Privacy Policy

1. Two kinds of data, two roles

• Your account data — who you are as our customer. We decide how it's used (we're the controller / data fiduciary).
• Your customers' data — the contacts you upload and the messages you exchange with them. You decide how it's used; we process it only on your instructions to deliver the service (we're your processor). You're responsible for having a lawful basis and permission to message those people.

2. What we collect

• Account: email address, password (stored hashed by our auth provider), workspace name.
• WhatsApp connection: your WhatsApp Business Account ID, phone number ID and display number, and your Meta access token — encrypted before it's stored.
• API keys: stored only as a one-way hash; we can't read your key back.
• Contacts and messages: phone numbers, names and any columns you upload; templates, flows and sequences; messages sent and received, with delivery status; opt-out status.
• Billing: your plan, trial dates and message usage. Card and payment details are handled by Dodo Payments — we never see or store your card number.
• Technical: basic request logs (such as IP address and time) kept by our hosting provider for security and debugging, and when an API key was last used.
• Cookies: only what's needed to keep you signed in. No advertising or tracking cookies.

3. How we use it

• To run SendFromChat: send and receive your WhatsApp messages, run your automations, show your dashboard, answer your AI assistant.
• To bill your subscription and track your monthly message usage.
• To keep the service secure, prevent abuse, and meet legal obligations.
• To contact you about your account, the service, or changes to these policies.

We don't sell personal data, and we don't use your contacts or messages to train AI models.

4. Who we share it with

Only the service providers needed to run SendFromChat:

• Supabase — database and sign-in (data stored in the Mumbai, India region).
• Vercel — application hosting (may process requests outside India, including the United States).
• Meta (WhatsApp) — delivers your messages; Meta's own privacy terms apply to data on WhatsApp.
• Dodo Payments — payments, as merchant of record.
• AI assistants you connect (for example Claude, ChatGPT, Cursor or Gemini) — receive the data your assistant asks for while you use it, under that provider's terms. Nothing is shared with them unless you connect one.

We may also disclose data if the law requires it, or to protect our users or the service from harm.

5. How long we keep it

We keep your data while your account is active. When you ask us to delete your workspace, we delete your account, contacts, messages and settings within 30 days, except records we must keep by law (such as payment records for tax purposes) and short-lived backups that expire on their own.

6. Security

Data is encrypted in transit (HTTPS) and at rest by our providers; Meta access tokens are additionally encrypted with our own key, and API keys are stored only as hashes. Access to each workspace's data is scoped to that workspace. No system is perfectly secure — if a breach affects your data, we'll tell you without undue delay.

7. Your rights

You can ask to access, correct, export or delete your personal data, or withdraw consent where we rely on it — under India's Digital Personal Data Protection Act, the EU/UK GDPR, or other laws that apply to you. Email safeedpromo@gmail.com and we'll respond within 30 days. If you're one of our customers' contacts, please contact the business that messaged you first; we'll help them respond. People can also reply STOP to any message to stop receiving templates.

8. Children

SendFromChat is for businesses and isn't directed at anyone under 18.

9. Changes

If we change this policy materially, we'll notify you by email or in the dashboard before the change takes effect. Our grievance contact under Indian law is Muhammed Safeed S, safeedpromo@gmail.com.