Privacy Policy

Last updated: 02 November 2026

Whatskare ("we", "us", "our") operates the messaging-automation platform available at whatskare.tech (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service you agree to this policy.

1. Information we collect

• Account information — your name, email address, phone number, business name, GSTIN and state, provided when you register or update your profile.
• Payment information — processed by our payment gateway (Razorpay). We store only the transaction reference, amount, and invoice details. We do not store your card or bank credentials.
• Messaging data — the contacts, message content, and delivery status you send or receive through the Service, so we can operate features such as logs, auto-reply, campaigns and AI agents.
• Device/session data — the encrypted credentials required to keep your linked messaging sessions connected. These are encrypted at rest and never shared.
• Usage & technical data — IP address, browser type, and login activity, used for security and to improve the Service.

2. How we use your information

• To provide, operate, and maintain the Service and its features.
• To process payments, issue invoices, and manage your subscription.
• To secure your account, detect abuse, and monitor number health.
• To respond to your support requests and send service-related notices.
• To comply with legal obligations.

3. Data processing on your behalf

When you send messages to your contacts, you are the data controller of those contacts' personal data and Whatskare acts as a data processor on your behalf. You are responsible for having a lawful basis and consent to message your contacts. We process that data only to provide the Service.

3A. Shopify app (WhatsKare WhatsApp Alerts)

When a Shopify merchant installs our Shopify app, the merchant is the data controller and Whatskare (operated by Trinity Info) is the processor of the merchant's customers' data. The app receives from Shopify only what it needs to send the WhatsApp notifications the merchant turns on:

• Customer name, to personalise the message.
• Customer phone number, as the WhatsApp recipient. Taken from the order, customer or shipping/billing address; the address country is used only to format the number.
• Order and cart details (order number, items, totals, tracking and order-status links) that appear in the message.

We do not receive customer email addresses, and we never sell this data or use it for advertising or any purpose other than the merchant's notifications. Retention: message history up to 90 days, closed abandoned-cart records 30 days, and all of a store's data is deleted when Shopify sends its shop deletion request (48 hours after uninstall), or at the latest 30 days after uninstall. Customer data access and deletion requests sent through Shopify are handled automatically; exports are sent to the merchant. Numbers of customers who replied STOP are kept only as a suppression list so they are never messaged again. Customers can contact the merchant, or us at help@whatskare.tech.

4. Third-party services

We share limited data with trusted providers strictly to run the Service:

• Razorpay — payment processing.
• Anthropic (Claude API) — AI features. When you use an AI agent, the relevant message text and your configured knowledge base are sent to Anthropic to generate a reply. We do not use OpenAI or any other AI vendor.
• WhatsApp (Meta): delivery of the messages you send.
• Shopify: for merchants using our Shopify app, order and customer data is received from Shopify as described in section 3A.
• Cloud hosting and email delivery providers — to host the Service and send transactional email.

5. Data retention

We retain message logs and AI usage records for up to 90 days, after which they are automatically pruned. Account and billing records are retained as required for legal and tax purposes. You may request deletion of your data as described below.

6. Security

Session credentials and OAuth tokens are encrypted at rest using AES-256-GCM. Access to internal systems is restricted, API keys are per-device and revocable, and sensitive values are redacted from logs. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

7. Your rights (DPDP Act, 2023)

As a data principal under India's Digital Personal Data Protection Act, you may request access to, correction of, or deletion of your personal data, and withdraw consent. To exercise any of these rights, email us at help@whatskare.tech.

8. Cookies

We use essential cookies to keep you signed in and to secure your session. We do not use cookies for third-party advertising.

9. Children

The Service is intended for businesses and is not directed at individuals under 18.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a new "last updated" date.

11. Contact

For any privacy question or request, contact us at help@whatskare.tech.