Privacy Policy

1. INTRODUCTION & SCOPE

This Privacy Policy ("Policy") governs the collection, processing, storage, transmission, and protection of personal data and business communication metadata by Karwadegroup (Wapflow) ("Company", "Wapflow OS", "we", "our", or "us"), operating the platform hosted at https://karwadegroup.in. By accessing our platform, registering for a tenant account, connecting Meta Cloud API credentials, or utilizing our customer engagement and AI tools, you acknowledge and agree to the practices described herein.

2. APPLICABILITY & ARCHITECTURAL SOVEREIGNTY

This Policy applies to registered business vendors ("Vendors", "Data Fiduciaries"), their authorized administrative operators ("Users"), and end-consumers who interact with Vendors through WhatsApp Cloud API and Instagram Messaging channels managed via Wapflow OS. Our multi-tenant architecture ensures strict cryptographic and database tenant isolation across all 14 operating engines.

3. DEFINITIONS UNDER DPDP ACT 2023 & GLOBAL REGULATIONS

In accordance with the Digital Personal Data Protection Act 2023:

• "Data Principal" means the individual to whom the personal data relates (including Vendors, administrative staff, and end-customers).
• "Data Fiduciary" means any person or entity who determines the purpose and means of the processing of personal data (primarily the Vendor using our platform).
• "Data Processor" means any person or entity that processes personal data on behalf of a Data Fiduciary (Wapflow OS acts as a Data Processor for end-customer conversations).
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.

4. DUAL CAPACITY: DATA FIDUCIARY VS. DATA PROCESSOR

Wapflow OS acts in two distinct capacities:

• As Data Fiduciary: For Vendor registration, account credentials, billing transactions, administrative logs, and direct inquiries sent to support@karwadegroup.in.
• As Data Processor: For customer contact lists, WhatsApp/Instagram messaging payloads, visual flow automation variables, and CRM notes maintained by Vendors on our sovereign platform.

5. INDEPENDENCE FROM META PLATFORMS, INC.

6. CATEGORIES OF DATA COLLECTED

We collect and process the following categories of information:

• Vendor Identity Data: Full name, authorized signatory designation, registered business name, corporate address, email address, phone number.
• Telecommunications & API Credentials: WhatsApp Business Account ID (WABA ID), Phone Number ID, App ID, Meta System User Tokens (encrypted via AES-256), Webhook verification tokens.
• Billing & Invoicing Records: GSTIN, transaction identifiers, subscription tier, billing address, invoice history (raw payment card/banking credentials are handled exclusively by verified PCI-DSS payment gateways).
• Telemetry & Session Data: IP address, browser type, operating system version, HTTP referrer, request timestamps, and console activity audit logs.

7. COLLECTION OF BUSINESS TELECOMMUNICATION DATA & METADATA

To deliver real-time message routing, template broadcasting, and delivery analytics, Wapflow OS processes message metadata including message timestamps, delivery status receipts (sent, delivered, read, failed), error codes returned by the Meta Cloud API, and routing identifiers (WAMID).

8. END-USER & SUBSCRIBER PERSONAL DATA

When Vendors connect their customer databases or interact with end-consumers, our servers process subscriber phone numbers, display names, profile identifiers, custom field attributes (e.g., membership level, order number), and conversational inputs. Vendors remain solely responsible for establishing the lawful basis for collecting this data.

9. STRICT PROHIBITION ON ACCESSING END-USER MESSAGE BODIES

10. AI AGENT STUDIO & DATA PROCESSING BOUNDARIES

When Vendors enable the AI Agent Studio or Flowise AI integrations:

• Conversational prompts and customer queries are transmitted via secure TLS 1.3 connections to configured large language model providers (e.g., OpenAI, Google Gemini).
• Vendor business documentation and training embeddings are partitioned per tenant and are never shared across accounts or used to train public foundational models without explicit authorization.
• Vendors retain full discretion to disable AI automated replies or require mandatory human handover at any time.

11. BOT FLOW MAKER & AUTOMATION SESSION LOGGING

Wapflow OS maintains stateful session logs for visual chatbot flows. Session states, selected interactive options, quick-reply responses, and custom variables are cached for session continuity and automatically expired following conversation completion or timeout.

12. LIVE CHAT & HUMAN HANDOVER CONVERSATION DATA

Live chat transcripts between Vendor customer support agents and end-users are recorded in the sovereign tenant database to maintain historical context, resolve customer service inquiries, and support quality assurance. Agent timestamps, internal notes, and assignment metadata are preserved per tenant configuration.

13. OMNICHANNEL CRM & CONTACT SYNCHRONIZATION

Customer contact cards, groups, dynamic tags, and interaction histories created within the Wapflow OS CRM engine remain the proprietary business assets of the respective Vendor. Vendors may export, modify, or delete their contact repositories at any time through the console.

14. E-COMMERCE STOREFRONT & INVOICING TRANSACTION DATA

For Vendors utilizing the digital storefront and product catalog features, Wapflow OS stores order details, product catalogs, customer delivery addresses, and invoice generation records. Financial fulfillment is governed by the Vendor's chosen payment integration.

15. LAWFUL GROUNDS FOR PROCESSING UNDER INDIAN LAW

Under the DPDP Act 2023 and Indian legal framework, we process personal data under the following recognized legal grounds:

• Consent: Explicit, affirmative consent provided by the Vendor upon signup and by end-users upon opting in to receive business communications.
• Contractual Performance: Necessary processing to fulfill our SaaS Terms of Service and execute telecommunication routing requested by the user.
• Legitimate Uses & Legal Compliance: Compliance with statutory directives from CERT-In, tax compliance under Indian GST laws, and fraud prevention.

16. CONSENT ARCHITECTURE & VENDOR OPT-IN OBLIGATIONS

17. SUB-PROCESSORS & INFRASTRUCTURE PARTNERS

Wapflow OS engages select enterprise sub-processors to maintain high availability and deliver platform capabilities:

• Hostinger International Ltd. / Enterprise Cloud: Server infrastructure, database hosting, automated backup storage.
• Meta Platforms, Inc. (Meta Cloud API): WhatsApp Cloud API and Instagram Messaging API gateway routing.
• Razorpay / Stripe / Official Gateways: Payment gateway tokenization and subscription charge execution.
• AI Model Providers (OpenAI, Google Cloud): Natural language understanding for configured AI Agent nodes.

18. COOKIES, LOCAL STORAGE & TRACKING TECHNOLOGIES

We use essential authentication cookies, CSRF defense tokens, and localized session preferences to keep users securely logged in and maintain interface states. We do not deploy third-party cross-site advertising tracking cookies on vendor administrative consoles.

19. CROSS-BORDER DATA TRANSFERS & SOVEREIGN STORAGE

Primary vendor databases, account profiles, and transaction records are hosted on secure enterprise cloud servers. Where processing requires global API interaction (such as Meta Cloud API data routing), transfers occur strictly subject to standard contractual clauses, encryption, and statutory transfer notifications compliant with Indian law.

20. DATA SECURITY SAFEGUARDS

We implement defense-in-depth cybersecurity protocols, including:

• Cryptographic encryption of API tokens, app secrets, and credentials using AES-256-GCM.
• End-to-end transport encryption via TLS 1.3 for all web, API, and webhook traffic.
• Strict database tenant partitioning preventing cross-vendor data exposure.
• Granular role-based access controls (RBAC) separating administrative privileges.
• Automated daily encrypted snapshot backups and continuous system monitoring.

21. INCIDENT MANAGEMENT & DATA BREACH NOTIFICATION

In the event of a confirmed security incident affecting personal data, Wapflow OS will notify affected Data Fiduciaries and statutory authorities (including the Indian Computer Emergency Response Team - CERT-In) in accordance with statutory reporting timelines prescribed by law.

22. RETENTION PERIODS & AUTOMATED PURGING POLICIES

We retain personal data only for as long as necessary to deliver the active SaaS subscription, fulfill legitimate business purposes, and satisfy statutory tax and legal requirements. Upon vendor account closure, conversational logs and media assets are scheduled for automated purge within 60 days, unless statutory preservation orders apply.

23. DATA PRINCIPAL RIGHTS

Under the DPDP Act 2023 and global privacy frameworks, Data Principals possess the following statutory rights:

• Right to Access: The right to obtain a summary of personal data being processed and the processing activities undertaken.
• Right to Correction & Erasure: The right to rectify inaccurate or obsolete personal data and request erasure of data no longer required.
• Right of Grievance Redressal: The right to lodge formal grievances with the Data Fiduciary and appellate authorities.
• Right to Nominate: The right to nominate an individual to exercise rights on their behalf in the event of death or incapacity.

24. PROCEDURE FOR EXERCISING PRIVACY RIGHTS

To exercise any of the foregoing rights, Vendors and Data Principals may submit a formal request to our designated Grievance Team at support@karwadegroup.in. Requests are verified using multi-factor identity validation and resolved within statutory timelines (not exceeding 30 calendar days).

25. CHILDREN'S PRIVACY & AGE RESTRICTION

26. REGULATORY COOPERATION WITH CERT-IN & LAW ENFORCEMENT

Karwadegroup cooperates fully with certified Indian judicial bodies, statutory law enforcement agencies, and CERT-In in response to lawful summons, court orders, or cyber safety investigations issued in accordance with the Information Technology Act 2000 and the Indian Constitution.

27. GRIEVANCE REDRESSAL MECHANISM & GRIEVANCE OFFICER

In accordance with the Information Technology Act 2000 and DPDP Rules, the details of the designated Grievance Officer for Karwadegroup are as follows:

28. DATA PROTECTION OFFICER & APPELLATE PATHWAYS

If you remain dissatisfied with the resolution provided by our Grievance Officer, you have the statutory right to escalate your grievance to the Data Protection Board of India established under the Digital Personal Data Protection Act 2023.

29. REVISIONS & MATERIAL UPDATES

We may update this Privacy Policy from time to time to accommodate platform advancements, statutory enactments, or operational improvements. Notice of material modifications will be delivered via vendor console banner, email broadcast, or prominent website notification at least 15 calendar days prior to effective adoption.

30. GOVERNING LAW & LEGAL JURISDICTION

This Privacy Policy shall be governed by, construed, and enforced in accordance with the laws of the Republic of India. Any dispute arising out of or related to this Policy shall fall under the exclusive jurisdiction of the competent civil courts located in Ahmedabad, Gujarat, India.