Privacy notice

1. Who is the controller, and who is the processor

For your customers’ data, you are the controller and we are the processor: you decide who to message and why, we carry it out. For your own account data — the people in your organisation, your billing details — we are the controller.

2. What we hold

• Account data: names, email addresses, roles, and the audit record of what each person did.
• Customer data: the contacts you import or that message you, the conversations, the messages and their media, and the attributes you put on a contact.
• Usage data: counts — messages sent and received, automation runs, AI tokens, API requests — which is what your plan limits are measured against.
• Operational logs: request IDs, timings and errors. Logs never contain a credential, a token or a message body.

3. Sub-processors

The list, what each one does, and where it runs. At minimum: Meta Platforms for WhatsApp message delivery, our cloud infrastructure provider, and the AI model provider for the AI features you choose to use. Changes to the list are announced before they take effect.

4. Where your data lives

In the region your organisation is pinned to. On the Enterprise tier that region is your choice, and it is enforced at the database-routing layer: a request for an organisation in one region cannot reach another region’s database.

5. How long we keep it

As long as you tell us to. Retention windows for conversations, messages and media are set per organisation and applied by a job whose results you can see. Without a window configured, data is kept for the life of the account.

6. AI, specifically

AI features send the conversation, the contact record and your own knowledge-base content to the model provider in order to produce a draft, a summary or an extraction. That content is not used to train a general-purpose model. Every AI request is metered and visible to you.

7. Security

Encryption in transit and at rest; integration credentials encrypted with a recorded key version; HttpOnly session cookies with no token in browser storage; server-side authorisation on every action; optional SSO, SCIM and IP allowlisting; a tamper-evident audit trail.

8. Your rights, and your customers’

Access, correction, export and deletion — available to you through the product and the public API without asking us, which is also how you satisfy a request from one of your own customers.

9. Cookies

The product sets a session cookie, which is necessary for it to work at all. This marketing site sets none: there is no analytics script, no advertising pixel and no consent banner, because there is nothing to consent to.

Contact

Questions about this document go to [email protected]. IconWave Technologies is registered in India.