Privacy Policy

This Privacy Policy explains how KDC Tek Private Limited (we, us) collects, uses, shares and protects personal data when you use WA.cr. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the WhatsApp Business Solution Terms. We have kept the language plain on purpose.

1. Who we are, and our two roles

• For data about you (our customer — your account, billing and business details), we are the Data Fiduciary and decide how that data is used.
• For data about your customers that flows through WA.cr (chats on WhatsApp and your other channels, contacts, orders), you are the Data Fiduciary and we act as your Data Processor, handling that data only on your instructions, in line with the data-processing terms in our Terms of Service.

2. Data we collect

• Account & business data — name, email, phone, company details and the tax/registration information needed to onboard you.
• Verification (KYC) data — documents we collect when verification is required, processed through KDC's own verification pipeline.
• End-customer messaging data — messages, contact details, media and order details you exchange with your customers on any channel you connect to WA.cr (such as WhatsApp, Instagram and email), which we process on your behalf.
• Connected-store data — when you connect a commerce platform (such as Shopify), we sync your customers, orders and products. This can include a buyer's name, email, phone and billing/shipping address, processed on your behalf so the order reaches the buyer's WhatsApp chat and can be fulfilled.
• Google account data — only if you connect Google Sheets, Calendar, Analytics or Ads; see section 10.
• Meta account data — only if you connect an Instagram account, a WhatsApp number or a Meta ad account; see section 11.
• Billing data — plan, usage and payment references (card and UPI details are handled by our payment processor, not stored by us).
• Usage & device data — log data, IP address and cookies; see our Cookie Policy.

3. How we use data, and our legal basis

We process personal data to provide and secure WA.cr, deliver your WhatsApp messages, take payments, verify your business, support you, meet legal and tax obligations, and improve the platform. We rely on your consent and on the lawful purposes recognised under the DPDP Act. We never sell your data, and we never share your customers' phone numbers or email addresses with third parties for their own marketing.

4. Who we share data with (sub-processors)

We share data only with service providers who help us run WA.cr, under contracts that require them to protect it:

5. Where your data lives

All WA.cr data — including chat metadata and verification documents — is stored in Mumbai on Google Cloud (asia-south1). Some providers above (for example Meta and Cloudflare) operate globally, so limited data may be processed outside India as part of delivering messages and securing traffic; where this happens, it is protected by contractual safeguards.

6. How long we keep it

We keep personal data for as long as your account is active and as long as needed for the purposes above. Some records — such as billing, tax and audit logs — are retained for up to 7 years to meet legal and regulatory requirements. When data is no longer needed, we delete or anonymise it.

7. How we protect it

We use encryption in transit, access controls, tenant isolation and an audit trail on sensitive actions. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the authorities of a reportable breach as required by law.

8. Your rights

Under the DPDP Act, you can:

• access a summary of the personal data we hold about you;
• ask us to correct or update inaccurate data;
• request a data export or full deletion at any time by emailing admin@kdc.in;
• nominate someone to exercise your rights in the event of death or incapacity;
• withdraw consent, and raise a grievance with our Grievance Officer below.

9. Connected stores (Shopify and other commerce platforms)

When you connect a store to WA.cr, we act as your Data Processor for the customer and order data we sync from it, handling it only to create and manage orders, message the buyer on your behalf, and push fulfilment back to the store. We never use this data for our own purposes and never sell it.

• What we sync — orders, customers and products, including a buyer's name, email, phone and billing/shipping address where present.
• Access & deletion requests — a buyer exercises their rights through you, the merchant (the data controller). For Shopify we honour the mandatory privacy webhooks: a customer data request makes the data we hold available to you; a customer redaction erases that buyer's personal data from WA.cr; and a shop redaction deletes the store's data after the app is uninstalled.
• Retention — connected-store data is kept while the store is connected and is removed on a redaction request or when you disconnect, subject to any record-keeping the law requires.

10. Google user data (Google Sheets, Calendar, Analytics and Ads)

You can connect a Google account to WA.cr to use Google Sheets, Google Calendar, Google Analytics or Google Ads. Google asks for your permission first, and we ask only for the access the feature you are connecting needs. This section covers the data we receive from Google this way (Google user data), apart from the rest of this policy.

• How we use it — only to provide the features above that you turn on and can see in WA.cr. We do not use Google user data for advertising, do not sell it, and do not use it to build profiles, judge creditworthiness or for anything unrelated to those features.
• AI features — when an AI feature you turn on needs something from a Google service (for example, an AI reply offering appointment times checked against your calendar, or the Ads assistant answering a question about your Google Ads), our AI provider receives only what that answer needs — such as your free time slots, never your event details — and processes it to produce the answer. Its terms do not allow it to train its models on that data. We never use Google user data to develop, improve or train generalised AI or machine-learning models.
• Who we share it with — we never sell Google user data or transfer it to advertising platforms, data brokers or information resellers. We share it only with the service providers in section 4 that host and process it for us under contract, with our AI provider as described above, where the law requires it, or as part of a merger, acquisition or sale of assets, with notice to you. Customer lists and conversions you upload go to your own Google Ads account.
• Who can see it — no one at KDC Tek Private Limited reads your Google user data unless you give us explicit permission (for example, to help with a support request), it is needed to investigate abuse or a security incident, or the law requires it. Our technical logs record that a call to Google happened and whether it succeeded, not what it contained.
• How we protect it — the access tokens Google gives us are kept in Google Cloud Secret Manager, encrypted at rest, never in our database and never shown in WA.cr; only our servers can use them. The one exception is Google Sheets' file picker: to open it, your browser receives a short-lived token that carries only drive.file, expires within an hour and is never stored. Data we receive from Google is stored in Mumbai (see section 5), encrypted at rest and in transit, and kept separate for each workspace. Connecting and disconnecting a Google account is recorded in your workspace's audit trail.
• How long we keep it, and how to delete it — only as long as the feature that uses it needs it. When you disconnect a Google service in WA.cr, we delete its token straight away and can no longer reach that service. Unlinking a Google Analytics property deletes the audience data we synced from it. You can also remove WA.cr's access at any time from your Google Account (myaccount.google.com/connections). To have all the Google user data we hold deleted, email admin@kdc.in and we will do so within 30 days. Rows, events and campaigns WA.cr added to your Google account at your request belong to you and stay there until you delete them.

WA.cr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Meta user data (Instagram, WhatsApp and Meta ads)

You can connect an Instagram professional account, a WhatsApp number or a Meta ad account to WA.cr. Instagram or Facebook asks for your permission first, and we ask only for the access the feature you are connecting needs. This section covers the data we receive from Meta this way (Meta user data), apart from the rest of this policy.

• How we use it — only to provide the features above that you turn on and can see in WA.cr. We do not use Meta user data for our own advertising, do not sell it, and do not use it to build profiles of the people who message you or for anything unrelated to those features.
• AI features — when an AI feature you turn on needs Meta user data (for example, an AI reply to a WhatsApp message, or the Ads assistant answering a question about your Meta ads), our AI provider receives only what that answer needs and processes it to produce the answer. Its terms do not allow it to train its models on that data, and we never use Meta user data to train AI models.
• Who we share it with — we never sell Meta user data or transfer it to advertising networks, data brokers or information resellers. We share it only with the service providers in section 4 that host and process it for us under contract, with our AI provider as described above, where the law requires it, or as part of a merger, acquisition or sale of assets, with notice to you. Your messages and replies go to Meta so they can be delivered, ads you create go to your own ad account, and if you turn on ad conversions, your sales from click-to-WhatsApp ads go to your own dataset at Meta.
• Who can see it — no one at KDC Tek Private Limited reads your messages or other Meta user data unless you give us explicit permission (for example, to help with a support request), it is needed to investigate abuse or a security incident, or the law requires it. Our technical logs of calls to Meta can hold what a call carried, such as a WhatsApp message, for troubleshooting; only WA.cr's platform administrators can open them.
• How we protect it — the access tokens Meta gives us are kept in Google Cloud Secret Manager, encrypted at rest, never in our database and never shown in WA.cr; only our servers can use them. Data we receive from Meta is stored in Mumbai (see section 5), encrypted at rest and in transit, and kept separate for each workspace. Connecting and disconnecting Instagram accounts, WhatsApp numbers and ad accounts is recorded in your workspace's audit trail.

How long we keep Meta user data, and how to delete it

• Messages, comments and contacts are your inbox history. We keep them while your workspace is active, including after you disconnect a channel, so your team keeps its conversation history.
• When you disconnect an Instagram account or a WhatsApp number in WA.cr, we stop using it and delete the access token we held for it. When you disconnect an ad account, we stop syncing it and keep the reports already synced.
• To withdraw WA.cr's access at Meta, remove WA.cr in Instagram under Settings → Apps and websites (instagram.com/accounts/manage_access), or in Facebook under Settings → Business integrations (facebook.com/settings).
• To have the Meta user data we hold deleted, email admin@kdc.in with your workspace name and we will delete it within 30 days. A deletion request Meta sends us after you remove WA.cr in Instagram or Facebook is handled the same way, and Meta gives you its confirmation code.
• Messages, replies, catalogue items and ads WA.cr created in your Meta accounts at your request belong to you and stay there until you delete them.

We use Meta user data only as Meta's Platform Terms and Developer Policies allow.

12. Children

WA.cr is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this Privacy Policy as the platform and the law evolve. We will revise the date above and, for material changes, give you notice where appropriate.

14. WA.cr Scheduler — our Chrome extension

WA.cr Scheduler is a separate, optional Chrome extension we publish that lets you schedule WhatsApp Web messages to be sent at a later time. It works very differently from the WA.cr platform described above: everything it stores stays on your own device, and it sends nothing to us or to any third party. The extension makes no network requests of its own; the only sending that happens is the WhatsApp message itself, delivered through your own logged-in WhatsApp Web session exactly as if you had sent it manually.

What it stores, and where

• Scheduled messages — the message text, the chosen send time, and the name (and, where available, the phone number) of the chat you scheduled it for.
• Attachments — the file contents of any images, videos, or documents you attach to a scheduled message.
• Delivery status — whether each message is pending, sent, failed, missed, or cancelled, plus any error text, so the queue can show you what happened.
• Settings — your preferences (time format, tab behaviour, catch-up window, notification toggles).

Messages, status and settings live in your browser's chrome.storage.local; attachment contents live in IndexedDB within the web.whatsapp.com origin on your computer. None of it is synced to any account, server, or cloud service operated by us.

What the extension does not do

• It does not transmit your messages, attachments, contacts, or settings to any server.
• It does not collect analytics, telemetry, usage statistics, or crash reports.
• It does not use tracking, advertising, or fingerprinting.
• It does not sell, rent, or share any data with third parties.
• It does not load or execute any remote or hosted code.

Permissions, and why they are needed

• Storage / unlimited storage — to save your scheduled messages and their attachments locally.
• Alarms — to wake at the scheduled time and send the message.
• Notifications — to tell you when a message was sent or failed (you can turn these off).
• Tabs — to find or open your WhatsApp Web tab so a scheduled message can be sent.
• Scripting + access to web.whatsapp.com — to add the “schedule” button to the composer and perform the send on the page at the scheduled time.

Deleting extension data

You control all stored data. You can delete individual scheduled messages from the toolbar popup, use Delete all scheduled messages in the extension's Settings, or remove the extension from chrome://extensions, which clears its local storage.

WA.cr Scheduler is an independent tool and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. Questions about this section? Email ping@wa.cr.

15. Campaign research from your inbox

If you switch on inbox research in AI campaigns, WA.cr reads a sample of recent messages your customers sent you on any channel, removes phone numbers, email addresses and identity numbers, and sends the rest to our AI provider to find recurring questions and objections. We keep only reworded themes and counts, not the messages, and our AI providers may not train their models on them. We do this only on your instruction, as your Data Processor (see section 1).