Privacy Policy

Who we are and our role

UseWhat is a software service that lets merchant businesses automate customer conversations on WhatsApp. It is operated by Cogvex Solutions Private Limited, C-042C, 4TH FLOOR, SUPERMART-1 DLF PHASE-IV, DLF QE, Dlf Qe, Gurgaon- 122002, Haryana.

This policy concerns two groups. First, our direct customers — the merchant businesses and their staff who hold UseWhat accounts. For their account data we act as the data controller (data fiduciary under the DPDP Act). Second, the end customers of those merchants, who message the merchant on WhatsApp. For that end-customer data we act as a data processor, processing it only on the documented instructions of the merchant, who is the controller. Meta and WhatsApp process business-conversation content on the merchant's behalf under the WhatsApp Business Data Processing Terms.

Information we process

Merchant account data: your name and business name, email address, phone number, business industry and location, login identifiers (including a Google account identifier if you sign in with Google), your connected store details (such as a Shopify shop domain and owner email), and billing records. When you accept our Terms, Privacy Policy or Data Processing Terms in the dashboard, we record the document version, the time, and the IP address and browser used, as evidence of that acceptance.

End-customer data, processed on behalf of a merchant: the customer's WhatsApp phone number and profile name, the content of messages and media exchanged with the business, delivery and read status, cart and order details, shipping addresses, and membership of any contact list the merchant maintains.

Platform Data from Meta APIs: data we obtain through Meta's APIs — what the Meta Platform Terms call "Platform Data" — including WhatsApp phone numbers, message content, profile names, media, and delivery metadata, and, where a merchant chooses to connect it, leads and page information from Facebook Lead Ads.

Technical data: limited service and error-diagnostic logs (through our error-monitoring provider, from which we strip authentication and signature data), and the strictly necessary authentication and session cookies our dashboard needs to work.

Payment data: we record that a payment occurred and its amount and reference. Card, UPI, and bank details are entered directly on our payment provider's systems (Razorpay) and are not collected or stored by us.

How and why we use information

We use this information to operate the messaging service on the merchant's behalf, generate automated replies, process orders and payments, maintain the contact lists and campaigns a merchant configures, provide that merchant with analytics about their own conversations, secure and support the service, and meet our legal, tax, and accounting obligations.

Automated replies and AI: to classify a message's intent, generate bot responses, and interpret typed addresses, we send the relevant message content to our AI sub-processor, Anthropic (the "Claude" models), over an encrypted connection. We use it solely to provide the service and do not permit this content to be used to train AI models. Before any message is sent to the AI or stored in conversation context, we screen it for payment-card numbers and one-time passwords and block those from being forwarded.

We do not use end-customer data for our own marketing, and we do not use one merchant's data to benefit another merchant.

Our commitments regarding Platform Data

We do not sell, license, or purchase Platform Data.

We do not transfer Platform Data to data brokers, ad networks, or other monetisation intermediaries.

We do not use Platform Data to build or augment profiles of individuals for advertising or for any purpose unrelated to providing the service.

We use Platform Data only to provide and improve the UseWhat service for the merchant from whom it originates, consistent with the Meta Platform Terms and the WhatsApp Business Solution Terms.

Sharing and sub-processors

We do not sell personal data. We share it only with the service providers needed to run UseWhat, each acting on our instructions under contract, and only as described below or where required by law.

Meta Platform / WhatsApp — to send and receive the messages that are the core of the service.

Amazon Web Services — cloud hosting, database, and storage of message media, in the India (ap-south-1) region.

Razorpay — a PCI-DSS-compliant payment provider that processes subscription and customer payments; card and UPI details are handled on Razorpay's systems, not ours.

Anthropic — to generate the AI replies and classifications described above.

Google — where a merchant enables it: sign-in, Google Sheets import/export of contacts and orders, and Calendar scheduling.

Shopify — where a merchant connects their store, to look up products and place or track orders.

A hosted error-monitoring provider — to capture technical errors, with authentication and signature data removed.

Some of these providers (including Meta and Anthropic) may process data outside India. Where that happens we rely on appropriate contractual and legal safeguards for the transfer.

Where we process your end customers' personal data on your behalf as your processor, the Data Processing Terms (available at /dpa) apply.

Data retention

We retain merchant account data for as long as the account is active and as needed to provide the service and meet our legal obligations. Message content, orders, and related records are retained while the merchant's account is active.

We delete this data when the account is closed or upon a valid deletion request (see below), and we instruct our sub-processors to do the same without undue delay. Limited operational logs, such as diagnostics for failed background jobs, may persist for a short period. Payment and invoice records are retained for the period required by tax and accounting law.

When an account is permanently erased, a limited set of records is deliberately kept in a form that is no longer linked to your workspace: tax invoices and payment records, subscription and refund records, marketing opt-out records, and platform audit events. We keep tax and payment records because company and tax law requires it; refund records so that any amount still owed to you can still be paid out; opt-out records so that a person who asked never to be messaged again is not contacted by a future account; and audit events for security and fraud prevention. These records are not used to re-identify you or to contact you.

Your right to request deletion

You may ask us to delete all personal data we hold from or about you, at any time and free of charge, regardless of where you are located.

Merchants can delete their own account from inside the app, without contacting us. Sign in as the account owner, open Settings, scroll to the "Danger Zone" panel, and choose "Delete my account". You will be asked to type your workspace name to confirm. Only the account owner can do this, and it cannot be done by our support staff on your behalf.

Requesting deletion immediately cancels any active subscription and closes the workspace, then starts a grace period of at least 30 days during which the owner can restore the account from the same screen. If a paid subscription cycle runs beyond those 30 days, the grace period lasts until that cycle ends, because the account has been paid for through that date. When the grace period expires, the account and its associated data are permanently erased, subject to the limited retained records described under "Data retention" above.

Merchants can also export, correct, or erase an individual end customer's data from that customer's page in the dashboard. Erasure takes effect after a 7-day grace period, during which no messages are sent to the customer other than an opt-out confirmation and the merchant can cancel. Order and payment records are kept for tax law in anonymised form, with the customer's name and phone number removed.

If you would rather not use the in-app route, or you are an end customer rather than a merchant, write to info@usewhat.in. End customers may also contact the business they messaged directly. We verify the request and instruct our sub-processors to delete the data without undue delay, and in any case within 30 days.

If we are unable to honour part of a request — for example, records we must keep to meet a legal, tax, or fraud-prevention obligation — we will tell you which data and why. This section also serves as our data-deletion instructions for the purposes of Meta's platform requirements.

Your rights under the DPDP Act

Subject to the DPDP Act, you have the right to access a summary of the personal data we process about you and how we process it; to correct, complete, or update it; to request its erasure; to grievance redressal; and to nominate another person to exercise your rights in the event of death or incapacity.

Where our processing of your data relies on your consent, you may withdraw that consent at any time, as easily as you gave it; withdrawal does not affect processing already carried out. To exercise any of these rights, contact us at info@usewhat.in or our Grievance Officer below.

Security

We protect information with measures appropriate to its sensitivity. All data sent between you, us, and our providers travels over encrypted (HTTPS/TLS) connections. Third-party access tokens and API secrets are encrypted at rest using authenticated encryption. Account passwords are stored only as salted hashes, never in plain text. Card and UPI data is handled by our PCI-DSS-compliant payment provider. Our infrastructure is access-controlled and hosted on a reputable cloud provider.

No method of transmission or storage is completely secure, so while we work hard to protect your data we cannot guarantee absolute security.

Cookies

Our dashboard uses only the strictly necessary cookies required to keep you signed in and maintain your session; it carries no advertising or cross-site tracking. Our public website uses advertising measurement cookies when you consent to them — see "Advertising measurement" below and our Cookie Policy.

Advertising measurement

When you consent to advertising cookies, we share a limited set of information with Meta Platforms Ireland Limited so that it can measure whether our advertising led to a signup or a subscription. This is limited to a cryptographically hashed version of your email address, your IP address, your browser user-agent string, and the Meta cookie identifiers described in our Cookie Policy.

Your email address is hashed using SHA-256 before it leaves our servers. We do not share your plaintext email address, your phone number, or your name, as the holder of a UseWhat account, with Meta for advertising purposes. Conversion reporting for Click-to-WhatsApp ads run by a merchant is described separately below.

We do not share information about your customers or the messages processed on your behalf for our own advertising. That information belongs to you, and we act only as a processor for it. The one exception is conversion tracking for Click-to-WhatsApp ads, described in the next section, which we do only on your behalf.

You can withdraw your consent at any time using the "Cookie preferences" link in the footer. Withdrawing stops all further sharing described in this paragraph; it does not undo sharing that already occurred.

Conversion tracking for Click-to-WhatsApp ads

When a merchant runs Click-to-WhatsApp ads and conversion tracking is on for their account, we share conversion events with Meta on the merchant's behalf, so the merchant can measure and optimise their own ads. Each event contains the ad click identifier Meta gave us when the customer messaged the business or, when there is none, a hashed (SHA-256) version of the customer's phone number; the event type (for example a purchase or a qualified lead); and, for orders, the order value, currency and order ID.

Customers who opt out (STOP) are not reported from the moment they opt out (events sent before then stay with Meta), and we do not report customers whose data has been erased. We delete this data from our systems when an erasure request is processed. Meta processes these events under its own business terms for ad measurement by the merchant.

Children's data

UseWhat is a business tool and is not directed to children. We do not knowingly process the personal data of children except where it may appear incidentally within a merchant's customer conversations, which the merchant is responsible for handling lawfully. If you believe a child's data has been provided to us, contact us so we can address it.

Grievance Officer

In accordance with the DPDP Act, you can raise any grievance about our handling of your personal data with our Grievance Officer:

Grievance Officer: Akshita Sharma, Director, Cogvex Solutions Private Limited, C-042C, 4TH FLOOR, SUPERMART-1 DLF PHASE-IV, DLF QE, Dlf Qe, Gurgaon- 122002, Haryana. Email: info@usewhat.in.

We will acknowledge and respond to grievances within the timelines prescribed by law. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are material, take reasonable steps to notify you. Your continued use of the service after an update takes effect constitutes acceptance of the revised policy.

Contact us

For any question about this Privacy Policy or your personal data, contact Cogvex Solutions Private Limited at info@usewhat.in, or write to us at C-042C, 4TH FLOOR, SUPERMART-1 DLF PHASE-IV, DLF QE, Dlf Qe, Gurgaon- 122002, Haryana.