Privacy Policy

1. Who we are

WA Platform ("the Platform") is a WhatsApp business messaging service operated by ASR ERP Solutions LLP, Jalandhar Bypass Chownk, Netaji Colony, Salem Tabri, Ludhiana, Punjab 141008, India ("ASR", "we", "us"). Contact: info@asrit.in, +91 98785 24354. Grievance Officer: Raj Narayan Thakur, info@asrit.in.

2. Our role

The Platform lets businesses ("Clients") send and receive WhatsApp messages with their own customers ("End Customers") using the Client's own WhatsApp Business Account, through the WhatsApp Business Platform provided by Meta Platforms, Inc. and its affiliates ("Meta").

• For End Customer data (phone numbers, names, messages), the Client is the Data Fiduciary and ASR is a Data Processor that acts only on the Client's instructions.
• For Client account data (company details, staff logins), ASR is the Data Fiduciary.

3. Data we process

Client account and onboarding data: company name, address, website, contact details, staff names and work email addresses, passwords (stored only as secure hashes), user roles, API key identifiers (keys stored only as hashes), logo, business registration document submitted for onboarding, and login and activity logs.

WhatsApp connection data: WhatsApp Business Account ID, phone number ID, display name, business profile information (about, description, address, website, picture), message templates, and access tokens and app secrets (stored encrypted).

End Customer data (processed on behalf of Clients): WhatsApp phone number, name if provided, opt-out status, the content of messages and templates sent to and received from the End Customer, message identifiers, delivery/read/failed status and timestamps. Recipient lists may be uploaded by the Client (CSV/Excel) or provided by the Client's own systems through our API.

Technical data: server and error logs, including IP addresses of requests to the Platform.

We do not sell personal data and do not use it for advertising.

4. Why we process data

• To provide the Platform: sending and receiving WhatsApp messages, delivery tracking, inbox, templates, business profile, opt-out handling and reports.
• To onboard Clients and connect their WhatsApp numbers.
• For security, abuse prevention, support, billing and legal compliance.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), End Customer data is processed on the basis of the consent the Client obtains from its End Customers, and for legitimate uses permitted by the Act. Clients are responsible for having that consent before messaging End Customers.

5. Data from Meta and WhatsApp

When a Client connects WhatsApp to the Platform (including through Meta's Embedded Signup), we receive only the access the Client authorises: the whatsapp_business_management and whatsapp_business_messaging permissions. We use this access only to provide the Platform to that Client. We do not use WhatsApp data for advertising, do not sell it, and do not combine it across Clients. We comply with the Meta Platform Terms, the WhatsApp Business Terms of Service and the WhatsApp Business Messaging Policy.

6. Who we share data with

• Meta / WhatsApp, to deliver messages (subject to Meta's own privacy policy).
• Hosting providers: Google Cloud (Google LLC), Mumbai region, India, for the application. The database runs on ASR's own self-hosted server in India.
• Government authorities, where required by law.

Each Client's data is kept separate and is never shared with other Clients.

7. Where data is stored and how it is protected

Data is stored in India. Access tokens and app secrets are encrypted; all connections use HTTPS/TLS; access is role-based and limited to each Client's own data; incoming WhatsApp events are verified with Meta's signature; passwords and API keys are stored only as hashes. No system is completely secure. If a personal data breach occurs, we will inform affected Clients and, where required, the Data Protection Board of India, as required by law.

8. How long we keep data

• Message content and delivery records: 12 months after sending, then deleted or anonymised.
• Client account and onboarding data: while the account is active and up to 90 days after it is closed. Registration documents are deleted once onboarding is complete and no longer needed.
• Backups: up to 35 days after deletion.
• Opt-out records (phone number with an opt-out flag) are kept for as long as needed to keep honouring the opt-out.

9. Your rights

Under the DPDP Act you may ask for a summary of your personal data, its correction or erasure, grievance redressal, and to nominate a person to exercise your rights. Because the Client is the Data Fiduciary for End Customer data, please contact the business that messaged you first; you can also write to info@asrit.in and we will act on or forward your request within 30 days.

To stop receiving messages from a business on the Platform, reply STOP to its WhatsApp message. For deletion, see our Data Deletion Instructions. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Removing our access to a WhatsApp account

A Client can remove the Platform's access at any time in Meta Business Settings (Accounts → WhatsApp accounts → Partners / Apps) or by emailing info@asrit.in. When access is removed, we stop processing for that account and delete its access tokens.

11. Children

The Platform is a business service and is not directed at anyone under 18.

12. Changes to this policy

We will publish any update on this page and change the date above. For significant changes we will also notify Clients by email.

13. Contact

ASR ERP Solutions LLP, Jalandhar Bypass Chownk, Netaji Colony, Salem Tabri, Ludhiana, Punjab 141008, India · info@asrit.in · +91 98785 24354