Privacy Policy

1. Who we are

Wazigo is a WhatsApp Business messaging platform operated by Saman Technosys Private Limited, a company incorporated in India (CIN U74999MH2016PTC283139), with its registered office at Unit No 802/801, 8th Floor, Sai Arpan B-11, Sai Complex, Opp. Shanti Vihar, Mira Road East, Maharashtra, India - 401107.

In this policy, “we”, “us” and “our” mean Saman Technosys Private Limited. Wazigo is the brand and product name; Saman Technosys Private Limited is the legal entity you contract with and the entity that collects payment.

We are contactable about anything in this policy at info@wazigo.io.

2. What this policy covers

This policy applies to:

• this website, wazigo.io;
• the Wazigo application at app.wazigo.io;
• the Wazigo app for Shopify, which connects a merchant’s Shopify store to their Wazigo workspace — see section 8; and
• the APIs, webhooks, embeddable forms and hosted form pages we provide as part of the service.

It does not cover WhatsApp itself. Messages sent and received through Wazigo travel over the WhatsApp Business Platform operated by Meta Platforms, Inc., and Meta’s own terms and privacy policy apply to that leg of the journey. It does not cover Shopify itself: a merchant’s store, and the data Shopify holds about that store and its buyers, sit under the merchant’s own agreement with Shopify. It also does not cover the websites or businesses of our customers.

3. Our two roles

This distinction decides who is answerable for what, so it is worth reading even if you skip the rest.

We are a Data Fiduciary (controller) for our customers.

When a business signs up for Wazigo, we decide what account information we need and how long we keep it. That business, its owner and its agents are our data principals, and everything in this policy applies to them directly.

We are a Data Processor for our customers’ contacts.

When a business uploads its contact list, or a customer of that business sends it a WhatsApp message, that data belongs to the business. We hold and process it strictly on that business’s instructions in order to run the service. We do not decide what is done with it, we do not sell it, and we do not use it for our own marketing.

Being a processor is a set of commitments, not a label. Where we hold a customer’s contact, conversation or order data:

• We act only on that customer’s instructions — the settings, automations, campaigns and connections they configure, and the support requests they send us. We do not process their contacts’ data for any purpose of our own.
• Only authorised personnel can reach it. Access to production data is limited to the staff who operate and support the service, under confidentiality obligations that survive their employment.
• We use the sub-processors named in section 10, and we update that list before adding another one that handles personal data.
• We help our customers answer their own data principals. If a contact or a buyer asks a business for access, correction or erasure, we give that business the means to act on it, and we act on it ourselves where the law requires us to.
• We keep it only as long as section 13 says, and we delete or return it when the customer closes the account or asks us to, subject to the exceptions set out there.

4. Information we collect

4.1 Account information

Collected when a business signs up and while it uses the service:

• the name, email address, mobile number and role of each user on the account;
• the business name, address, GSTIN where provided, and timezone;
• a hashed password — we never store a readable password;
• one-time passcodes used to sign in, which expire quickly and are then discarded.

4.2 WhatsApp Business Account credentials

To send and receive messages on a customer’s behalf we hold their WhatsApp Business Account ID, phone number ID, Meta app ID and access token. Access tokens and app secrets are encrypted at rest and are never sent to a browser, never written to our logs, and never shared.

4.3 Contact data uploaded or captured by our customers

Names, WhatsApp numbers, country, any custom attributes the business chooses to store (order number, city, plan, and so on), list membership, marketing consent state and the source a contact came from. This is our customer’s data; we process it for them.

4.4 Message content and delivery data

The text of messages sent and received, the templates used, media (images, documents, audio and video) attached to those messages, timestamps, and delivery, read and failure statuses returned by Meta. Media is re-hosted on our storage because Meta’s media URLs expire within days — without a copy, a conversation history would gradually empty itself out.

4.5 Usage and technical data

Counts of messages sent, feature usage, IP address, browser and device type, and application error logs. Server logs are kept for troubleshooting and security.

4.6 Payment data

A business pays for Wazigo through one of two billing providers, depending on how it subscribed: Razorpay, or Shopify where the subscription was bought through the Shopify app. In both cases card numbers, UPI IDs, CVVs and net-banking credentials are entered on the provider’s systems and never reach our servers.

• From Razorpay we receive and store the transaction reference, amount, status, date and the billing name and address needed to raise a GST invoice.
• From Shopify we receive the plan, subscription status, amount, currency and billing dates for the store’s Wazigo subscription. Razorpay is not involved in a subscription billed by Shopify and is not its payment processor.

This is the merchant’s own billing data, and we are the data fiduciary for it. It is a separate flow from the buyer and order data described in section 8: neither billing provider receives that order data, and buyer data is never used for billing.

4.7 Shopify store and order data

If a business connects a Shopify store, we receive buyer and order details from Shopify so that order notifications and customer conversations can be handled over WhatsApp. Because that involves a different source, a different set of parties and a different set of responsibilities, it is set out in full in section 8 rather than summarised here.

4.8 What we do not collect

• We do not run advertising trackers, ad pixels or third-party analytics for advertising.
• We do not buy contact lists, and we do not enrich or resell anybody’s data.
• We do not use our customers’ message content to train artificial intelligence models. Interpreting a message is not the same as training on it — see section 11 for what is sent where.

5. How we use information

6. Our legal basis

We process personal data under India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it.

• Consent. Users consent when they create an account. End customers give consent to the business messaging them, which the business records and which we store as evidence on that business’s behalf.
• Legitimate uses. Where the Act permits processing without separate consent — for example to comply with a legal obligation, to respond to an emergency, or where a data principal has voluntarily provided data for a specified purpose.
• Contract. Processing needed to provide the service a customer has paid for.

7. WhatsApp, Meta and message data

Wazigo is built on the WhatsApp Business Platform and Saman Technosys Private Limited operates as a Meta Tech Provider. We are an independent company and are not affiliated with, endorsed by or sponsored by Meta Platforms, Inc.

What this means in practice:

• Every message you send or receive through Wazigo passes through Meta’s infrastructure, and Meta processes it under its own terms.
• Our customers connect their own WhatsApp Business Account. Meta bills them directly for messaging. We never resell messages and never add a markup.
• Meta sends us signals about a customer’s number — quality rating, messaging tier, account status and template verdicts. We store these against the customer’s account and act on them, for example by pausing sending when a rating falls.
• Deleting data from Wazigo does not delete it from WhatsApp, from Meta’s systems, or from the phone of the person you messaged.

8. Shopify stores and order data

A merchant installs the Wazigo app from Shopify. Installing it is the whole of the connection: the app links the store to that merchant’s Wazigo workspace itself, and there are no webhooks to configure and no signing keys to copy anywhere. A merchant can disconnect the store, or uninstall the app in Shopify, at any time.

8.1 What Shopify sends us

With the merchant’s authorisation, we receive:

• the buyer’s name and phone number as given at checkout;
• order details — the order identifier and number, the total amount, the currency, and the order, payment and fulfilment status;
• fulfilment and tracking details — carrier, tracking number and tracking link, so a dispatch message can carry them;
• store details — the shop domain and name, and the store’s currency and timezone settings.

We do not request buyer email addresses or shipping addresses, because the launch features need only name and phone to address WhatsApp messages. Order handling discards other buyer fields. A mandatory Shopify privacy request may separately include a customer email or phone as an identifier; we use it only to fulfil that request and to preserve deletion after a covered backup restoration. We do not request payment-card data.

8.2 What it is used for

The Shopify launch has two purposes:

1. Order notifications. A message to the buyer about an order they placed — placed, paid, fulfilled with tracking where supplied, or cancelled. These are transactional: they follow from the purchase itself.
2. Customer conversations. When a buyer replies, the reply lands in that merchant’s Wazigo inbox with the order it relates to shown next to it, so their staff can answer without asking the buyer to repeat themselves.

We do not use any of this for our own marketing, we do not sell it, we do not share it with other merchants, and we do not train artificial intelligence models on it.

Shopify cart recovery is not part of this launch. Checkout reminders are not enabled for the launch. Any checkout data retained from earlier testing is subject to the same Shopify access and erasure handling described below.

8.3 What reaches Meta

Delivering any of these messages means handing them to the WhatsApp Business Platform. Meta receives the recipient’s phone number, the template used, and the values placed into that template — in practice the buyer’s name, the order number, the amount and currency, and the order-status or tracking link. It does not receive anything else we hold about the buyer. Section 7 covers that leg of the journey.

8.4 Who the parties are

8.5 Uninstalling Shopify, cancelling billing and closing Wazigo

• Pausing a store in Wazigo stops its configured messages. Pausing is not a request to erase the store or close the account.
• Uninstalling Wazigo in Shopify clears our stored Shopify access and refresh credentials when we receive the verified uninstall notification. It stops store automation and cancels queued or retrying store messages. Store-linked erasure is scheduled for 48 hours after uninstall, then processed by our background worker. This is the start of erasure processing, not a promise that every copy disappears at exactly 48 hours. Processing failures remain pending for retry.
• Reinstalling before erasure closes the earlier uninstall request after fresh Shopify authentication. Cancelled messages stay cancelled. Reinstalling after erasure creates a fresh connection and does not restore deleted customer records.
• Store erasure removes store-linked orders, checkout records and related customer, message, media and log data. Independently acquired Wazigo contacts and unrelated conversations remain. Minimal keyed records retain deletion and opt-out decisions and the original installation date; we do not keep a customer profile just to remember an opt-out.
• Billing and account closure are separate. Uninstalling ends the subscription billed through that Shopify store. It does not close the Wazigo account or cancel a separately billed Razorpay subscription. General account closure follows section 13 and our Data Deletion Instructions.

8.6 Customer access and erasure requests

Merchants can request customer data or erasure through Shopify. We verify Shopify’s notification, process the matching records and show progress under Online Stores in Wazigo. Customer requests have a 30-day completion deadline from receipt. An access export is encrypted in storage, available only to authorised store administrators, and expires 30 days after preparation or sooner if matching data is erased. Completed request payloads are cleared. Unresolved matching, access or processing problems remain visible for follow-up. Customers can also use the contact routes on our deletion page.

9. Who we share information with

We share personal data only in these situations:

• With the sub-processors listed below, to the extent each needs it to perform its function.
• Within a customer’s own account. Every user on a business’s Wazigo account can see that business’s conversations and contacts, subject to their role. Accounts are strictly isolated from one another: no business can read or write another business’s data.
• When the law requires it — a valid order from a court, a regulator or a law-enforcement agency with jurisdiction over us. Where we are permitted to tell the affected customer, we will.
• On a change of control. If Saman Technosys Private Limited is acquired or merged, data may transfer to the acquirer, who remains bound by this policy or a materially equivalent one. We will give notice before that happens.

We do not sell personal data. We never have and we do not intend to.

10. Sub-processors

These are the third parties that process personal data in order for the service to work. We publish the actual list rather than a phrase like “trusted partners”, because that is not a disclosure.

We will update this list before adding a sub-processor that handles personal data. Customers who want notice by email of changes can ask at info@wazigo.io.

11. AI assistants and automated interpretation

Two separate things in Wazigo involve AI. They are kept apart here because the answer to “who sent what, and on whose instruction” is different for each.

10.1 An AI assistant connected by the business

A business using Wazigo may connect its own AI assistant — Claude (Anthropic) or ChatGPT (OpenAI) — to its workspace, so its staff can ask questions about their own account in ordinary language. This is off until a workspace admin switches it on. An admin can switch it off or disconnect an assistant at any time, and disconnecting takes effect immediately.

When it is on, data goes to the AI provider that business chose, under that provider’s own terms and on that business’s own account with them. We do not select the provider and we do not hold the subscription. These providers are therefore not our sub-processors and are not in the list above: the business directs that disclosure, and it is the business’s decision to make.

An assistant acts as the person who authorised it and can see only what that person’s role already allows. It cannot reach anything the human could not.

What an assistant can read:

• Contact names, country, opt-in and opt-out status, list membership, and the contact attributes the business itself defined.
• Message templates, chatbot scripts, signup forms and campaign setup.
• Aggregate reporting.

What an assistant cannot read, in any circumstance:

• The content of conversations with your customers. Message text is never available to an assistant.
• Whole phone numbers. A number is masked to its country code and last five digits — +91 ••••• 43210. The full number is never returned.
• WhatsApp access tokens, app secrets, payment credentials, or lead-source keys and secrets.
• Any other business’s data.

How much can be read at once is capped: 50 records in a single response and 500 in a connected session. A contact database cannot be exported this way.

An assistant can read and it can draft. It cannot send a message to one of your customers, publish a chatbot, activate a signup form, launch a campaign, or delete anything. Those remain human actions taken inside Wazigo.

Every action an assistant takes is recorded — the workspace, the person who authorised it, the action, and what was passed to it. The data returned to the assistant is not recorded.

10.2 Automated interpretation of an incoming message

Wazigo can use an AI model to work out what a message from your customer means, so that the right chatbot answer is given. Unlike the assistants above, this one is our processing rather than the business’s, and our sub-processor for it is OpenAI, listed in section 10.

Only the text of the message is sent, truncated to 500 characters. Before it goes, any run of nine or more digits — the shape of a card or identity number — is replaced with a placeholder.

The customer’s phone number, their name, their contact attributes and the history of the conversation are never sent.

This feature is not enabled today. It is disclosed here before it is switched on rather than after.

12. Cookies and local storage

This marketing website sets no cookies and runs no analytics or advertising scripts. It loads typefaces from Google Fonts, which means your browser makes a request to Google’s servers.

The application at app.wazigo.io uses:

• a session cookie, strictly necessary to keep you signed in and to protect forms against cross-site request forgery;
• browser local storage, to hold your sign-in token and your interface preferences so you are not signed out on every page load.

None of it is used for advertising or for tracking you across other websites.

13. How long we keep information

Shopify deletion records and backup limits

We keep encrypted Shopify deletion records separately in private Cloudflare R2 storage. They contain only the identifiers needed to repeat an erasure after restoration. These records are configured to expire 120 days after they are written. A coverage marker containing the initialization time remains; minimal keyed deletion and opt-out records in Wazigo remain while needed to prevent old data or marketing permissions returning.

The restoration tool can reapply Shopify erasures only to backups started after 16 September 2026 at 10:12:20 UTC and no more than 90 days old. That 90-day limit is a restoration-coverage limit, not a statement of Hostinger’s backup retention. Older backups fall outside this coverage. The complete Hostinger server restoration procedure has not yet been verified. These deletion records are not a replacement for encryption of the server backups.

Hostinger provides weekly server backups and automatic rotation. We cannot currently guarantee an exact date when an individual deleted record disappears from every backup, or claim verified encryption of those backups. This replaces the earlier blanket claim that encrypted backups always disappear within a further 90 days. General Wazigo account closure and Shopify store erasure remain separate processes.

14. How we protect information

• Encryption in transit. Every connection to Wazigo uses TLS.
• Encryption at rest for secrets. WhatsApp access tokens, app secrets and payment keys are encrypted in the database with keys held outside it.
• Tenant isolation. Every record belongs to exactly one business and every query is filtered by it automatically, at the framework level rather than per feature. We test for this on every release.
• Role-based access. Owners, supervisors and agents see different things. Sensitive actions require the right role.
• Signed webhooks. Incoming webhooks from Shopify, Meta and Razorpay are signature-verified before they are trusted.
• Least privilege internally. Access to production data is limited to staff who need it to operate or support the service.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and affected data principals as the DPDP Act requires.

15. Your rights

Under the DPDP Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct or complete data that is inaccurate or out of date;
• Erase personal data where it is no longer needed for the purpose it was collected for;
• Withdraw consent at any time, as easily as it was given;
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated;
• Complain to us and, if we do not resolve it, to the Data Protection Board of India.

Write to info@wazigo.io. We acknowledge requests within 72 hours and complete them within 30 days. We may ask you to verify your identity first — we will not hand somebody’s data to a stranger who claims to be them.

16. If you received a message from a Wazigo customer

You are dealing with that business, not with us. We process your data on their instructions and we cannot decide on their behalf what happens to it. Your options, in the order that works fastest:

1. Reply STOP in the WhatsApp conversation. This stops marketing messages from that business immediately and permanently — promotional broadcasts and cart reminders included — and it is recorded in a way the business cannot reverse. Hindi and Hinglish phrases such as band karo and बंद करो work too, as does the Stop promotions button WhatsApp shows on marketing templates.
   Two things STOP does not do. It does not stop a message about something you actually did — a confirmation or a delivery update for an order you placed, or a reply to a question you asked. And it does not erase your data: stopping the marketing and deleting the record are separate requests, and the opt-out itself has to be kept, because deleting the record of a STOP would let the business message you again. To have your data erased, use the next two options.
2. Contact the business directly to ask for access to, correction of, or erasure of your data. They control it.
3. Write to us at info@wazigo.io if the business does not respond, or if you cannot identify who messaged you. We will pass your request to them, and we will act on it ourselves where the law requires us to.

Full instructions, including how to have your data deleted, are on our Data Deletion Instructions page.

17. Deleting your data

Every route to deletion — for a business closing its account, for a user, and for someone who received a message — is set out step by step on the Data Deletion Instructions page.

18. Children

Wazigo is a business tool and is not intended for anyone under 18. We do not knowingly collect the personal data of a child, and we do not permit behavioural advertising or tracking directed at children. If you believe a child’s data has reached us, write to info@wazigo.io and we will delete it.

19. Where data is processed

Our application, database and message archive are hosted on servers we control. Some sub-processors process data outside India: Meta, unavoidably, for a service built on the WhatsApp Business Platform, and Shopify, for a merchant who has chosen to run their store there. We transfer personal data outside India only to countries not restricted by the Central Government under the DPDP Act, and only under contractual terms that require the recipient to protect it.

20. Changes to this policy

We will update this page when the service changes. The effective and last-updated dates at the top always reflect the current version. If a change materially affects how we handle personal data, we will tell account owners by email or by a notice inside the application before it takes effect.

21. Grievance redressal and contact

In line with the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our grievance officer is:

• Akmal Faizan, Grievance Officer
• Saman Technosys Private Limited, Unit No 802/801, 8th Floor, Sai Arpan B-11, Sai Complex, Opp. Shanti Vihar, Mira Road East, Maharashtra, India - 401107
• info@wazigo.io — write “Grievance” in the subject line and it reaches Akmal Faizan directly

Grievances are acknowledged within 24 hours and resolved within 15 days.

We keep two addresses and no more, so that both are actually read: info@wazigo.io for privacy, data protection, legal notices and grievances, and support@wazigo.io for the product, your account and billing.