This policy explains how Wasavo handles personal data across our website and our seven products: the WhatsApp Platform, Wasavo Clinic, Wasavo Schools, Wasavo Tyre, Wasavo Gym, Wasavo Signage and Wasavo IVR. It applies to visitors to this website, to people who sign up for an account, and to the people whose details our customers store in our products.
Who we are
Wasavo is an Indian SaaS company. We build business software for clinics, schools, gyms, workshops and retail, most of it running on WhatsApp. Our customers are businesses in India and Saudi Arabia.
The legal entity behind Wasavo is [ADD: registered company name], registered at [ADD: registered address]. For anything in this policy you can reach us at privacy@wasavo.com.
The data we collect
Account data
When you sign up or talk to our sales team we collect the name, business name, email address, phone number and WhatsApp number you give us, along with your billing details and the plan you are on. We also keep the correspondence you have with us, so that whoever picks up your next question can see what was already said.
Customer-uploaded data
Our products exist to hold the records your business already keeps: contacts, patients, students, members, vehicles, invoices and the message history attached to them. You decide what goes in. We do not choose what you upload, we do not use it to build any product of our own, and we do not sell it or share it with anyone for their own purposes.
Usage and log data
Our servers record the ordinary technical details of a request: IP address, browser and device type, pages or screens opened, timestamps, and errors. We use this to keep the service running, to investigate faults and to detect abuse.
Cookies and analytics
This website uses cookies that are necessary for it to work, and Google Analytics 4 to understand which pages people actually read.
Analytics cookies. Google Analytics sets first-party analytics cookies in your browser — _ga and _ga_<id> — which tell one visitor apart from another across pages and visits. We use them to count and understand traffic, not to identify you. Analytics data is reported to us in aggregate.
You can block or delete cookies in your browser; the site will still work without them. Our product dashboards use cookies to keep you signed in, and those are necessary for the product to function.
Why we use it
- To provide the product you signed up for, and to keep your account working.
- To send service messages: onboarding, billing, security notices, and changes that affect you.
- To provide support when you ask for it.
- To bill you correctly, and to meet our tax and accounting obligations.
- To keep the service secure, to prevent abuse and to investigate misuse.
- To improve the product, using aggregated usage patterns rather than the contents of your records.
We do not sell personal data, and we do not use customer-uploaded data for advertising.
Legal basis
Where you are our customer, we process your account data because we need it to perform the contract between us, and because we have a legitimate interest in running and securing our business. Where the law requires consent — for marketing messages you have not asked for, for example — we ask for it first, and you can withdraw it at any time.
For customer-uploaded data, the legal basis for processing it sits with the customer who uploaded it. They decide why that data exists and what happens to it; our role is set out below.
Our role: processor, not controller
For the data our customers upload, Wasavo acts as a data processor. The customer is the controller. We process that data only on the customer's documented instructions — which, in practice, means the actions they take in the product.
So if you are a patient of a clinic, a parent at a school, or a member of a gym that uses Wasavo, and you want to see, correct or delete your data, please contact that organisation directly. They decide what happens to it. If you contact us instead, we will pass your request to them and tell you we have done so; we cannot act on their records ourselves without their instruction.
For our own account, billing and website data, Wasavo is the controller.
Sub-processors
We use a small number of third parties to deliver the service. Each is bound to confidentiality and may use the data only to provide their service to us.
- Meta Platforms (WhatsApp Cloud API) — WhatsApp messages sent and received through Wasavo pass through Meta's WhatsApp Cloud API. Meta processes message content under its own terms and privacy policy, which we do not control. Wasavo is not affiliated with WhatsApp LLC or Meta Platforms, Inc.
- Google (Analytics) — website analytics only. No customer-uploaded data reaches it.
- Hostinger — email.
- [ADD: any other sub-processors, e.g. SMS fallback, error monitoring]
We will update this list before adding a sub-processor that handles customer-uploaded data.
Where your data is stored
Customer data is stored on servers located in India. Every record is scoped to your account, so another customer cannot reach your data.
Two things cross a border by design, and you should know about both. WhatsApp message content is processed by Meta on their own global infrastructure. And if you are a customer in Saudi Arabia, your records are held in India rather than locally — please check this against your own obligations before you upload anything sensitive.
How long we keep it
We keep customer-uploaded data for as long as your account is active. After you cancel we keep it for 30 days, so that an account closed by mistake can be recovered, and then delete it. You can export your full data at any point during those 30 days, and you can ask us to delete it sooner.
Billing records are kept for as long as Indian tax law requires. Log data is kept for 90 days.
Security
Data is encrypted in transit using TLS. Access to production systems is restricted to the staff who need it, and every record is scoped to the account that owns it. Within your own account, role-based access lets you decide which of your staff can see what.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will tell you and the relevant authority, within the timeframes the law sets.
Your rights
Subject to the law that applies to you, you can ask us to:
- confirm what personal data of yours we hold, and get a copy of it;
- correct it if it is wrong or incomplete;
- delete it, where we are not required to keep it;
- stop using it for a particular purpose, or withdraw a consent you gave;
- nominate another person to exercise these rights on your behalf if you die or become incapacitated.
Write to privacy@wasavo.com. We will respond within 30 days. We may need to verify who you are before we act. If your request concerns data an organisation uploaded about you, see Our role above.
India: the DPDP Act 2023
For customers and users in India, we handle personal data in line with the Digital Personal Data Protection Act, 2023. In the Act's language we are a Data Fiduciary for our own account and website data, and a Data Processor for the data our customers upload. The rights listed above reflect the rights the Act gives Data Principals, and the grievance route below is the one the Act requires.
Saudi Arabia: the PDPL
For customers in Saudi Arabia, we handle personal data in line with the Personal Data Protection Law and its implementing regulations. Note the point made above: Wasavo stores customer data on servers in India, so using our products involves a transfer of personal data outside the Kingdom. Please satisfy yourself that this is appropriate for your data before you upload it, and talk to us if you need specific arrangements in writing.
Grievance officer
If you are unhappy with how we have handled your data or your request, you can escalate to our grievance officer:
- Name: Shaifi Ahmed
- Email: privacy@wasavo.com
- Address: [ADD: grievance officer postal address]
We will acknowledge a grievance within 7 days. If you are still not satisfied, you may complain to the Data Protection Board of India or, in Saudi Arabia, to the competent supervisory authority.
Children's data
Our products are business software. They are not intended for direct use by children, and we do not knowingly create accounts for them.
Wasavo Schools necessarily holds records about students, many of whom are children. That data is uploaded and controlled by the school. The school is responsible for obtaining verifiable parental consent where the law requires it, and for deciding what student data is collected and how long it is kept. We process it only on the school's instructions.
Changes to this policy
We update this policy when the product or the law changes. The date at the top always reflects the current version. If a change materially affects how we handle your data we will tell account holders by email before it takes effect.
Contact
Questions about this policy: privacy@wasavo.com. General enquiries: sales@wasavo.com, or message us.
See also our Terms of Service.