Privacy Policy

1. Who we are

Wazigo is a WhatsApp Business messaging platform operated by Saman Technosys Private Limited, a company incorporated in India (CIN U74999MH2016PTC283139), with its registered office at Unit No 802/801, 8th Floor, Sai Arpan B-11, Sai Complex, Opp. Shanti Vihar, Mira Road East, Maharashtra, India - 401107.

In this policy, “we”, “us” and “our” mean Saman Technosys Private Limited. Wazigo is the brand and product name; Saman Technosys Private Limited is the legal entity you contract with and the entity that collects payment.

We are contactable about anything in this policy at info@wazigo.io.

2. What this policy covers

This policy applies to:

• this website, wazigo.io;
• the Wazigo application at app.wazigo.io; and
• the APIs, webhooks, embeddable forms and hosted form pages we provide as part of the service.

It does not cover WhatsApp itself. Messages sent and received through Wazigo travel over the WhatsApp Business Platform operated by Meta Platforms, Inc., and Meta’s own terms and privacy policy apply to that leg of the journey. It also does not cover the websites or businesses of our customers.

3. Our two roles

This distinction decides who is answerable for what, so it is worth reading even if you skip the rest.

We are a Data Fiduciary (controller) for our customers.

When a business signs up for Wazigo, we decide what account information we need and how long we keep it. That business, its owner and its agents are our data principals, and everything in this policy applies to them directly.

We are a Data Processor for our customers’ contacts.

When a business uploads its contact list, or a customer of that business sends it a WhatsApp message, that data belongs to the business. We hold and process it strictly on that business’s instructions in order to run the service. We do not decide what is done with it, we do not sell it, and we do not use it for our own marketing.

4. Information we collect

4.1 Account information

Collected when a business signs up and while it uses the service:

• the name, email address, mobile number and role of each user on the account;
• the business name, address, GSTIN where provided, and timezone;
• a hashed password — we never store a readable password;
• one-time passcodes used to sign in, which expire quickly and are then discarded.

4.2 WhatsApp Business Account credentials

To send and receive messages on a customer’s behalf we hold their WhatsApp Business Account ID, phone number ID, Meta app ID and access token. Access tokens and app secrets are encrypted at rest and are never sent to a browser, never written to our logs, and never shared.

4.3 Contact data uploaded or captured by our customers

Names, WhatsApp numbers, country, any custom attributes the business chooses to store (order number, city, plan, and so on), list membership, marketing consent state and the source a contact came from. This is our customer’s data; we process it for them.

4.4 Message content and delivery data

The text of messages sent and received, the templates used, media (images, documents, audio and video) attached to those messages, timestamps, and delivery, read and failure statuses returned by Meta. Media is re-hosted on our storage because Meta’s media URLs expire within days — without a copy, a conversation history would gradually empty itself out.

4.5 Usage and technical data

Counts of messages sent, feature usage, IP address, browser and device type, and application error logs. Server logs are kept for troubleshooting and security.

4.6 Payment data

Subscription payments are collected through Razorpay. Card numbers, UPI IDs, CVVs and net-banking credentials are entered on Razorpay’s systems and never reach our servers. We receive and store only the transaction reference, amount, status, date and the billing name and address needed to raise a GST invoice.

4.7 What we do not collect

• We do not run advertising trackers, ad pixels or third-party analytics for advertising.
• We do not buy contact lists, and we do not enrich or resell anybody’s data.
• We do not use our customers’ message content to train artificial intelligence models.

5. How we use information

6. Our legal basis

We process personal data under India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it.

• Consent. Users consent when they create an account. End customers give consent to the business messaging them, which the business records and which we store as evidence on that business’s behalf.
• Legitimate uses. Where the Act permits processing without separate consent — for example to comply with a legal obligation, to respond to an emergency, or where a data principal has voluntarily provided data for a specified purpose.
• Contract. Processing needed to provide the service a customer has paid for.

7. WhatsApp, Meta and message data

Wazigo is built on the WhatsApp Business Platform and Saman Technosys Private Limited operates as a Meta Tech Provider. We are an independent company and are not affiliated with, endorsed by or sponsored by Meta Platforms, Inc.

What this means in practice:

• Every message you send or receive through Wazigo passes through Meta’s infrastructure, and Meta processes it under its own terms.
• Our customers connect their own WhatsApp Business Account. Meta bills them directly for messaging. We never resell messages and never add a markup.
• Meta sends us signals about a customer’s number — quality rating, messaging tier, account status and template verdicts. We store these against the customer’s account and act on them, for example by pausing sending when a rating falls.
• Deleting data from Wazigo does not delete it from WhatsApp, from Meta’s systems, or from the phone of the person you messaged.

8. Who we share information with

We share personal data only in these situations:

• With the sub-processors listed below, to the extent each needs it to perform its function.
• Within a customer’s own account. Every user on a business’s Wazigo account can see that business’s conversations and contacts, subject to their role. Accounts are strictly isolated from one another: no business can read or write another business’s data.
• When the law requires it — a valid order from a court, a regulator or a law-enforcement agency with jurisdiction over us. Where we are permitted to tell the affected customer, we will.
• On a change of control. If Saman Technosys Private Limited is acquired or merged, data may transfer to the acquirer, who remains bound by this policy or a materially equivalent one. We will give notice before that happens.

We do not sell personal data. We never have and we do not intend to.

9. Sub-processors

These are the third parties that process personal data in order for the service to work. We publish the actual list rather than a phrase like “trusted partners”, because that is not a disclosure.

We will update this list before adding a sub-processor that handles personal data. Customers who want notice by email of changes can ask at info@wazigo.io.

10. Cookies and local storage

This marketing website sets no cookies and runs no analytics or advertising scripts. It loads typefaces from Google Fonts, which means your browser makes a request to Google’s servers.

The application at app.wazigo.io uses:

• a session cookie, strictly necessary to keep you signed in and to protect forms against cross-site request forgery;
• browser local storage, to hold your sign-in token and your interface preferences so you are not signed out on every page load.

None of it is used for advertising or for tracking you across other websites.

11. How long we keep information

12. How we protect information

• Encryption in transit. Every connection to Wazigo uses TLS.
• Encryption at rest for secrets. WhatsApp access tokens, app secrets and payment keys are encrypted in the database with keys held outside it.
• Tenant isolation. Every record belongs to exactly one business and every query is filtered by it automatically, at the framework level rather than per feature. We test for this on every release.
• Role-based access. Owners, supervisors and agents see different things. Sensitive actions require the right role.
• Signed webhooks. Incoming webhooks from Meta and Razorpay are signature-verified before they are trusted.
• Least privilege internally. Access to production data is limited to staff who need it to operate or support the service.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and affected data principals as the DPDP Act requires.

13. Your rights

Under the DPDP Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct or complete data that is inaccurate or out of date;
• Erase personal data where it is no longer needed for the purpose it was collected for;
• Withdraw consent at any time, as easily as it was given;
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated;
• Complain to us and, if we do not resolve it, to the Data Protection Board of India.

Write to info@wazigo.io. We acknowledge requests within 72 hours and complete them within 30 days. We may ask you to verify your identity first — we will not hand somebody’s data to a stranger who claims to be them.

14. If you received a message from a Wazigo customer

You are dealing with that business, not with us. We process your data on their instructions and we cannot decide on their behalf what happens to it. Your options, in the order that works fastest:

1. Reply STOP in the WhatsApp conversation. This stops marketing messages from that business immediately and permanently, and it is recorded in a way the business cannot reverse. Hindi and Hinglish phrases such as band karo and बंद करो work too, as does the Stop promotions button WhatsApp shows on marketing templates.
2. Contact the business directly to ask for access to, correction of, or erasure of your data. They control it.
3. Write to us at info@wazigo.io if the business does not respond, or if you cannot identify who messaged you. We will pass your request to them, and we will act on it ourselves where the law requires us to.

Full instructions, including how to have your data deleted, are on our Data Deletion Instructions page.

15. Deleting your data

Every route to deletion — for a business closing its account, for a user, and for someone who received a message — is set out step by step on the Data Deletion Instructions page.

16. Children

Wazigo is a business tool and is not intended for anyone under 18. We do not knowingly collect the personal data of a child, and we do not permit behavioural advertising or tracking directed at children. If you believe a child’s data has reached us, write to info@wazigo.io and we will delete it.

17. Where data is processed

Our application, database and message archive are hosted on servers we control. Some sub-processors — Meta in particular — process data outside India, which is unavoidable for a service built on the WhatsApp Business Platform. We transfer personal data outside India only to countries not restricted by the Central Government under the DPDP Act, and only under contractual terms that require the recipient to protect it.

18. Changes to this policy

We will update this page when the service changes. The effective and last-updated dates at the top always reflect the current version. If a change materially affects how we handle personal data, we will tell account owners by email or by a notice inside the application before it takes effect.

19. Grievance redressal and contact

In line with the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our grievance officer is:

• Akmal Faizan, Grievance Officer
• Saman Technosys Private Limited, Unit No 802/801, 8th Floor, Sai Arpan B-11, Sai Complex, Opp. Shanti Vihar, Mira Road East, Maharashtra, India - 401107
• info@wazigo.io — write “Grievance” in the subject line and it reaches Akmal Faizan directly

Grievances are acknowledged within 24 hours and resolved within 15 days.

We keep two addresses and no more, so that both are actually read: info@wazigo.io for privacy, data protection, legal notices and grievances, and support@wazigo.io for the product, your account and billing.