Privacy Policy

1. Two kinds of data, two roles

• Your account data — who you are as our customer. We decide how it's used (we're the controller / data fiduciary).
• Your customers' data — the contacts you upload and the messages you exchange with them. You decide how it's used; we process it only on your instructions to deliver the service (we're your processor). You're responsible for having a lawful basis and permission to message those people. If they're in the EU or UK, our Data Processing Agreement sets out the terms, sub-processors and transfer safeguards.

2. What we collect

• Account: email address, password (stored hashed by our auth provider), workspace name.
• Google sign-in (if you use it): your name, email address and profile picture from your Google account, used only to sign you in and name your workspace. We don't get your Google password or access to anything else in your Google account.
• WhatsApp connection: your WhatsApp Business Account ID, phone number ID and display number, and your Meta access token — encrypted before it's stored.
• API keys: stored only as a one-way hash; we can't read your key back.
• Contacts and messages: phone numbers, names and any columns you upload; templates, flows and sequences; messages sent and received, with delivery status; opt-out status.
• Billing: your plan, trial dates and message usage. Card and payment details are handled by Dodo Payments — we never see or store your card number.
• Technical: basic request logs (such as IP address and time) kept by our hosting provider for security and debugging, and when an API key was last used.
• Usage: which days your workspace was active and through what (the dashboard, a connected AI assistant or the API); your approximate location (country, region and city, worked out from your IP address by our hosting provider); and how you found us — the site that linked to sign-up, any campaign tags on that link, whether you signed up to connect an AI assistant, and your answer if you tell us. We use this to understand how SendFromChat is used and improve it. Recorded on our own servers, without cookies.
• Website visits: anonymous page-view statistics for our public pages — which page, the site you came from, any campaign tags on the link, your country and device type — recorded on our own servers and through Vercel Web Analytics. No cookies, and we don't store your IP address: to count unique visitors we keep only a one-way code made from it that changes every day, so it can't follow you from one day to the next. Sign-in tokens and record IDs are removed from page addresses before anything is recorded.
• Cookies: the cookies that keep you signed in, and one small first-party cookie, sfc_consent, that remembers your marketing-cookie choice (up to 180 days). Marketing cookies from Meta (_fbp, _fbc) are set only if you accept them, as described in section 3.

3. Marketing cookies and Meta (optional, only if you accept)

If we are running ads for SendFromChat on Facebook or Instagram, a banner asks whether we may use marketing cookies. Accept and Reject are equal choices, and the site and product work the same either way. Until you accept, nothing is loaded from Meta and nothing is sent to it.

• What Meta receives if you accept: the pages you view on our public pages (not the signed-in dashboard); Meta's own browser identifiers (_fbp and, if you arrived from a Meta ad, _fbc); your browser's user-agent string; and, for the events “account created”, “free trial started”, “WhatsApp number connected” and “first payment” (with its amount and currency), a one-way hash (SHA-256) of your email address. We never send the email address itself, message content, contacts or phone numbers.
• Why: to measure whether our ads lead to sign-ups and customers, and to show our ads to people likely to be interested. Meta Platforms Ireland Limited acts as an independent controller for its own use of this data under its own terms; data may be transferred outside the EU/EEA, on the safeguards Meta describes in its terms.
• Legal basis: your consent (Article 6(1)(a) GDPR). It is optional and not needed to use SendFromChat.
• Our record: if you accept and then sign up, we note on your workspace that you consented (and the two Meta identifiers) so later events can be sent; that is deleted if you withdraw.
• Withdrawing or changing your mind: use Cookie settings (also in the footer of every page) and choose Reject. That deletes _fbp and _fbc from your browser, stops all further sending and clears our record. You can also email us. Data Meta already received is handled under Meta's terms; you can manage it in your Facebook or Instagram ad settings.

4. How we use it

• To run SendFromChat: send and receive your WhatsApp messages, run your automations, show your dashboard, answer your AI assistant.
• To bill your subscription and track your monthly message usage.
• To keep the service secure, prevent abuse, and meet legal obligations.
• To contact you about your account, the service, or changes to these policies.
• Only if you accept marketing cookies: to measure our ads (section 3).

We don't sell personal data, and we don't use your contacts or messages to train AI models.

5. Who we share it with

Only the service providers needed to run SendFromChat:

• Supabase — database and sign-in (data stored in the Mumbai, India region).
• Vercel — application hosting and anonymous website statistics (may process requests outside India, including the United States).
• Meta (WhatsApp) — delivers your messages; Meta's own privacy terms apply to data on WhatsApp.
• Meta (Facebook and Instagram advertising) — receives the data in section 3, only if you accept marketing cookies.
• Dodo Payments — payments, as merchant of record.
• AI assistants you connect (for example Claude, ChatGPT, Cursor or Gemini) — receive the data your assistant asks for while you use it, under that provider's terms. Nothing is shared with them unless you connect one.

We may also disclose data if the law requires it, or to protect our users or the service from harm.

Requests from public authorities. If a government body, regulator or law-enforcement agency asks for someone's data, we first check that the request is lawful and properly made. We challenge requests we believe are unlawful or too broad, disclose only the minimum the request legally requires, and keep a record of each request, our response and the legal basis for it. Where the law allows, we tell the affected customer before disclosing.

6. How long we keep it

We keep your data while your account is active. When you ask us to delete your workspace, we delete your account, contacts, messages and settings within 30 days, except records we must keep by law (such as payment records for tax purposes) and short-lived backups that expire on their own.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our providers; Meta access tokens are additionally encrypted with our own key, and API keys are stored only as hashes. Access to each workspace's data is scoped to that workspace. No system is perfectly secure — if a breach affects your data, we'll tell you without undue delay.

8. Your rights

You can ask to access, correct, export or delete your personal data, or withdraw consent where we rely on it — under India's Digital Personal Data Protection Act, the EU/UK GDPR, or other laws that apply to you. Email safeedpromo@gmail.com and we'll respond within 30 days. If you're one of our customers' contacts, please contact the business that messaged you first; we'll help them respond. People can also reply STOP to any message to stop receiving templates.

9. Children

SendFromChat is for businesses and isn't directed at anyone under 18.

10. Changes

If we change this policy materially, we'll notify you by email or in the dashboard before the change takes effect. Our grievance officer under Indian law is Muhammed Safeed S of Beaurickz, safeedpromo@gmail.com.