1. Information We Collect

We collect several categories of information to provide and improve our services:

Business Information

• Business name, legal entity type, and registration details

• Business phone numbers registered with WhatsApp Business

• Business verification information you choose to provide or connect for supported provider workflows

• Tax or billing identifiers when you provide them for an enabled billing or compliance feature

• Billing and subscription information used by enabled billing features; payment credentials handled directly by a payment provider are not represented here as if we store full card or bank credentials

WhatsApp Data

• WhatsApp Business Account (WABA) ID and associated phone number IDs

• Message templates submitted and their approval status

• Message delivery receipts and read receipts

• Webhook event payloads received from Meta

• Message content processed through the platform and, where the feature requires it, stored in message history subject to the configured retention settings

• Business profile information (name, description, website, address)

Contact and End-User Data

• Phone numbers of contacts you message through our platform

• Contact display names (if provided)

• Opt-in and opt-out records for your messaging campaigns

• Message history between your business and its customers

Technical Data

• IP addresses used for security, abuse prevention and rate limiting where available

• Browser type, version, and operating system

• API request logs including endpoints accessed and response codes

• Authentication tokens and session identifiers

• Browser and device information supplied by the client where available

2. How We Use WhatsApp Data

WhatsApp data processed through our platform is used strictly to provide the services you have subscribed to:

• Facilitating the sending and receiving of WhatsApp messages on your behalf

• Storing message templates and managing their submission to Meta for approval

• Processing webhook events from Meta and routing them to your configured endpoints

• Generating analytics and delivery reports for your messaging campaigns

• Troubleshooting delivery failures and API errors

• Maintaining audit logs for compliance and security purposes

We do not use message content for advertising purposes, and we do not sell WhatsApp message data to third parties. Access to message content is strictly limited to authorized personnel for support and debugging purposes, subject to access controls and audit logging.

3. How User Consent is Collected

Because SK Digital integrates with Meta's official WhatsApp Business Platform, businesses using WhatsApp features must comply with WhatsApp's Business Policy and Messaging Policy, including the applicable consent and messaging requirements.

Businesses using SK Digital are responsible for:

• Obtaining clear, affirmative consent from contacts before sending them WhatsApp messages

• Clearly disclosing the nature and frequency of messages at the point of opt-in

• Providing a simple mechanism for contacts to opt out at any time

• Maintaining records of consent for audit purposes

• Honoring opt-out requests promptly (within 24 hours)

SK Digital provides tools to help businesses manage opt-in/opt-out records, but ultimate responsibility for consent compliance lies with the business using our platform.

4. Data Retention

The application has automated retention controls for messages, inactive contacts and audit logs, but the retention windows are deployment-configurable rather than hard-coded. If no retention window is configured, those records are not automatically expired by the retention scheduler.

• Message, contact and audit-log retention windows are controlled by the deployment configuration.

• Account and billing records may be retained where required to provide the service or meet applicable accounting and legal obligations.

• A verified deletion request removes the account-owned live data covered by our deletion service, including messages, contacts, connected accounts, API keys, webhooks, automations and SMB records.

• A minimal deletion-request record may be retained to evidence that the request was received and processed.

• Backup retention depends on the backup system actually enabled for the deployment; we do not promise a fixed backup purge period unless it is configured and published.

You may request deletion of your account data at any time. See Section 8 for details.

5. Data Encryption and Security

We publish only controls that are implemented by the current application or its production transport:

• WhatsApp access tokens and values passed through the sensitive-value helper are encrypted with application-layer AES-256-GCM.

• Customer API keys are stored as one-way hashes; the plaintext key is returned only when it is created.

• The web application applies a nonce-based Content Security Policy and additional browser security headers.

• Meta callbacks and customer webhook deliveries use cryptographic signature-verification paths where applicable.

• Production browser and provider connections are served over HTTPS/TLS.

6. Data Sharing and Disclosure

We do not sell your data or use message content for advertising. Beyond the sub-processors named below, we share information only when required by law, court order or government request, or with your explicit consent.

Sub-processors

These are the third parties that process data on our behalf, what each one receives, and why. Every one of them is bound to process it only on our instructions.

• Meta Platforms, Inc. — message content, phone numbers and delivery status. Required to send and receive on the WhatsApp Business Platform; there is no way to operate without it.

• MongoDB Atlas — the database of record: accounts, contacts, message history, and encrypted access tokens.

• Cloudinary — media attachments (images, video, audio, documents) sent or received on your number, so they can be shown in the inbox after Meta expires the original.

• Render — hosting and the queue that holds inbound messages between arrival and processing.

• Anthropic PBC — the text of an incoming message, and only when you have switched on an AI auto-reply rule. It is sent to generate that one reply, is not used to train models, and no message reaches Anthropic while AI replies are off. Turn the rule off and this sub-processor drops out entirely.

Your own endpoints

Where you register a webhook destination, we also deliver your inbound messages to the URL you gave us. What happens to them after that is governed by your own policies, not this one.

7. Your Rights – GDPR and CCPA

Depending on your jurisdiction, you may have the following rights regarding your personal data:

GDPR (EU/EEA Residents)

• Right to access your personal data

• Right to rectification of inaccurate data

• Right to erasure ("right to be forgotten")

• Right to restriction of processing

• Right to data portability

• Right to object to processing

• Right to withdraw consent at any time

CCPA (California Residents)

• Right to know what personal information is collected about you

• Right to delete personal information

• Right to opt-out of the sale of personal information (we do not sell personal information)

• Right to non-discrimination for exercising your rights

To exercise an applicable privacy right, contact us at privacy@meta.sanjusk.in or submit a request through our data deletion page. We will verify and process requests according to the law that applies to the requester and the data involved.

8. How to Delete Your Data

You can request deletion of your data at any time by visiting our Data Deletion page. Upon receiving a valid deletion request, we will:

• Record your request with a confirmation code and status page

• Verify the requester before destructive manual deletion

• Remove the account-owned live data covered by the deletion service after verification

• Update the request status when processing completes or requires manual follow-up

9. How Businesses Revoke Access

Businesses can revoke SK Digital's access to their WhatsApp Business Account at any time by:

• Navigating to Meta Business Suite → Business Settings → Connected Apps and removing SK Digital

• Visiting Facebook Settings → Business Integrations and removing the SK Digital integration

• Contacting our support team at support@meta.sanjusk.in to initiate immediate access revocation

• Deleting your SK Digital account through the Account Settings page

Revoking provider access stops future provider-authorized processing once the revocation takes effect. Historical data remains subject to the configured retention settings and any verified deletion request.

10. Cookies

We use cookies and similar tracking technologies. For detailed information, please see our Cookie Policy.

11. Children's Privacy

Our platform is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be reflected on this page with a revised "Last updated" date and, where required by law or appropriate for the change, may also be communicated through the product or available account contact channels.

13. Contact Us

For privacy-related inquiries, please contact our privacy team:

• Email: privacy@meta.sanjusk.in

• Subject line: Privacy Inquiry – [Your Name/Company]

• We acknowledge and process privacy requests according to the timelines required by applicable law; verification or complex requests may require additional information.