Privacy Policy

1. Who We Are

NotifyIQ (“Platform”, “we”, “us”, or “our”) is an enterprise messaging intelligence and WhatsApp Business API (WABA) automation software provided by Aadi IT Services LLP, a limited liability partnership organized under the laws of the Republic of India.

We respect your privacy and are committed to safeguarding all personal data and communications information processed through our systems in full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Meta Platform Terms, and the WhatsApp Business Terms of Service and Policies.

2. What Data We Collect

We adhere strictly to data minimization principles. We only collect and process data that is strictly necessary for providing the NotifyIQ WABA automation services:

• Account & Workspace Profile Data: Full name, corporate email address, business name, encrypted credentials, billing address, and referral attribution when provisioning a workspace account.
• Meta Platform & WABA Credentials: When you connect your WhatsApp Business Account via Meta Guided Embedded Signup or manual entry, we store your Meta Business Account ID, WhatsApp Phone Number ID, display phone number, and a system user access token.
• WhatsApp Messaging Data & Metadata: Inbound and outbound message text bodies, media identifiers, message delivery statuses (sent, delivered, read, failed), timestamps, and conversation sentiment tags required for real-time customer care and conversation threading.
• Customer Contact Directory: Phone numbers in E.164 format, contact names, user-defined CRM tags, consent confirmation timestamps (consentGiven), and opt-out preferences.
• System & Diagnostic Logs: Outbound webhook responses, latency measurements, and Meta Graph API response logs (meta_api_logs) with authentication tokens strictly redacted.

Note: We do NOT access private social profiles, friend lists, or unrelated personal Facebook/Instagram user accounts.

3. Purpose of Processing

We process your personal and messaging data exclusively for the following operational purposes:

1. Authenticating users and isolating multi-tenant workspace environments.
2. Facilitating bidirectional messaging via the Meta WhatsApp Cloud API v20.0.
3. Executing visual flow automations, keyword triggers, and AI-grounded customer assistance.
4. Managing broadcast campaign dispatches to consent-verified recipients within Meta rate limits.
5. Generating delivery SLA metrics, containment analytics, and statutory tax invoices (18% GST HSN 998314).
6. Maintaining immutable compliance audit logs for statutory legal verification.

4. Legal Basis for Processing

Our processing operations are legally grounded in:

• Contractual Performance: Processing necessary to fulfill our service agreement and provide WABA automation.
• Explicit Consent: Valid consent collected for broadcast messaging under Section 6 of the DPDP Act 2023 and Article 6(1)(a) of the GDPR.
• Compliance with Legal Obligations: Retaining financial transaction and audit records pursuant to Indian tax and accounting regulations.

5. Data Storage, Isolation & Security

We apply defense-in-depth technical and organizational security controls:

• Encryption at Rest: All Meta permanent access tokens, webhook secrets, and sensitive integration keys are encrypted using AES-256-GCM with an authenticated initialization vector and verification tag (iv:authTag:ciphertext).
• Encryption in Transit: All web traffic and WebSocket communication are enforced via TLS 1.3 encryption.
• Multi-Tenant Data Isolation: Every database query and socket room is scoped strictly to the authenticated tenant workspaceId, preventing any cross-tenant data visibility.
• Geographic Residency: Primary production databases are hosted in certified Tier-III data centers located in Mumbai, India (ap-south-1).

6. Data Sharing & Third Parties

We never sell, rent, monetize, or trade customer contact records or WhatsApp message content to data brokers, advertisers, or third-party marketers.

We only transmit data to trusted sub-processors strictly required to fulfill the service:

• Meta Platforms, Inc. / Meta Platforms Ireland Ltd.: Transmitting outbound and receiving inbound WhatsApp Cloud API payloads.
• Cloud Infrastructure & Database Providers: Managed database clusters (MongoDB Atlas), in-memory queue brokers (Redis), and cloud hosting providers under strict data protection addendums.
• Payment Processors: Stripe Inc. and Razorpay Software Private Ltd. for secure processing of subscription payments without storing raw credit card details on our servers.

7. Data Retention & Erasure

We retain personal data for as long as your workspace account remains active. Upon workspace termination or contact deletion:

• Individual contact records, conversations, and message histories are wiped immediately through an atomic cascading deletion pipeline.
• Financial records and transaction invoices are retained for the statutory period mandated by Indian tax legislation.

8. User Rights & How to Request Deletion

Under the DPDP Act 2023 and GDPR, you have the following rights:

• Right to Access & Portability: You can export all contacts, messages, and audit logs into a standardized ZIP archive directly from the console.
• Right to Rectification: Update contact attributes or workspace information at any time.
• Right to Erasure (“Right to be Forgotten”): Permanently delete contacts or request full workspace account eradication.

9. Cookies & Local Storage

NotifyIQ uses essential session cookies and local storage tokens (notifyiq_token, notifyiq_workspace) strictly to maintain authenticated user sessions and UI workspace preferences. We do not use third-party behavioral advertising tracking cookies.

10. Meta Platform & WhatsApp Policy Compliance

NotifyIQ operates in strict accordance with:

• Meta Platform Terms: Ensuring data accessed through Meta APIs is never used for surveillance or sold.
• WhatsApp Business Terms of Service: Complying with messaging tier caps, opt-in consent mandates, and content restrictions.
• WhatsApp Business Policy: Zero tolerance for unsolicited promotional spam or prohibited categories.
• Instagram Platform Policies: Ensuring future multi-channel capabilities adhere to Meta ecosystem integrity standards.

11. Children's Privacy

NotifyIQ is exclusively a business-to-business (B2B) communications tool and does not knowingly collect or solicit personal data from children under the age of 18.

12. Contact Details & Grievance Redressal

For privacy inquiries, data subject access requests, or regulatory questions, please contact our designated Grievance & Privacy Officer: