Privacy policy
How waca.ai handles personal data. For your own account we decide how data is used (we are the data fiduciary). For the customers you message and call through waca.ai, your business decides — we only process that data for you (we are the data processor).
1. Who we are and our two roles
waca.ai is a product of Code Trays Information Technology Pvt Ltd, 1407, T3, Pyramid Altia, Sector 70, Gurgaon, Haryana 122101 (“waca.ai”, “we”). Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we act in two different roles:
| Whose data | Our role | Who decides how it is used |
|---|---|---|
| Business owners, team members, agency staff and visitors of waca.ai — your login, billing and support data | Data fiduciary | waca.ai, as described in this policy |
| Your customers and leads — the people your business messages on WhatsApp, calls with an AI agent, imports or stores in waca.ai | Data processor | Your business (the data fiduciary). We follow its instructions and our data processing agreement. |
If you are a customer of a business that uses waca.ai, please contact that business first about your data — they decide why it was collected and can correct or erase it. We will help them answer you, and you can always reach our Grievance Officer (section 11).
2. Data we collect as data fiduciary
- Account: name, work email, phone, password (stored only as a salted hash), role, two-step verification settings, sign-in history (time, IP address, device).
- Business details: business name, legal name, address, state, GSTIN / PAN and documents you share for account approval (KYC).
- Billing: wallet recharges, invoices, credit notes, refunds and usage. Payments are handled by Codetrays Payments; we never see or store full card, UPI PIN or bank login details.
- Product usage: pages and features used, errors, and audit logs of changes made in your workspace.
- Support and sales: messages, calls and emails with our team, and the details you leave in the website “Contact us” form.
- Cookies: a session cookie to keep you signed in and small preferences stored in your browser (section 10).
3. Data we process for your business (as data processor)
When you use waca.ai we process, only on your behalf and on your instructions:
- customer contact details (name, phone, email, address, tags, custom fields, deal stage) you add, import or receive from connected apps;
- WhatsApp, Instagram, SMS and website-chat conversations, including media your customers send;
- call recordings, transcripts, AI summaries and outcomes of AI and human calls;
- consent and opt-out records, DND checks and calling-window decisions;
- knowledge-base documents you upload for your AI agents.
Your business is responsible for having a lawful basis (usually the customer’s consent) and for giving its own privacy notice to its customers. waca.ai records consent and opt-outs for you and stops messages and calls to people who opt out.
4. Why we use your data
As data fiduciary we use account data only for these purposes, on the basis of your consent or a legitimate use allowed by section 7 of the DPDP Act:
- to create and secure your account, sign you in and prevent fraud or abuse;
- to run the service you asked for — messages, calls, AI agents, journeys, reports;
- to bill you, issue GST invoices and credit notes, and keep the records tax law requires;
- to review new accounts and meet telecom, WhatsApp and legal obligations;
- to send account and security emails (password resets, approvals, wallet alerts, receipts);
- to answer support requests and improve the product using aggregated, de-identified usage.
We do not sell personal data, and we do not use your customers’ data to train AI models.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account and business details | While the account is open, then up to 90 days after closure (unless the law needs longer) |
| Invoices, credit notes, ledger and payment records | 8 years, as required by GST and company law |
| Customer data you store (contacts, chats, call recordings, transcripts) | As long as your business keeps it; deleted within 90 days after your account closes, or earlier when you erase it |
| Consent and opt-out records | As long as needed to prove consent, and at least as long as the related messages |
| Security and audit logs | Up to 1 year |
| Website enquiries | Up to 2 years after our last contact |
7. Your rights
Under the DPDP Act you (the data principal) can:
- get a summary of the personal data we process about you and with whom it was shared;
- ask us to correct, complete, update or erase it;
- withdraw consent at any time (this doesn’t affect processing already done);
- have your grievance answered by our Grievance Officer, and then approach the Data Protection Board of India;
- nominate someone to exercise these rights if you die or become unable to.
Account owners can export and erase workspace data themselves in Settings → Compliance and Security. For anything else, write to the Grievance Officer. We may need to confirm your identity first, and we keep data the law requires us to keep (for example invoices).
8. Children
waca.ai is a business tool for people aged 18 or older. We do not knowingly process children’s data as data fiduciary. Businesses must not use waca.ai to message or call children without verifiable consent of a parent or lawful guardian, and must not track or target ads at children.
9. Security and breaches
We protect data with encryption in transit (HTTPS / TLS) and for stored secrets, role-based access for your team, optional two-step verification, audit logs, limited and logged staff access (support access only with the owner’s approval), and regular backups.
If a personal data breach happens we will inform the Data Protection Board of India and affected people as the DPDP Act and Rules require, and tell affected businesses without undue delay so they can meet their own duties.
11. Grievance Officer
Grievance Officer: [Name to be confirmed], Code Trays Information Technology Pvt Ltd
Email: nitish@waca-ai.com
Address: 1407, T3, Pyramid Altia, Sector 70, Gurgaon, Haryana 122101, India
We acknowledge every grievance within 48 hours and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
12. Changes to this policy
We will post any change here and update the date at the top. For important changes we will also tell account owners by email or in the app before they apply.
Questions
Write to nitish@waca-ai.com or by post to Code Trays Information Technology Pvt Ltd, 1407, T3, Pyramid Altia, Sector 70, Gurgaon, Haryana 122101, India. We answer on Monday to Saturday, 10 am to 7 pm IST.