Privacy Policy — DCI WhatsApp Business Platform
Privacy Policy
1. Who we are
Dot Com Inventions (“DCI”, “we”, “us”) operates the DCI WhatsApp Business Platform (the “Platform”), a service that lets businesses manage WhatsApp conversations with their customers through the WhatsApp Business Platform (Cloud API) provided by Meta.
- Registered office: Basement Floor, #2136, Sector 21, Panchkula, Haryana, India
- Website:
- Contact for privacy matters: [email protected]
This policy explains what personal data the Platform processes, why, and what choices people have. It applies to the Platform only, not to other services or websites we operate.
2. Our role, and why it matters
The Platform serves two different groups of people, and our legal responsibility differs for each.
Businesses that use the Platform (“Clients”). For the account data of our Clients and their staff, we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) — equivalent to a “controller” in other regimes. We decide what we collect and why.
Customers our Clients message (“End Users”). For the contact details and message content of the people our Clients talk to, we are a Data Processor acting only on the Client’s documented instructions. The Client is the Data Fiduciary. They decide who to message, on what basis, and for how long.
If you are an End User and want your data corrected or deleted, the business that messaged you controls it. Contact them first. If you cannot reach them, write to us at [email protected] and we will identify the Client and pass the request on, but we cannot act on their data without instruction.
We are a Meta Tech Provider, not a reseller of messaging. Each Client holds their own WhatsApp Business Account and their own billing relationship with Meta. We never take payment for message volume and do not sit between a Client and Meta’s charges.
3. What we process
3.1 Client account data (we are the Fiduciary)
| Data | Why |
|---|---|
| Name, work email, password (stored only as a salted scrypt hash) | Creating and securing accounts |
| Role within the workspace (owner, admin, agent) | Deciding what each person may do |
| Login timestamps, IP address, browser user-agent | Detecting account compromise |
| Workspace name and settings | Operating the service |
| Support correspondence | Answering your questions |
We do not store Client payment card details. We do not sell any data, and we do not use it to train machine learning models.
3.2 WhatsApp account credentials
When a Client connects their WhatsApp Business Account through Meta’s Embedded Signup, we receive and store an access token issued by Meta, and we generate a six-digit registration PIN for each phone number.
Both are encrypted at rest using AES-256-GCM, are never written to logs, and are never sent to a browser. They are used solely to call Meta’s API on the Client’s behalf.
3.3 End User data (we are the Processor)
Processed on behalf of, and under the instruction of, the Client:
| Data | Notes |
|---|---|
| WhatsApp ID (phone number in international format) | Stored exactly as Meta returns it |
| Display name and WhatsApp profile name | As supplied by WhatsApp |
| Attributes the Client adds (e.g. order reference, city, tags) | Entirely the Client’s choice |
| Message content — text, images, documents, audio, video, location | Both directions |
| Delivery state (sent, delivered, read, failed) and message category | Operating the service and producing usage reports |
| Consent record: whether the person opted in, when, and through what source | Required by WhatsApp’s own rules and by the DPDP Act |
| Raw webhook payloads received from Meta | Kept briefly for fault diagnosis |
Sensitive personal data. The Platform is not designed for health, financial, biometric, or other sensitive categories. Clients are contractually responsible for not sending such data through it. We cannot inspect message content to enforce this.
3.4 Technical data
Server logs recording request paths, response codes, timing and IP address, for security and reliability. Access tokens, passwords and session tokens are redacted from logs at source.
4. Why we process it
- To provide the Platform: delivering, receiving and displaying messages
- To authenticate users and keep accounts secure
- To show Clients how many messages they sent, in which category, so they can anticipate what Meta will bill them
- To maintain an audit trail of staff actions on conversations
- To diagnose faults and prevent abuse
- To meet legal obligations
We process Client account data on the basis of the contract between us and, for security measures, our legitimate interest in protecting the service. End User data is processed on the Client’s instruction and on the consent the Client obtained.
5. Sharing
We share personal data only in these circumstances.
Meta Platforms, Inc. Messages are delivered through Meta’s WhatsApp Business Platform. Sending a message necessarily transmits the recipient’s WhatsApp ID and the message content to Meta, which processes it under its own terms (). This is inherent to the service; there is no version of it that does not involve Meta.
Infrastructure providers. Our servers and databases are hosted with Hostinger, in India – Mumbai.
Professional advisers and authorities. Where required by law, or to establish or defend legal claims.
A successor, if the business is sold or reorganised. We will tell Clients before their data moves.
We do not share data with advertisers or data brokers.
6. How long we keep it
| Data | Retention |
|---|---|
| Raw webhook payloads | 30 days, then automatically deleted |
| Session refresh tokens | 30 days, or until you sign out |
| Conversations, messages and media | 12 months after the last message, unless the Client deletes them sooner |
| Contact records and consent history | For as long as the Client’s account is active |
| Audit logs | 12 months |
| Client account data | For the life of the account, then 90 days, then deleted |
Clients can delete an individual contact and its message history at any time from within the Platform. Deletion is permanent and is not recoverable from backups after 30 days.
7. Security
- Access tokens and registration PINs encrypted at rest with AES-256-GCM
- All traffic over TLS
- Passwords stored as salted scrypt hashes, never in plain text or reversibly
- Each Client’s data isolated at the database level by row-level security, in addition to application-level checks, so a fault in one layer does not expose another Client’s data
- Staff access limited by role, with every action on a conversation logged
- Webhook requests cryptographically verified before being accepted
No system is perfectly secure. If a breach affects personal data we will notify the Data Protection Board of India and affected Clients as the DPDP Act requires.
8. Your rights
Under the DPDP Act you may ask us to:
- Confirm what personal data we hold about you and give you a copy
- Correct data that is inaccurate or incomplete
- Erase data we no longer need for the purpose it was collected for
- Nominate someone to exercise these rights if you die or become incapacitated
- Withdraw consent, where processing relies on it
Write to [email protected]. We will respond within 30 days. We may need to verify your identity first.
If you are an End User, see section 2: the business that messaged you controls that data, and your request should go to them.
9. WhatsApp opt-in
WhatsApp requires a business to have the recipient’s opt-in before messaging them, and the Platform records the source and timestamp of every consent.
Obtaining valid opt-in is the Client’s responsibility, not ours. Anyone can stop receiving messages by replying to ask, or by blocking the number in WhatsApp. Complaints about a specific business should go to that business; if you cannot reach them, tell us at [email protected] and we will follow it up with the Client.
10. Children
The Platform is for business use and is not directed at children. We do not knowingly process the personal data of anyone under 18. Clients must not use it to message children without verifiable parental consent as the DPDP Act requires.
11. Transfers outside India
Our infrastructure is in India (Mumbai). Meta processes message data on infrastructure outside India as part of delivering WhatsApp. Transfers are made under the DPDP Act and any applicable restrictions notified by the Government of India.
12. Changes
We may update this policy. Material changes will be notified to Clients by email at least 30 days before they take effect, and the “Last updated” date above will change. Continuing to use the Platform after that means you accept the revised policy.
13. Contact and grievances
Grievance Officer (as required by the DPDP Act)
- Name: Sidharth Sharma
- Email: [email protected]
- Address: Basement Floor, #2136, Sector 21, Panchkula, Haryana, India
We acknowledge grievances within 7 working days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.