Privacy Policy

For your own account data (your name, login email, billing details) we are the data fiduciary (controller).

For your customers' and employees' data that you put into the platform (WhatsApp contacts and messages, employee records, job applicants), you are the data fiduciary and we act as your data processor. We process that data only to provide the service and on your instructions.

• Account data: name, work email, phone, company name, role, hashed password, login history.
• Billing data: plan, invoices and payment status. Card, UPI and bank details are entered on Razorpay and are never stored by us.
• WhatsApp data you connect: your WhatsApp Business Account ID, phone number ID, access token (stored encrypted), contacts' phone numbers and profile names, message content, media, delivery status and templates.
• Workspace data: team members, permissions, and other records you create in the products you use (such as HR or hiring records as those products become available).
• Enquiries: details you send through our contact form or WhatsApp chat.
• Technical data: IP address, browser, device, pages used and error logs, kept for security and reliability.

• To create your workspace, authenticate you, and provide and support the service.
• To send and receive WhatsApp messages through the Meta WhatsApp Business Platform on your behalf.
• To bill you and prevent fraud, abuse and unauthorised access.
• To send service messages such as invites, security alerts and billing notices.
• To improve the product using aggregated usage information.

We do not sell personal data and do not use your customers' messages for advertising.

You must have a valid opt-in from every person you message on WhatsApp and must honour opt-outs. The platform only sends broadcasts to contacts marked as opted in. You remain responsible for the lawfulness of the contacts you upload.

Only with service providers needed to run the platform, under contract:

• Meta Platforms (WhatsApp Business Platform): message delivery.
• Razorpay: payment processing and subscriptions.
• Vercel (application hosting) and our database provider (managed PostgreSQL).
• Authorities, where required by law or to protect rights and safety.

These providers may process data outside India. We take steps to ensure appropriate safeguards.

Data is encrypted in transit (HTTPS). Third-party access tokens are encrypted at rest. Passwords are stored only as salted hashes. Access is role-based, sensitive actions are logged, and webhooks are cryptographically verified. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

We keep workspace data while your account is active. After cancellation or deletion, we delete or anonymise it within 90 days, except billing records we must keep for tax and accounting (up to 8 years) and logs needed to resolve disputes or prevent abuse.

You may ask us to access, correct, update or erase your personal data, withdraw consent, or nominate someone to exercise these rights on your behalf. For data a company put into the platform about you (for example an employee or a WhatsApp customer), please contact that company first; we will assist them in responding.

Write to hello@mecgura.com. We respond within 30 days.

We use only essential cookies: a secure session cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies.

The service is for businesses and is not directed to anyone under 18.

We will post updates here and, for material changes, notify account owners by email. Continued use after the effective date means you accept the update.

Grievance Officer, MECGURA, India
Email: hello@mecgura.com
Phone / WhatsApp: +91 7837722567