GSTIN and role.
• Usage data: log-ins, pages used, device and browser type, IP address, and actions taken in the panel (audit logs).
• Customer data you add: contacts, tags, notes, leads, deals, quotations, invoices and files.
• Website enquiries: name, phone, email, company and message submitted through our contact form.
• Payment data: plan, invoices and wallet transactions. Card and UPI details are handled by our payment provider, not stored by us.

We connect your WhatsApp number through the official Meta WhatsApp Business Platform (Cloud API) using Meta's Embedded Signup. When you connect, Meta shares your WhatsApp Business Account ID, phone number ID and an access token with us. Access tokens are stored on our servers only and are never shown in the browser.

Messages sent and received through your number (text, media, templates, delivery and read status) pass through Meta and are stored in the Service so your team can see the conversation history. Meta's own processing is governed by Meta's terms and privacy policy.

If you connect Meta Lead Ads, Google lead forms, IndiaMART, Justdial or similar sources, we receive the lead details those platforms share (such as name, phone, email, city and form answers) and store them in your account so your team can follow up. We use this data only to provide the Service to you and never sell it or use it for our own advertising.

• To provide, secure and improve the Service and keep your account working.
• To send and receive WhatsApp messages and sync templates on your behalf.
• To bill you, issue GST invoices and manage your wallet.
• To respond to enquiries and provide support.
• To meet legal obligations and prevent fraud, spam and misuse.

We use essential cookies and browser storage to keep you signed in and remember your preferences. The Facebook SDK may set its own cookies when you connect WhatsApp with Facebook. We do not use advertising cookies on the panel.

Data is stored with our hosting and database provider, Supabase, with encryption in transit and at rest. Each company's data is kept separate with row-level access rules, and employees see only what their role allows. No method of storage is 100% secure, but we take reasonable security safeguards as required by the DPDP Act.

We share data only with service providers who help us run the Service (such as Meta for WhatsApp messaging, our hosting provider, payment and email providers), when required by law, or with your consent. We do not sell personal data.

We keep account and customer data while your account is active. After you close your account or ask for deletion, we delete or anonymise it within 30 days, except records we must keep by law (such as invoices and tax records, kept for up to 8 years).

Under the DPDP Act you can:

• Ask for a summary of the personal data we process about you.
• Ask us to correct, complete or update your data.
• Ask us to erase your data and withdraw consent.
• Nominate another person to exercise your rights.
• Raise a grievance with us, and then with the Data Protection Board of India.

See our data deletion page for how to request deletion. Customers of a business using our Service should contact that business first.

For privacy questions or grievances, contact:

Hatflow Agency
Concourse level, Metro Station, Street Number 04, opp. Ticket Counter Entry gate, Sector 7, RRTS, Patel Nagar, Ghaziabad, Uttar Pradesh 201003
Email: officialhatflow@gmail.com
Phone: +917055481738, +916395855214

We aim to respond within 7 days and resolve grievances within 30 days.