Privacy Policy

1. Scope and operator

This policy explains how Hardeep ERP Software handles information in the WAAPI Connect website and portal. Contact us at +91 78889-17735 for privacy questions. A client business remains responsible for its own customer relationships and for the information it chooses to place in its workspace.

2. Information we process

• Account details: name, email address, account role, account status and a salted password hash. Passwords are not stored as readable text.
• Workspace records: contact names and numbers, groups, consent-source notes, campaign/template drafts, business directory entries, setup notes and support-request text.
• Meta integration data: configured business-account and phone-number identifiers, recipient numbers, message identifiers, incoming text, message types, timestamps, delivery/read events and API error information. The current connection is an administrator test integration.
• Authentication and security records: session identifiers, expiry times and limited authentication-attempt information used for access protection. The application may process a connection IP address when enforcing setup protection.
• Information you voluntarily provide when you contact us by phone or WhatsApp. Hosting and communication providers may also process operational request information under their own policies.

3. Why we use it

• Create and administer accounts, authenticate users and separate account records.
• Save, search, edit and export the workspace records requested by users.
• Perform authorized API tests and display incoming messages and status events from the configured Meta account.
• Respond to enquiries, investigate faults, protect access and handle correction or deletion requests.
• Meet applicable obligations and address misuse or disputes where necessary.

We do not sell personal information or use message content for advertising profiling. We do not use customer messages to train our own AI models. The current application does not implement AI model processing.

4. Meta and WhatsApp data

The administrator configures Meta access credentials on the server. An optional Embedded Signup/Coexistence pilot lets a signed-in account authorize its own business assets through Meta. It processes authorization codes transiently, checks granted asset permissions and stores account-linked access tokens encrypted on the server. The encryption key is stored separately in server configuration. Connection records include the authorized business account, phone identifiers, selected onboarding mode, Meta user identifier where returned, token expiry and subscription state. Short-lived onboarding attempts expire after 15 minutes. Meta controls eligibility and approval.

Only authorized integration activity should be performed. Incoming webhook signatures and configured account identifiers are checked. Removing a Meta permission or stopping an integration can stop future access but does not automatically erase records already held in this portal. Follow the deletion instructions to request removal of stored information.

5. Who receives information

Information is processed by our application and its hosting/database infrastructure on Hostinger. Meta/WhatsApp receives API requests and processes messages used through its services. If you choose a WhatsApp contact link, that interaction is also subject to WhatsApp’s policies.

Authorized administrators can manage account access. The current portal does not provide administrators with an interface to browse every client’s contact records; authorized technical operators may need database or server access to support the service or fulfil verified requests. We may disclose information when legally required or where needed to investigate abuse and protect the service.

6. Storage, security and retention

The portal uses HTTPS, salted password hashes, server-side sessions and account-scoped record queries. Meta credentials are configured on the server rather than displayed to clients. These measures reduce risk but cannot guarantee absolute security.

Workspace and integration records remain in the active database until removed through available controls, a verified request or service administration. There is currently no automatic age-based purge for all records. Sessions normally expire after 12 hours. Client users who select Remember me may keep a persistent sign-in for up to 30 days; administrator sessions remain capped at 12 hours. Password changes, suspension and sign-out can revoke sessions sooner; expired session rows may be removed during later sign-ins. Security and hosting records can follow separate operational retention settings.

Deleted active records may remain in hosting backups until those backups are rotated or removed. Where information must be retained for a valid legal or security reason, we will explain the applicable limitation when handling a request. Hosting location and cross-border processing depend on the configured infrastructure and third-party services.

7. Cookies and third-party resources

The portal uses an essential HTTP-only session cookie to keep users signed in. It is not an advertising cookie. We have not added advertising trackers or analytics SDKs to this release. When you choose to prepare an onboarding connection, the portal loads Meta’s JavaScript SDK and opens Meta authorization screens. Meta can process browser, account and permission information under its own policies. Portal styling may load fonts from Google Fonts, which can expose connection information to that provider. The public information pages use system fonts. External links are governed by the destination’s policies.

8. Your choices and requests

You can correct and remove supported workspace records, export supported records, change your password and sign out. To request broader access, correction, account closure or deletion, use Data Deletion Instructions or contact us. We may need to verify your identity and authority, particularly for customer data held by a client business. Do not send passwords or tokens to prove identity.

Client signup and account recovery

Clients may register by email or use configured Google or Facebook sign-in. Email signup may also collect a phone number, country preference and an optional referral source. A signup phone number is not OTP-verified and does not grant marketing permission. We use the returned basic name, email and provider identifier to create or recognize a client account; we do not request access to Google mail, contacts or files. We do not automatically link an existing account solely because a provider returns the same email. Client social login is separate from WhatsApp Embedded Signup and does not authorize WhatsApp assets.

New self-service accounts can sign in to a restricted portal preview. Administrator approval is required before WhatsApp connection, messaging or Meta billing access is enabled. Email verification is optional and does not approve an account. Email signup does not require a configured mail service. Verification and password recovery use time-limited, one-time links delivered through our configured email service. Token hashes and temporary OAuth security state are stored on the server; social access tokens used for identity checks are not returned to the browser. Resetting a password revokes existing portal sessions and does not lift suspension or pending approval.

9. Business responsibilities and children

Businesses must have appropriate authorization and notices for the personal information they provide, including contact data and messages. This service is intended for business use and is not directed to children. If you believe a child’s information was submitted inappropriately, contact us for review.

10. Changes and contact

We may update this policy as features or processing practices change. The effective date identifies the current version. Material changes affecting existing use will be communicated through an appropriate service channel. Contact: +91 78889-17735 · Contact page.