Privacy Policy

Effective date: 9 October 2026.

1. Who this policy covers

There are two groups of people whose data we handle:

• Our customers and their team members — the businesses that sign up for wbm.link and the people they add to their account. For this data we decide how it is used.
• Our customers’ contacts — the people who exchange WhatsApp messages with a business that uses wbm.link. We process this data only on that business’s behalf and on its instructions. The business is responsible for having a lawful basis to message its contacts, including their opt-in. If you are such a contact, please direct requests about your data to the business you messaged.

2. What we collect

Account data

• Name, email address and a password, which we store only as a one-way hash.
• If you sign in with Google, the name and verified email address Google shares with us. We do not receive your Google password or access your Google account, except the contacts access described under “Importing contacts”, which you grant separately.
• Business details you provide: business name, WhatsApp Business profile, address, website.
• Team members you add, their roles and permissions.

Data you process through the service

• WhatsApp messages sent and received, including media, voice notes and documents.
• Contacts: phone numbers, names and any attributes, labels or notes you add or import.
• Importing contacts. If you choose to import contacts from your phone or connect a Google account, the wbm link app reads your address book on your device and sends us only the names and phone numbers of the contacts you select (for Google, those with a phone number). We do not receive email addresses, postal addresses, birthdays, notes, photos or any other contact fields. For Google, the app uses read-only access (contacts.readonly) on your device; we never receive or store your Google password or Google access tokens, and you can disconnect at any time in Settings → Contacts or at myaccount.google.com/permissions. Imported contacts are stored in your business's contact book like any other contact and are not used for advertising or shared with anyone. Deleting a contact in Google does not delete it here; you can delete it in the app. wbm link's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Templates, broadcasts, chatbot flows, AI assistant instructions and knowledge-base entries.
• When you connect a number with WhatsApp coexistence, the contacts and up to six months of chat history that Meta makes available from your WhatsApp Business app.

Billing data

• Wallet top-ups, fees and message charges. Payments are handled by Cashfree Payments; we never see or store your full card or bank details.

Technical data

• A single session cookie that keeps you signed in for up to 30 days. It is essential to the service and is not used for advertising.
• If you turn on notifications, a push subscription for your browser or device.
• Server logs such as IP address, browser type and request times, kept for security and troubleshooting.
• Counts of taps on short links. We do not build profiles of the people who tap them.

Device data (mobile app)

When you use the wbm link app we also handle:

• A Firebase Cloud Messaging (FCM) registration token for your device, so we can send you push notifications about new messages and alerts. It identifies the device, not you, and is deleted when you sign out or uninstall.
• The app version and your device's operating-system version, so we can support the app and fix faults.
• Basic diagnostic and crash information if the app runs into an error. We do not collect advertising identifiers, and the app contains no advertising SDKs.

App permissions (mobile app)

The app asks for a permission only when a feature needs it, and every one is optional — you can decline it or turn it off later in your device settings, and the rest of the app keeps working.

• Notifications — to alert you to new WhatsApp messages and reply-time reminders.
• Contacts — only if you choose to import contacts from your phone. The app reads your address book on the device and uploads only the names and numbers you pick (see “Importing contacts”). We never read your contacts in the background.
• Camera and photos / storage — only when you attach a photo, video or document to a message, or set your business profile picture.
• Microphone — only while you are recording a voice note to send.

We use advertising and analytics measurement tools (Google Tag Manager, the Google tag, the Meta Pixel) to learn which of our ads lead to sign-ups, and to show our ads to people who have visited our website. They set cookies and share page visits and sign-up events with Google or Meta. You can block them with your browser's tracking protection or an ad blocker without affecting the service.

3. How we use it

• To provide the service: deliver and receive WhatsApp messages, run your broadcasts, flows and assistants.
• To bill you and keep your wallet balance accurate.
• To keep the service secure, prevent abuse and meet WhatsApp’s policies.
• To support you when you contact us, and to tell you about changes to the service.
• To meet legal obligations, such as tax and accounting records.

We do not sell personal data, and we do not use your customers’ messages to advertise to them.

4. Who we share it with

We use a small number of service providers, each only for the purpose listed:

• Meta Platforms — the WhatsApp Business Platform, which carries every message.
• Cashfree Payments — processing wallet top-ups and fee payments.
• AI model providers (OpenAI and Google Gemini) — only when you use the AI assistant or AI steps, or the AI pack features (reply suggestions, summaries, rewriting, voice-note transcription and translation), in which case the message text is sent to the provider to produce the result — and only the conversation text and knowledge needed to write a reply. These providers process the text on our API account; under their business/API terms they do not use it to train their models. They may retain it briefly (up to about 30 days) to detect abuse, after which it is deleted. We do not send them your contacts' phone numbers or your billing data.
• Google / Firebase Cloud Messaging — delivering push notifications to the app. Only the device token and the notification content needed to show the alert are sent.
• Plivo — the telephony provider that places the reply-time alert phone calls and carries calls on any phone number you rent through us. It receives the numbers involved in a call.
• SMS gateway (TRAI DLT) — an Indian SMS provider that delivers one-time verification codes and alerts by text. As Indian law requires, these messages run on registered DLT templates; the provider receives the destination number and the message.
• Amazon Web Services — hosting our servers and database in India.
• Google Ads — measuring which ads lead to sign-ups on our public website.
• Meta (Facebook and Instagram ads) — measuring which ads lead to sign-ups on our public website.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and the public.

5. How long we keep it

We keep account and service data for as long as your account is active. After you delete your account we remove or anonymise it, and it disappears from our backups as they roll over, within 30 days. The few records we must keep by law — invoices and payment records — are kept for up to 8 years, anonymised (your personal name, email and phone removed), and used only for tax and accounting. Server logs are kept for a short period (typically up to 90 days) for security and troubleshooting. You can export your contacts at any time from the panel.

6. How we protect it

Data is encrypted in transit with HTTPS. Passwords are hashed, sessions use a server-only cookie, and access within your account is controlled by roles and permissions you set — including hiding customers’ phone numbers from agents. No system is perfectly secure, but we work to protect your data and will notify affected users of a breach as the law requires.

7. Your rights and deleting your account

Under India’s Digital Personal Data Protection Act, 2023, you may ask to access, correct or erase your personal data, withdraw consent where processing relies on it, and nominate someone to exercise these rights for you. Write to us at praveen@dreamquizs.com and we will respond within the time the law allows.

Deleting your account. You can delete your account and the data stored with it at any time. In the app, go to Settings → Account → Delete account; we confirm with a code, and if you own the business it is deleted after a short grace period during which you can cancel. You can also request deletion without signing in, from outside the app, on our Delete your account page. What is removed and the few records we must keep by law are set out there and in our Data Deletion details.

8. Children

wbm.link is a business service and is not meant for anyone under 18. We do not knowingly collect data from children.

9. Changes to this policy

We will update this page when our practices change and revise the date at the top. For significant changes we will also tell account owners by email or in the panel.

10. Contact and grievances

Grievance Officer: Praveen, Dream Learn Quiz LLP, Rawan Gate, Kalwar Road, Jaipur, Rajasthan 302012, India. Email: praveen@dreamquizs.com. Phone: +91 91192 01557. See also our Terms of Service.