Privacy Policy

This Privacy Policy explains what personal data VartaAPI collects, why, and what choices you have. VartaAPI is operated by Kavin International.

1. Information we collect

• Account information — name, email address, mobile number and organisation details you give us when you sign up, and the team members you invite. We send a one-time code to the mobile number on WhatsApp to check it is real, and we may use it to contact you about your account.
• WhatsApp connection data — your WhatsApp Business Account ID, phone number ID, display number and the access token Meta issues, so we can send and receive on your behalf.
• Contacts and messages — the contacts you upload and the content of messages that pass through the Service, including inbound replies and media, so we can deliver them and show delivery, read and reply status.
• Billing data — subscription records and wallet ledger entries. Card details are handled by our payment gateway; we never see or store your full card number.
• Usage data — technical logs such as timestamps, IP address and error information, used to operate and secure the Service.
• Interest in our plans— when you are signed in: when you last used the app, and when you look at our plans, press a Buy button, start a payment or try a feature your plan doesn’t include. We record this only about your own use of VartaAPI, never about your website’s visitors or your customers.
• Chat on our website — if you write to us in the chat window on this site: what you write and any file you send, the name and email you give us, the page you were on and your browser, so our team can answer you and, if you have left, reply by email. A ticket you raise there is kept with it. We keep these as support records and you can ask us to delete them.

2. How we use it

• To provide, maintain and improve the Service.
• To send the WhatsApp messages and campaigns that you initiate.
• To show analytics such as sent, delivered, read and reply counts.
• Where a business puts a tracked link in a campaign, to show it which of its contacts opened that link. When the link is opened we record only that it was opened and when, for that message: no IP address, browser or device details about the person opening it, and no cookie.
• Where a business runs Click-to-WhatsApp ads on Facebook or Instagram, to show it which ad a contact wrote in from. With that first message Meta sends us the ad’s ID, headline, text, picture address and a click ID; we keep them with the chat, and they are deleted with the contact.
• To meter usage and charge your subscription correctly.
• To let our sales team call or message you about a plan that fits, using the phone number and email on your account. Tell us if you’d rather not be contacted and we’ll stop.
• To secure accounts, prevent abuse and comply with Meta’s policies and applicable law.

3. Legal basis

We process personal data to perform our contract with you, to meet legal obligations, and for our legitimate interest in running and securing the Service. Where the Digital Personal Data Protection Act, 2023 applies, we process personal data for the lawful purposes above and act as a Data Processor for the customer data you upload.

4. Who we share it with

We do not sell your personal information. We share data only with:

5. International transfers

Some providers process data outside India. Where that happens we rely on the provider’s contractual protections and only use providers we consider adequate.

6. Retention

We keep your information for as long as your account is active, and afterwards only as long as needed to provide the Service, resolve disputes, and meet tax and accounting obligations. Financial records are retained for the period Indian law requires. Records of interest in our plans are deleted after 180 days. See our data deletion instructions.

Inbound media is fetched from Meta on demand rather than stored; Meta keeps its copy for about 30 days, after which older attachments stop opening.

If your plan or free trial ends, or you stop paying, your account has no plan: you can still see your contacts, chats and history, but cannot send messages until you choose a plan. Your contacts, chats and history stay, and nothing is deleted automatically. You can ask us to delete them at any time.

7. Your rights

You may access, correct, export or delete your personal information by contacting us. You can disconnect your WhatsApp Business account at any time, which stops us sending on your behalf. You may also ask us to tell you what personal data we hold about you, to stop using your details for offers and marketing, to name someone to act for you, or make a complaint. Use our privacy request form: you confirm by email, and we reply within 30 days. There is no fee, and we may ask you to confirm who you are first.

When you send us a message through our contact form, we keep a record of what you agreed to (the version of this policy and, if you ticked them, updates by email or WhatsApp), with the time, as proof. You can withdraw an optional consent at any time by asking us. You can also nominate another person to use these rights for you if you die or cannot act, and, if you are not satisfied with our reply, complain to the Data Protection Board of India (the law asks you to contact our Grievance Officer first).

8. Security

We use industry-standard measures to protect data in transit and at rest. Access tokens and API keys are stored hashed or encrypted, and API keys are shown in plaintext only once. No method of transmission or storage is completely secure, but we work to protect your information and keep improving.

9. Cookies

Always on, because the site needs them. Our website remembers your light or dark setting and your cookie choice in your browser, and uses a security check on forms. If you open the chat window, it keeps an ID in your browser so your conversation is still there when you come back. The application uses a session token to keep you signed in. We do not ask your consent for these.

Analytics, only if you say yes. When you first visit, a banner asks whether we may count visits with Google Analytics 4, a service of Google. Accept all and Reject all carry equal weight, and Choose shows what Analytics collects before you decide. Until you allow it, Google Analytics is not loaded and nothing is sent to Google. If you accept, Google sets cookies named _ga and _ga_G-FKBQ5HYFKZin your browser (kept up to 2 years), and Google receives which pages you open, your browser and device type, and your approximate location worked out from your IP address. We use this only to see which pages are read and to fix what is unclear. We have switched off Google’s advertising features, and we do not combine this with your name or email. Google processes this data on its own servers, which may be outside India.

Advertising, only if you say yes. The same banner asks separately whether Meta may measure our ads. Until you allow Advertising, the Meta Pixel is not loaded and nothing is sent to Meta. If you allow it, Meta sets cookies named _fbp and _fbc(kept up to 90 days) and receives which pages you open, whether you clicked “Start free trial” or sent the contact form (not what you typed in it), your browser and device, and your IP address. Meta may link this to your Facebook or Instagram account, under Meta’s own privacy policy, so it can show VartaAPI ads to people likely to need it and tell us how many ads led to a visit. We have turned off Meta’s automatic matching, so names, emails and phone numbers you type on this website are not sent to Meta. Meta processes this data on its own servers, which may be outside India.

If you then open a VartaAPI account.Only if you allowed Advertising, our server also tells Meta (through Meta’s Conversions API) that an account was created and, later, that its first payment was made, with the amount in rupees. With it we send Meta’s own _fbp and _fbc browser IDs, your IP address, your browser details and a scrambled code for the account. We never send your name, email address or phone number. We keep these IDs for at most 90 days. This lets Meta tell us which ads led to real accounts, not only clicks. If you did not allow Advertising, nothing about your account is sent to Meta.

If you chat with us on WhatsApp. If you have agreed to receive WhatsApp messages from VartaAPI, we may use your WhatsApp number to show our ads on Facebook and Instagram to you, or to people similar to you. Before it leaves our server, your number is scrambled with a one-way code (SHA-256), so Meta receives the code, never the number itself. We never send your name or email address. Meta uses the code only to find matching Facebook and Instagram accounts, and deletes it once the matching is done. If you stop our WhatsApp messages (reply STOP), you are removed from these lists within an hour; Meta may take up to a day. You can also object at any time through our privacy rights page or at [email protected]. Meta processes this data on its own servers, which may be outside India.

Changing your mind.Press “Cookie settings” in the footer of any page and choose again. Choosing “Reject all” switches analytics and advertising off, deletes the Google and Meta cookies from your browser and reloads the page. Your choice is kept in your own browser. As proof of consent, we also keep a record on our servers of each choice, change or withdrawal: a random ID, what you chose, the banner version, the page, the language and the time. It holds no name, email address or IP address. Every cookie and what it does is listed in our Cookie Policy.

10. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from children.

11. Changes

We may update this policy. We will change the “last updated” date and, for material changes, give notice in the app or by email.

Contact

See also: Terms · Privacy · Cookies · Your privacy rights · Refunds · Data deletion