Privacy Policy

Your account. When you sign up or are invited to a workspace, we decide how your account details are used, so we are responsible for them.

Your customers' data. The contacts, messages and files a workspace adds to WAdesk belong to that workspace — the business using it. The business decides why and how they are used and is responsible for having permission to message people. We process that data on the business's behalf, only to provide the service (our Terms of Service set out how). If you are a customer of a business that uses WAdesk, please contact that business about your data.

• Account and team: email address, name, workspace name, role, and your password — which is stored only as a salted hash by our sign-in provider; we never see it.
• Business details you give us: for example your business name, industry, website, phone number and country, used to set up your workspace.
• Workspace data you add: contacts (phone number, name, email, country, tags, custom fields, notes, opt-in status and source, and when consent was given or withdrawn), conversations and messages (text, media, delivery status, timestamps), message templates, campaigns and their recipient lists, quick replies, automation rules and saved segments.
• WhatsApp connection: your WhatsApp Business Account ID, phone number ID and display number, and the access token that lets WAdesk send and receive messages for that account (and, for numbers connected manually, the app secret). Tokens and secrets are encrypted before they are stored, are never shown again after saving, are never included in exports and are never sent to your browser.
• Billing: your plan, billing status and the subscription and payment references our payment provider returns. Card and bank details are entered with the payment provider and never reach our servers.
• Browser notifications: if you allow notifications in your browser, a push subscription for that browser, so we can alert you about new messages and reminders. You can turn it off at any time.
• Technical data: our hosting provider's server logs (IP address, browser type, pages requested, time) for security and reliability.

When you connect WhatsApp through Meta's sign-up window (Facebook Login for Business), Meta asks you to grant WAdesk access to your WhatsApp Business Account. We then receive the IDs of the business account and phone number you chose and an access token for them. We do not receive or store your Facebook profile, friends, posts or password.

We use this information only to provide the messaging features you asked for — sending and receiving messages, managing templates and showing delivery status — never for advertising, and we don't sell or share it with anyone except as described in this policy. You can remove WAdesk's access at any time in your Meta Business settings or Facebook settings.

• To provide the service: send the messages you ask us to send, show your inbox, run your automations and show your analytics.
• To email you about your account: confirmations, password resets, team invitations, receipts and important service notices.
• To bill your subscription.
• To keep the service secure and reliable, investigate abuse and fix problems.
• To meet legal obligations.

We do not sell personal data. WAdesk contains no advertising and no third-party tracking.

Messages are sent and received through the WhatsApp Business Platform, which is operated by Meta. Meta handles those messages under its own terms and privacy policy (see the WhatsApp Privacy Policy).

Businesses must have people's permission (opt-in) before sending them marketing messages. WAdesk records each contact's consent status and honours opt-out requests such as “STOP”.

We rely on a small number of providers (sub-processors) to run WAdesk. They process data only to provide their service to us:

• Supabase — database, sign-in and file storage
• Vercel — hosting and delivery of the application
• Meta (WhatsApp) — sending and receiving WhatsApp messages, and connecting your WhatsApp Business Account
• Razorpay — subscription payments
• An email delivery provider (for example Resend) — account emails such as confirmations and password resets

We may also disclose information when the law requires it, or to protect the rights, safety and security of our users and the service.

Images, videos and documents you upload to use in templates and messages are kept in cloud storage at a unique web address so that WhatsApp can fetch them. Anyone who has that exact address can open the file, so please don't upload anything confidential that you would not want reachable by link.

We use only what is needed to run the service: a sign-in session cookie that keeps you signed in, and your browser's local storage for preferences such as the light or dark theme and inbox settings. We do not use advertising, analytics or tracking cookies.

Traffic is encrypted with HTTPS. WhatsApp credentials are encrypted at rest (AES-256-GCM). Each workspace's data is isolated from every other workspace at the database level, and access inside a workspace is role-based (owner, admin, agent). Service credentials stay on the server. No system is perfectly secure — if you suspect a problem, please tell us straight away.

We keep workspace data while the workspace is active. Admins can export contacts as a CSV file and delete contacts, templates and campaigns at any time. When a workspace is closed we delete or anonymise its data within a reasonable period, unless the law requires us to keep something longer (for example billing records or security logs). Backups are overwritten on their normal schedule.

• Delete a workspace: the workspace owner can delete it from Settings → Workspace. This permanently removes its contacts, chats, templates, campaigns and automations, disconnects its WhatsApp number and cancels its subscription.
• Remove WAdesk from Facebook: if you connected WhatsApp through Meta, you can remove WAdesk in your Facebook or Meta Business settings and ask for your data to be deleted; Meta tells us and we act on the request.
• Ask us: follow the steps on our data deletion page. We confirm when it's done.

If you are a customer of a business that uses WAdesk, please ask that business to delete your details — or reply STOP to its WhatsApp messages to stop receiving them.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how it is used, receive a copy, nominate someone to act for you and withdraw consent. For your account, contact us using the details below. For data a business holds about you as its customer, please contact that business. You can also complain to your local data-protection authority. We aim to handle personal data in line with applicable law, including India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.

Our providers operate around the world, so your data may be processed in countries other than your own. Where the law requires it, we rely on appropriate safeguards for those transfers.

WAdesk is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

If we change this policy we will update the date at the top and, for significant changes, tell you by email or inside the app.

To ask a question or make a request about your personal data, contact WAdesk, which operates this service, using the contact details you were given when you signed up.