Privacy Policy

1. Scope & agreement

This Privacy Policy applies to the WhatsInfinity web application, APIs, and related services (the "Service") operated by Jaimik.com ("we", "us", "our"). By creating an account, connecting Meta/WhatsApp assets, or otherwise using the Service, you agree to this Policy and our Terms of Service.

If you use the Service on behalf of a business, you represent that you have authority to bind that business and that you will provide appropriate notices to your customers and staff.

2. Roles: controller vs processor

• Jaimik.com is the data controller for account data, billing records, platform logs, and information we need to operate and secure the Service.
• For end-customer data you upload or sync (phone numbers, message content, lead form answers, etc.), you are the data controller and we act as a data processor processing that data on your documented instructions to provide messaging, automation, and reporting.
• Meta Platforms Technologies (Facebook, Instagram, WhatsApp) are independent controllers for data processed under their own terms when you use their products.

3. Information we collect

3.1 Account & identity

• Name, email address, username, password hash, role (agency/client), business name
• OAuth identifiers if you sign in with Google or Facebook (where enabled)
• Agency–client relationships, invite metadata, plan and usage limits

3.2 WhatsApp & Meta Business data

• WhatsApp Business Account (WABA) ID, phone number ID, display phone number, verified business name
• Encrypted WhatsApp / Meta user access tokens and token expiry metadata
• Approved message template names, languages, categories, components, and sync status
• Message delivery status (queued, sent, delivered, read, failed) and related logs
• Webhook events received from Meta (including delivery receipts and, where configured, leadgen events)

3.3 Customer & campaign data (your data)

• Customer phone numbers, names, tags, custom fields, opt-in notes you store
• WhatsApp Business-scoped User IDs (BSUIDs), customer @usernames when Meta provides them, and your business @username if you reserve one — used to deliver messages when a phone number is not available
• Flow assignments, broadcast recipients, queue and execution history
• CSV import files and mapping configuration you provide

3.4 Lead Ads (Facebook / Instagram)

• Facebook Page ID, lead form ID, field mapping configuration
• Lead identifiers and field values retrieved via Meta APIs (e.g. leads_retrieval) after a leadgen webhook
• Processing logs (success/failure, timestamps) for troubleshooting

3.5 Facebook Pages lock

• When you connect Facebook for Lead Ads, you choose which Pages belong to this WhatsInfinity workspace. We store those Page IDs and related tokens so the same login cannot switch to another portfolio later without disconnecting and reconnecting.
• Page names, IDs, and webhook subscriptions needed to receive leadgen events for the locked Pages

3.6 Meta Pixel / Conversions API (CAPI)

• Optional Pixel / dataset ID and access token you configure under Marketing / Ads & Tracking settings
• Server-side conversion events we send to Meta on your instruction (for example lead stage changes, CRM milestones, Click-to-WhatsApp / messaging events, or website-style test events when you run a test)
• Event payloads may include hashed customer identifiers (for example phone or email hashed per Meta requirements), event name, event time, action_source, and optional test_event_code when you request Test Events visibility in Events Manager
• We do not sell CAPI data. Events are sent only to the Meta dataset you connect, to improve ad measurement and optimization for your business.

3.7 Marketing Messages & activity sharing

• If you enable WhatsApp Marketing Messages / related Meta marketing features, we may exchange the configuration and activity signals Meta requires (for example eligibility, template association, and delivery-related metadata) so those features work in your workspace.
• Activity sharing with Meta follows Meta's product settings and your workspace toggles.

3.8 Ads API (optional)

• If you connect Meta Ads permissions (for example ads_read / ads_management where granted), we may read ad account / campaign metadata needed to link Click-to-WhatsApp ads, datasets, or reporting surfaces you enable in Settings.
• We do not change your ad spend without an explicit product action you initiate in the Service.

3.9 Mobile app device access

• Contacts: optional import into your CRM. Nothing is uploaded until you select contacts and confirm import.
• Camera, photos, and documents: optional. Used only when you attach media in customer chat to send through WhatsApp Cloud API during an open messaging session.
• Push tokens: if you enable notifications for inbound messages and account alerts.
• Biometrics: Face ID / fingerprint stay on-device; we store only an unlock trust token.
• The Android app is distributed via Google Play (Play listing). Mobile analytics and crash reports use opaque account identifiers where possible.

3.10 Google Calendar (optional)

• Only if you connect Google Calendar in Settings: OAuth tokens for the Google Calendar API scope calendar.events, plus your Google account email used to identify the connection
• Calendar event IDs we create for your lead follow-up tasks (so we can update or delete the matching event later)
• Event title/description content derived from follow-up details you already store in WhatsInfinity (due time, contact type, lead/context summary)—not a full dump of your other calendars

3.11 Technical & security

• IP address, browser type, device class, approximate region from IP
• Authentication sessions, refresh tokens, audit logs for sensitive actions
• Error reports and performance metrics needed to maintain the Service (web exceptions via Google Analytics / Firebase; mobile crashes via Firebase Crashlytics). Reports use an opaque account id, not your email or phone.

4. How we use information

• Provide, maintain, and improve the Service (dashboards, queues, templates, analytics)
• Authenticate users and enforce role-based access per workspace
• Sync optional Google Calendar events for scheduled lead follow-ups when you connect that integration
• Send optional Meta Conversions API / Pixel events and Marketing Messages activity signals you enable
• Send service-related email (security alerts, plan expiry, support)
• Comply with law, respond to lawful requests, and enforce our terms
• Detect abuse, fraud, and policy violations

We do not sell personal information. We do not use your customer lists or lead data for our own advertising or to build unrelated profiles.

5. Legal bases (where applicable)

Depending on your jurisdiction, we rely on one or more of:

• Contract: to deliver the Service you subscribed to
• Legitimate interests: security, fraud prevention, product improvement (balanced against your rights)
• Legal obligation: tax, regulatory, or court requirements
• Consent: where required for optional integrations or marketing communications from us

You (the business user) must establish your own lawful basis and consent for messaging your customers and for Lead Ads collection text on Meta forms.

6. Meta Platform & WhatsApp Business Platform

Our Service integrates with Meta products under the Meta Platform Terms, Developer Policies, and WhatsApp Business Platform / Commerce policies. When you connect:

• We receive and store tokens and identifiers necessary to call Meta APIs on your behalf
• We send messages only as instructed by your templates, flows, and broadcasts
• We subscribe to webhooks for message status and (if enabled) leadgen events
• We may send hashed conversion events to your Meta dataset when you enable Pixel / CAPI, and share Marketing Messages activity when you turn that on
• Facebook Pages you lock at connect time stay bound to this workspace until you disconnect

Meta may process data according to its own privacy policies. You can review Meta's policies at facebook.com/privacy and WhatsApp Business documentation.

7. Facebook Login, Google Login & permissions

If you use Facebook Login or Google Login, we receive information permitted by those flows (typically email, name, and profile identifier) to create or link your account. We request only permissions needed for WhatsApp Embedded Signup, Lead Ads, Page management, and (when you enable it) Google Calendar follow-up sync—not legacy social graph permissions such as friends lists.

You may revoke app access in Facebook Settings → Apps and Websites or Google Account → Security → Third-party access; revoking access may disable integrations until you reconnect. See data deletion instructions for removing data stored on our servers.

8. Google Calendar integration

Google Calendar is optional. You connect it from Settings → Google Calendar (or Follow-ups). We request the Google OAuth scope https://www.googleapis.com/auth/calendar.events so WhatsInfinity can create, update, and delete calendar events that correspond to lead follow-up tasks you schedule in the Service.

• Each synced event includes the follow-up time, a short lead/context summary, and reminders (typically 15 minutes and 1 hour before)
• If you reschedule or cancel a follow-up in WhatsInfinity, we update or delete the matching Google Calendar event
• When enabled by the workspace owner, follow-ups assigned to staff may also be copied to the owner's connected calendar
• We do not use this scope to read or modify unrelated calendar events, access Gmail, Drive, or Contacts, or use calendar data for advertising
• OAuth tokens are stored encrypted. You can disconnect Google Calendar in Settings at any time; we then stop syncing and revoke the stored tokens. You can also revoke access in your Google Account settings

Google processes calendar data under its own policies. Review Google's privacy documentation for how Google handles your Google Account data.

9. Lead Ads & leads_retrieval

When you map a Lead Ad form, Meta may notify us of a new lead. We use Meta's APIs to retrieve form field values only for leads associated with Pages and forms you authorize. We use this data to:

• Create or update a customer record in your isolated workspace
• Optionally enroll the contact in a WhatsApp automation flow you configured
• Display processing status in your dashboard and logs

You must ensure lead form privacy disclosures mention your business, purpose, and how individuals can contact you for access or deletion. We process lead data only to provide the Service to you.

10. Sharing & disclosure

We may share information only in these situations:

• Service providers: hosting, email, monitoring, and crash reporting (Google Firebase / Analytics)—under contracts requiring confidentiality and security
• Meta / Google: as required to operate integrations you enable
• Legal: if required by law, court order, or to protect rights, safety, and integrity
• Business transfer: in connection with a merger or acquisition, with notice where required

We do not share customer phone lists with other tenants or unrelated third parties.

11. International transfers

Primary infrastructure may be located in India. If data is accessed from other countries, you acknowledge that laws may differ. Where required, we implement appropriate safeguards (contractual clauses, encryption, access controls).

12. Security measures

• HTTPS/TLS for data in transit
• Encryption at rest for sensitive tokens (e.g. WhatsApp and Google Calendar OAuth tokens)
• Role-based access, tenant isolation by client/agency workspace
• Parameterized database queries, input sanitization, rate limiting on authentication
• Audit logging for high-risk administrative actions

No method of transmission or storage is 100% secure. Report suspected incidents to support@whatsinfinity.com promptly.

13. Retention

• Active subscription: account and operational data retained while the account is active
• Terminated account: removed immediately when you delete in the mobile app, or within 30 days of a confirmed email request. In-app deletion sends a confirmation email to your registered address.
• Google Calendar connection: tokens and event-link metadata retained while connected; removed when you disconnect or delete the account (events already created in Google Calendar remain until you delete them in Google or we delete them as part of follow-up cancellation while still connected)
• Message logs: typically retained up to 7 days unless your plan or configuration states otherwise
• Webhook forward logs: may be retained up to 7 days for operations
• Billing records: retained as required by tax and accounting law

14. Your rights (including DPDP)

Subject to applicable law — including India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025, and GDPR where relevant — you may:

• Request a summary of personal data we hold about your user account
• Correct inaccurate account data
• Request deletion or export (see data deletion — includes in-app Delete account in Settings)
• Withdraw consent where processing is consent-based (e.g. optional analytics), as easily as you gave it
• Nominate another individual to exercise rights on your behalf where the law provides for nominees
• Lodge a complaint with the Data Protection Board of India (when operational for your complaint type) or another competent supervisory authority

Email support@whatsinfinity.com with the subject "Data rights request". We aim to respond within 90 days (or sooner where law requires). End consumers of your WhatsApp/Lead Ads should contact your business first; we assist you as processor when instructed.

15. Children (under 18)

Under the DPDP Act, a "child" is anyone under 18. The Service is a B2B product for businesses and users aged 18+. We do not knowingly offer the Service to children, do not use children's data for tracking or targeted advertising, and do not knowingly collect personal information from children. If you believe a child's data was submitted in error, contact support@whatsinfinity.com and we will delete it promptly. You must not use the Service to message or profile children in violation of Meta policies or applicable law.

16. Cookies & similar technologies

Essential cookies keep you signed in. Optional Google Analytics loads only after you Accept on our cookie banner (Reject and Cookie Policy details are equally available). See the Cookie Policy for tools, purposes, and how to change your choice later via Cookie settings in the site footer.

17. Marketing & communications from us

We may email you about product updates, security, billing, or policy changes related to your account. Non-essential marketing emails are not pre-ticked at signup; you may opt out where offered. Transactional and legal notices may still be sent.

18. Your obligations to your customers

As a business user you agree to:

• Obtain free, specific, informed opt-in before WhatsApp marketing or promotional messages (no pre-ticked boxes)
• Keep a record of who consented, to what, and when, where practical
• Honor opt-out / STOP and consent withdrawal as easily as opt-in
• Use approved templates and correct categories (Marketing vs Utility vs Authentication)
• Comply with Meta restrictions (including US marketing limitations where applicable)
• Maintain accurate privacy notices on websites and lead forms; avoid dark patterns

See WhatsApp API Compliance.

19. Security incidents & breach notice

• We maintain reasonable security safeguards (TLS, token encryption, access control, logging) as described above
• If a personal data breach is likely to affect you, we will notify affected users without undue delay and inform the Data Protection Board with required particulars (target: within 72 hours of becoming aware, as Rules require)
• Cyber incidents meeting CERT-In criteria are reported to CERT-In within 6 hours of noticing them, as directed
• Report suspected incidents to support@whatsinfinity.com

20. Grievance Officer

For complaints about personal data or service grievances under applicable Indian law (including DPDP and IT Rules):

• Name: Nishu Agrawal
• Designation: Grievance Officer / Data Protection Contact
• Email: support@whatsinfinity.com
• Phone: +91 8200670752
• Address: Jaimik.com, 813, Western Business Park, Opp. SD Jain School, Vesu, Surat, Gujarat, 395007, India

We acknowledge online-shopping / consumer complaints within 48 hours where those Rules apply, and aim to resolve them within one month. Data-protection complaints are answered within 90 days at the latest.

21. Changes to this Policy

We may update this Policy to reflect legal, technical, or product changes. Material changes will be posted on this page with an updated "Last updated" date. Continued use after the effective date constitutes acceptance where permitted by law.

22. Contact & data protection requests

Jaimik.com
813, Western Business Park, Opp. SD Jain School, Vesu, Surat, Gujarat, 395007, India
Email: support@whatsinfinity.com
Support: support@whatsinfinity.com

User data deletion: https://whatsinfinity.com/data-deletion

This Policy is general information about how we handle data for WhatsInfinity. It is not legal advice. DPDP core duties and penalties are currently planned to apply from 13 May 2027 unless the Government notifies an earlier date — we design for that standard now.