Aviral WhatsApp Platform privacy policy

Effective date: 16 October 2026

This policy explains how Aviral Techlab Private Limited ("Aviral Techlab", "we", "us") handles personal data in Aviral WhatsApp Platform (the "Service"). The Service helps businesses talk to their customers on WhatsApp. It includes a shared inbox, templates, campaigns, automation, AI features and, if enabled, calling.

We wrote this in plain English. If anything is unclear, write to privacy@aviraltechlab.com.

1. Who we are

• Company: Aviral Techlab Private Limited
• Trading name: Aviral Techlab
• Registered office: H-89, 2nd Floor, Ashok Vihar Phase-1, Delhi 110052, India
• Website: https://aviraltechlab.com
• Contact: info@aviraltechlab.com · +91 83830 08380
• Privacy contact: privacy@aviraltechlab.com
• Grievance Officer: Grievance Officer, Aviral Techlab Private Limited, grievance@aviraltechlab.com (see section 13)

2. Our two roles

We handle personal data in two different roles. The role decides who you should contact.

a) We act for our business customers (processor).
Our customers are businesses. They use the Service to message their customers ("end-users"). For that data, the business decides why and how it is used. The business is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under the GDPR. We are their Data Processor. We process that data only on their instructions, under our Data Processing Agreement (https://whatsapp.aviraltechlab.com/legal/dpa).

If you are an end-user who got a WhatsApp message from a business using the Service, contact that business first. Its privacy notice applies. We will help the business answer you. If you write to us, we will pass your request to the business, where we can identify it.

b) We act for ourselves (fiduciary/controller).
We decide how to use data about our own customers' accounts and users. That covers sign-up, login, billing, support, security, product analytics and marketing to business contacts. For that data, we are the Data Fiduciary (and controller under the GDPR).

3. Data we handle

3.1 Account and user data (we are the fiduciary)

• Name, work email, phone, job title, company name, GSTIN, billing address.
• Login details: hashed passwords, 2FA settings, SSO identifiers.
• Billing records: plan, invoices, payment status. Card or UPI details are collected by our payment processor, Razorpay. We don't store full card numbers.
• Support conversations and feedback, and enquiries you send us by email, WhatsApp, phone or the contact options on our website.
• Usage and device data: IP address, browser, device type, pages used, feature events, error logs, access logs.
• Cookies and similar browser storage (see section 15).

3.2 WhatsApp Business Account data (we process it for the customer)

When a business connects WhatsApp through Meta's Embedded Signup, Meta gives us access to:

• WhatsApp Business Account (WABA) ID, business portfolio ID and name.
• Phone number IDs, display phone numbers, display names and their approval status.
• Quality rating, messaging limit, throughput and account review status.
• Message templates, their status and quality.
• Business profile (about, address, website, category, photo).
• An access token that lets us act on that WABA. We encrypt it.

3.3 Message content and media (we process it for the customer)

• Messages the business sends and receives: text, images, video, audio, documents, location, contacts, interactive replies, reactions.
• Message metadata: message IDs, timestamps, delivery and read status, pricing category, error codes.
• Click-to-WhatsApp ad referral data (ad ID, headline, click ID), if the business runs such ads.
• Media is copied to our storage when it arrives, because Meta keeps inbound media for a short time only.

3.4 End-user contact data (we process it for the customer)

• WhatsApp profile name, business-scoped user ID (BSUID), username, phone number where available.
• Data the business adds: tags, notes, custom fields, lead or deal details, opt-in source and time, marketing preferences, opt-out status.
• Form responses from WhatsApp Flows.
• Order and payment status messages, if the business uses commerce features.

3.5 Call data, if calling is enabled (we process it for the customer)

• Call logs: caller, callee, time, duration, outcome.
• Call recordings and transcripts, only if the business turns recording on. The business must tell callers and get any consent the law requires.

3.6 AI processing, if AI features are enabled (we process it for the customer)

Some features use AI. Examples: reply suggestions, summaries, translation, template rewrites and task-specific AI agents.

• When a business turns these on, relevant message text, call transcripts and knowledge-base content are sent to our AI provider (Anthropic) to produce the output.
• We use these features only for the business's task. Our AI is task-specific. It is not a general-purpose chatbot.
• We don't use customer content to train AI models, and our AI provider is contractually barred from training on it.
• Businesses can turn AI features off at any time.

4. Meta Platform Data

Some data reaches us through Meta's APIs ("Platform Data"). This includes WABA details, phone number details, templates, messages and webhooks. We follow the Meta Platform Terms and Developer Policies.

• We use Platform Data only to provide and secure the Service for the business that connected its account. That means sending and receiving messages, managing templates and numbers, showing analytics, and keeping the account safe.
• We never sell, license or rent Platform Data.
• We don't use Platform Data for advertising profiles, data brokering, or to decide anyone's eligibility for credit, housing, jobs or insurance.
• We don't share Platform Data except with the sub-processors listed in section 7, with the business that owns it, or when the law requires it.
• When a business disconnects its WhatsApp account or closes its account, we stop using its Platform Data and delete it on the schedule in section 9.
• We complete Meta's annual Data Use Checkup and allow audits Meta is entitled to under its terms.

How to request deletion: see https://whatsapp.aviraltechlab.com/legal/data-deletion.

Meta Platforms and WhatsApp also process this data under their own terms and policies. That includes the WhatsApp Business Terms the business accepts directly with Meta. See https://www.whatsapp.com/legal.

5. Why we use data

We don't use end-user message content to market our own Service.

6. Legal basis

6.1 India: DPDP Act 2023 and DPDP Rules 2025

• Data we process for businesses: the business is the Data Fiduciary. It must have a lawful basis, usually the end-user's consent (for example a WhatsApp opt-in) or a legitimate use under section 7 of the DPDP Act. Our Terms require businesses to collect valid opt-in before messaging.
• Our own account data: we rely on:
  • consent, given when you sign up and accept this policy, which you can withdraw (section 12);
  • legitimate uses under section 7 of the DPDP Act, for example where you share data voluntarily to use the Service, and to meet legal duties such as tax records.
• We give notice in clear language as the DPDP Rules require. We will offer this notice in English and, on request, in a language listed in the Eighth Schedule to the Constitution.

6.2 European Union / UK (where the GDPR applies)

If you are in the EU, EEA or UK:

• Contract (Art. 6(1)(b)): to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement and B2B marketing. You can object at any time.
• Legal obligation (Art. 6(1)(c)): tax and accounting.
• Consent (Art. 6(1)(a)): optional features and marketing messages where consent is required. We don't currently set any non-essential cookies.

For data we process for businesses, the business's own legal basis applies.

7. Sub-processors and sharing

We use these service providers to run the Service. Each is bound by a contract that protects the data.

The current list is always at https://whatsapp.aviraltechlab.com/legal/subprocessors. We give business customers notice before adding a new sub-processor, as the DPA describes.

We also share data:

• With the business that owns the account, including its admins and agents.
• When the law requires it, for example a valid court order or a lawful request from a government body. We review each request, push back on overly broad ones, and share the minimum needed. Where allowed, we tell the affected business first.
• In a business transfer, such as a merger or sale, under the same protections.

We do not sell personal data.

8. International transfers

We host the Service in India (AWS Mumbai). Some processing happens outside India:

• Meta processes WhatsApp messages in its global infrastructure.
• Anthropic processes AI requests in the United States, only when AI features are on.

The DPDP Act allows transfers outside India except to countries the Central Government restricts by notification. We will stop transfers to any restricted country.

For data from the EU/EEA/UK, we use Standard Contractual Clauses (and the UK Addendum) or another valid transfer mechanism.

9. How long we keep data

Under the DPDP Rules, a fiduciary must erase data once its purpose is served. Some classes of fiduciary must also warn the person 48 hours before erasure. We support businesses in meeting these duties.

10. How we protect data

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• WhatsApp tokens and secrets encrypted with per-customer keys in a managed key service.
• Strict tenant isolation in the database (row-level security), backed by automated tests.
• Role-based access in the product. Least-privilege access for our staff, with 2FA.
• Webhooks from Meta verified by signature. Unsigned requests are rejected.
• Access and audit logs, kept for at least 1 year.
• Encrypted backups and tested restores.
• Vulnerability assessment and penetration testing (VAPT) before launch and at least yearly.
• Staff confidentiality agreements and security training.

No system is perfectly secure. If something goes wrong, we follow section 11.

11. Data breaches

If a personal data breach affects data we hold:

• As processor: we tell the affected business without undue delay, and within 72 hours of becoming aware. We give the details it needs to meet its own legal duties.
• As fiduciary: we notify the Data Protection Board of India and affected people as the DPDP Act and Rules require. That means an intimation without delay, then a detailed report to the Board within 72 hours (or longer if the Board allows). Where the GDPR applies, we notify the supervisory authority within 72 hours where required.
• We also report to CERT-In within the time its directions require (currently 6 hours for reportable incidents).

12. Your rights

12.1 If you are a business user of the Service

Under the DPDP Act you can:

• get a summary of your data and how we use it;
• correct, complete or update it;
• ask us to erase it (subject to legal retention, such as tax records);
• withdraw consent, as easily as you gave it;
• nominate someone to act for you if you die or can't act;
• complain to our Grievance Officer, and then to the Data Protection Board of India.

If the GDPR applies, you also have rights to access, rectification, erasure, restriction, portability and objection, and to complain to your supervisory authority.

To use a right, email privacy@aviraltechlab.com. Most account data can also be edited in Settings. We may ask you to prove your identity. We aim to reply within 30 days.

12.2 If you are an end-user messaged by a business

Contact the business that messaged you. It controls your data. You can also:

• reply STOP to stop marketing messages from that business;
• block the business in WhatsApp;
• write to us at privacy@aviraltechlab.com. We will pass your request to the business and help it respond.

13. Grievance Officer

Under the DPDP Act 2023, the DPDP Rules 2025 and the Information Technology Act, 2000 and its rules, our Grievance Officer is:

• Name and designation: Grievance Officer, Aviral Techlab Private Limited
• Email: grievance@aviraltechlab.com
• Address: Aviral Techlab Private Limited, H-89, 2nd Floor, Ashok Vihar Phase-1, Delhi 110052, India
• Phone: +91 83830 08380

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you're not satisfied, you can complain to the Data Protection Board of India.

14. Children

The Service is for businesses. It is not meant for anyone under 18. We don't knowingly collect children's data for our own purposes. If we learn we have, we delete it.

Businesses must not use the Service to message children without verifiable parental consent where the DPDP Act requires it. They must not use it for tracking, behavioural monitoring or targeted advertising directed at children.

15. Cookies

The Service uses a small number of essential cookies to keep you signed in and to protect sign-in and connection flows, and your browser's local storage to remember preferences such as the theme and table columns. We don't use advertising or cross-site tracking cookies, and we don't run third-party analytics cookies in the product or on our website.

Our Cookie policy lists each cookie, what it does and how long it lasts. You can control cookies in your browser.

16. Changes to this policy

We may update this policy. If a change is material, we tell account admins by email or in the product at least 30 days before it takes effect, unless the law requires a faster change. The date at the top always shows the current version. We keep past versions on request.

17. Contact us

• Privacy questions: privacy@aviraltechlab.com
• Grievances: grievance@aviraltechlab.com
• General: info@aviraltechlab.com · +91 83830 08380
• Post: Aviral Techlab Private Limited, H-89, 2nd Floor, Ashok Vihar Phase-1, Delhi 110052, India

This policy is governed by the laws of India. Courts at New Delhi have jurisdiction, subject to your rights under applicable data protection law.