Privacy Policy

This Privacy Policy explains how KDC Tek Private Limited (we, us) collects, uses, shares and protects personal data when you use WA.cr. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the WhatsApp Business Solution Terms. We have kept the language plain on purpose.

1. Who we are, and our two roles

• For data about you (our customer — your account, billing and business details), we are the Data Fiduciary and decide how that data is used.
• For data about your customers that flows through WA.cr (WhatsApp chats, contacts, orders), you are the Data Fiduciary and we act as your Data Processor, handling that data only on your instructions, in line with the data-processing terms in our Terms of Service.

2. Data we collect

• Account & business data — name, email, phone, company details and the tax/registration information needed to onboard you.
• Verification (KYC) data — documents we collect when verification is required, processed through KDC's own verification pipeline.
• End-customer messaging data — WhatsApp messages, contact numbers, media and order details you exchange with your customers, which we process on your behalf.
• Connected-store data — when you connect a commerce platform (such as Shopify), we sync your customers, orders and products. This can include a buyer's name, email, phone and billing/shipping address, processed on your behalf so the order reaches the buyer's WhatsApp chat and can be fulfilled.
• Billing data — plan, usage and payment references (card and UPI details are handled by our payment processor, not stored by us).
• Usage & device data — log data, IP address and cookies; see our Cookie Policy.

3. How we use data, and our legal basis

We process personal data to provide and secure WA.cr, deliver your WhatsApp messages, take payments, verify your business, support you, meet legal and tax obligations, and improve the platform. We rely on your consent and on the lawful purposes recognised under the DPDP Act. We never sell your data, and we never share your customers' phone numbers with third parties for their own marketing.

4. Who we share data with (sub-processors)

We share data only with service providers who help us run WA.cr, under contracts that require them to protect it:

5. Where your data lives

All WA.cr data — including chat metadata and verification documents — is stored in Mumbai on Google Cloud (asia-south1). Some providers above (for example Meta and Cloudflare) operate globally, so limited data may be processed outside India as part of delivering messages and securing traffic; where this happens, it is protected by contractual safeguards.

6. How long we keep it

We keep personal data for as long as your account is active and as long as needed for the purposes above. Some records — such as billing, tax and audit logs — are retained for up to 7 years to meet legal and regulatory requirements. When data is no longer needed, we delete or anonymise it.

7. How we protect it

We use encryption in transit, access controls, tenant isolation and an audit trail on sensitive actions. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the authorities of a reportable breach as required by law.

8. Your rights

Under the DPDP Act, you can:

• access a summary of the personal data we hold about you;
• ask us to correct or update inaccurate data;
• request a data export or full deletion at any time by emailing admin@kdc.in;
• nominate someone to exercise your rights in the event of death or incapacity;
• withdraw consent, and raise a grievance with our Grievance Officer below.

9. Connected stores (Shopify and other commerce platforms)

When you connect a store to WA.cr, we act as your Data Processor for the customer and order data we sync from it, handling it only to create and manage orders, message the buyer on your behalf, and push fulfilment back to the store. We never use this data for our own purposes and never sell it.

• What we sync — orders, customers and products, including a buyer's name, email, phone and billing/shipping address where present.
• Access & deletion requests — a buyer exercises their rights through you, the merchant (the data controller). For Shopify we honour the mandatory privacy webhooks: a customer data request makes the data we hold available to you; a customer redaction erases that buyer's personal data from WA.cr; and a shop redaction deletes the store's data after the app is uninstalled.
• Retention — connected-store data is kept while the store is connected and is removed on a redaction request or when you disconnect, subject to any record-keeping the law requires.

10. Children

WA.cr is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this Privacy Policy as the platform and the law evolve. We will revise the date above and, for material changes, give you notice where appropriate.

12. WA.cr Scheduler — our Chrome extension

WA.cr Scheduler is a separate, optional Chrome extension we publish that lets you schedule WhatsApp Web messages to be sent at a later time. It works very differently from the WA.cr platform described above: everything it stores stays on your own device, and it sends nothing to us or to any third party. The extension makes no network requests of its own; the only sending that happens is the WhatsApp message itself, delivered through your own logged-in WhatsApp Web session exactly as if you had sent it manually.

What it stores, and where

• Scheduled messages — the message text, the chosen send time, and the name (and, where available, the phone number) of the chat you scheduled it for.
• Attachments — the file contents of any images, videos, or documents you attach to a scheduled message.
• Delivery status — whether each message is pending, sent, failed, missed, or cancelled, plus any error text, so the queue can show you what happened.
• Settings — your preferences (time format, tab behaviour, catch-up window, notification toggles).

Messages, status and settings live in your browser's chrome.storage.local; attachment contents live in IndexedDB within the web.whatsapp.com origin on your computer. None of it is synced to any account, server, or cloud service operated by us.

What the extension does not do

• It does not transmit your messages, attachments, contacts, or settings to any server.
• It does not collect analytics, telemetry, usage statistics, or crash reports.
• It does not use tracking, advertising, or fingerprinting.
• It does not sell, rent, or share any data with third parties.
• It does not load or execute any remote or hosted code.

Permissions, and why they are needed

• Storage / unlimited storage — to save your scheduled messages and their attachments locally.
• Alarms — to wake at the scheduled time and send the message.
• Notifications — to tell you when a message was sent or failed (you can turn these off).
• Tabs — to find or open your WhatsApp Web tab so a scheduled message can be sent.
• Scripting + access to web.whatsapp.com — to add the “schedule” button to the composer and perform the send on the page at the scheduled time.

Deleting extension data

You control all stored data. You can delete individual scheduled messages from the toolbar popup, use Delete all scheduled messages in the extension's Settings, or remove the extension from chrome://extensions, which clears its local storage.

WA.cr Scheduler is an independent tool and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. Questions about this section? Email ping@wa.cr.