Privacy Policy

Effective: January 1, 2026  ·  Last Updated: September 17, 2026  ·  Controller: WhatsGrow AI

WhatsGrow AI (“WhatsGrow AI,” “we,” “us,” or “our”) operates the software-as-a-service platform available at whatsgrowai.com(the “Service”). This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use our Service, visit our website, or communicate with us.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you are using our Service on behalf of a business, that business accepts this policy. If you do not agree with this policy, please do not use our Service.

1. Information We Collect

1.1 Account and Profile Information

When you register for WhatsGrow AI, we collect information necessary to create and manage your account:

• Identity data: Full name, business name, job title
• Contact data: Email address, phone number
• Credentials: Hashed passwords (we never store plaintext passwords)
• Business data: Company information, billing email, time zone, language preferences
• Team data: Names, email addresses, and roles of team members you invite to your workspace

1.2 WhatsApp Business and Conversation Data

Our platform connects to the WhatsApp Business API (provided by Meta Platforms, Inc.). As part of this integration, we process:

• Message content: Text, images, documents, audio, video, and location data sent through your WhatsApp Business number
• Contact information: Phone numbers, names, and profile information of your WhatsApp contacts
• Message metadata: Timestamps, delivery status, read receipts, and message IDs
• Media files: Files shared in conversations, stored securely in Cloudflare R2

Important:WhatsGrow AI processes this data as a data processor on behalf of you (our customer, the data controller) and your end users. You are responsible for having a lawful basis to process your contacts' data through our platform and for maintaining your own privacy notices with your end users.

1.3 Payment and Billing Information

We use third-party payment processors (Stripe and Razorpay) to handle all payment transactions. We do not store full credit card numbers or bank account details on our servers. We collect and retain:

• Billing name and address
• Payment method type (e.g., “Visa ending in 4242”)
• Transaction history, amounts, dates, and statuses
• Stripe Customer ID or Razorpay Order ID for subscription management

1.4 Usage and Analytics Data

• Activity logs: Features used, pages visited, actions performed within the dashboard
• Performance data: Campaign delivery rates, AI bot interaction metrics, pipeline stage conversions
• Device and technical data: Browser type, operating system, IP address, screen resolution, language settings
• Session data: Login timestamps, session duration, page views
• Marketing analytics: On our public marketing website, we use Google Analytics 4 and Meta Pixel to collect anonymised data about how visitors interact with our site, which pages are visited, and which marketing campaigns drive sign-ups. This data is used solely to improve our website and measure advertising effectiveness. We do not use this data to build personal profiles or sell it to third parties.

1.5 AI Processing Data

When you use our AI chatbot features, conversation messages are sent to our AI providers (OpenAI, Google, and/or Anthropic) to generate responses. We send only the minimum context necessary. We do not send identifying personal information beyond what is in the conversation thread itself. AI providers' data handling is governed by their own privacy policies. We do not use your conversation data to train AI models.

1.6 Communications Data

If you contact us for support, send us feedback, or participate in surveys, we retain those communications and any information you provide.

1.7 Optional Google Calendar Data

If you connect Google Calendar from Bookings / Appointments settings, we process Google Calendar event data and OAuth tokens as described in the dedicated section Google Calendar and Google user data below. This integration is optional and is not required to use the rest of the Service.

Android Mobile App

The WhatsGrow AI Android app (package com.whatsgrowai.app) gives you access to the same Service on your phone. Everything in this policy applies to the app. In addition, the app handles the following on your device:

• Push notification token: If you allow notifications, the app obtains a device push token and links it to your account so we can alert you about new messages, calls, and tasks. Notifications are delivered through Expo's push service and Google Firebase Cloud Messaging. We stop sending to the token when you sign out on that device or when it expires, and it is deleted when your account is deleted. You can turn notifications off at any time in Android settings.
• Microphone: Used only while you record a voice note to send in a conversation. The app asks for permission the first time, never records in the background, and the recording is uploaded only when you send it.
• Files, photos, and documents: The app does not request access to your storage or camera roll. When you attach a file, you choose it with Android's system file picker, and only that file is uploaded.
• Sign-in: Your session is stored in the app's private storage on your device. Google sign-in and WhatsApp Business connection open in a secure browser tab and return to the app.
• Device and usage data: App version, Android version, and the usage and analytics data described in Section 1.4, which may also be collected while you use the app.

The app does not access your location, device contacts, SMS, call logs, or camera, does not use the Android advertising ID, and does not show ads. All data is encrypted in transit using TLS. You can request deletion of your account and associated data from the app (Settings → Profile → Delete account) or at whatsgrowai.com/account-deletion.

Google Calendar and Google user data

You can optionally Connect Google Calendar from Bookings / Appointments settings in the WhatsGrow AI dashboard. Connecting a Google account is not required to use WhatsGrow AI. Sign-in with Google (if offered) is a separate flow and does not request Calendar access.

OAuth scope we request

When you connect Google Calendar, we request the Google OAuth scope https://www.googleapis.com/auth/calendar.events (view and edit calendar events).

What we access

Through that scope we access:

• Calendar event titles
• Event start and end times
• Descriptions and notes we write when creating or updating events that mirror WhatsGrow appointments
• Related event metadata needed to sync appointments, including Google Calendar event IDs

We create, update, and delete Google Calendar events that mirror WhatsGrow appointments. We may also read event and busy information needed to avoid double-booking, so WhatsApp AI availability does not offer a slot that is already busy on the connected calendar.

How we use Google Calendar data

Google Calendar user data is used solely to provide the appointments / bookings sync feature that is visible in the product UI: two-way sync between WhatsGrow appointments and the connected Google Calendar. We do not use this data for advertising, retargeting, credit-worthiness, lending, or any purpose other than providing or improving that user-facing sync feature.

How we store it

• OAuth tokens: Refresh and access tokens are stored encrypted at rest on our servers
• Event IDs: Google Calendar event IDs are linked to WhatsGrow appointments as needed for sync
• Busy-time metadata: We may cache event titles and busy intervals needed to prevent double-booking

Google user data obtained through this integration is not used to train AI models.

Sharing and Limited Use

We do not sell Google Calendar data. We do not use it for advertising or retargeting. We do not transfer it to data brokers.

We share this data with subprocessors only as needed to operate the Service under the sub-processor framework in Section 4.1. Otherwise we transfer Google user data only: (i) with your consent; (ii) for security purposes (for example, investigating abuse, fraud, or unauthorised access); (iii) to comply with applicable law; or (iv) as part of a merger, acquisition, or sale of assets, and only after obtaining your explicit prior consent.

Human access to Google user data from this integration is limited to those same cases, or when the data is aggregated and used for internal operations consistent with Limited Use.

WhatsGrow AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect and revoke access

You can disconnect Google Calendar in Bookings / Appointments settings. When you disconnect, we clear stored OAuth tokens and stop syncing. You can also revoke WhatsGrow AI's access from your Google Account permissions page at https://myaccount.google.com/permissions.

2. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your data to serve third-party advertising, sell to data brokers, or build advertising profiles.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing are:

• Contract performance: Processing necessary to deliver the Service you subscribed to (e.g., storing messages, managing your pipeline)
• Legitimate interests: Improving our platform, fraud detection, security monitoring — where our interests do not override your fundamental rights
• Legal obligation: Complying with applicable laws, tax regulations, and court orders
• Consent: Marketing emails and non-essential cookies (you can withdraw consent at any time)

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

4.1 Service Providers (Sub-Processors)

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of WhatsGrow AI, our customers, or the public.

4.3 Business Transfers

If WhatsGrow AI undergoes a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. You will be notified in advance via email and will have the option to delete your account before any transfer takes effect.

5. Data Retention

When you delete your account, we will delete or anonymise all your personal data within 30 days, except where we are required by law to retain certain records (e.g., payment history for 7 years).

6. Data Security

We implement industry-standard technical and organisational security measures to protect your data:

• Encryption in transit: All data transmitted between your browser, our servers, and third-party APIs is encrypted using TLS 1.2 or higher
• Encryption at rest: Sensitive data fields (API keys, tokens, credentials) are AES-256 encrypted in our database
• Password hashing: All passwords are hashed using bcrypt (cost factor 12)
• Access controls: Role-based access; employees access data only on a need-to-know basis
• Multi-factor authentication: Supported for all user accounts; mandatory for admin accounts
• Security monitoring: 24/7 logging of authentication events, API access, and administrative actions
• Penetration testing: Regular third-party security assessments

Despite these measures, no system is completely secure. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by applicable law.

7. International Data Transfers

WhatsGrow AI operates globally. Your data may be transferred to and processed in countries outside your country of residence, including the United States and other countries that may not provide the same level of data protection as your home country.

For transfers of personal data from the EEA, UK, or Switzerland to third countries, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): Approved by the European Commission, incorporated into our agreements with all US-based sub-processors
• Adequacy decisions: Where applicable for specific countries
• UK International Data Transfer Agreements: For transfers from the United Kingdom

8. Your Privacy Rights

8.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the EEA, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Correct inaccurate or incomplete personal data
• Right to erasure (“right to be forgotten”): Request deletion of your personal data where there is no legitimate reason for us to continue processing it
• Right to restriction: Request that we restrict processing of your data in certain circumstances
• Right to data portability: Receive your personal data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making: Not be subject to solely automated decisions that significantly affect you

8.2 Rights Under CCPA (California Residents)

California residents have the right to: (i) know what personal information is collected, disclosed, or sold; (ii) request deletion of personal information; (iii) opt-out of the sale of personal information (we do not sell personal information); (iv) non-discrimination for exercising these rights.

8.3 Exercising Your Rights

To exercise any of these rights, contact us at privacy@whatsgrowai.com. We will respond within 30 days. We may need to verify your identity before processing your request. There is no fee for most requests, but we may charge a reasonable fee for excessive or repetitive requests.

If you believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection supervisory authority.

9. Children's Privacy

Our Service is intended for business use by adults (18 years of age or older). We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected data from a minor, please contact us at privacy@whatsgrowai.com and we will promptly delete it.

10. Third-Party Services and Links

Our platform integrates with and may link to third-party services. This policy does not apply to those services. We encourage you to review the privacy policies of:

• Meta Platforms: facebook.com/privacy/policy — governs WhatsApp Business API data
• OpenAI: openai.com/privacy — governs AI processing
• Google: policies.google.com/privacy — governs Gemini API and, if you connect Google Calendar, Calendar API user data. See also the dedicated section Google Calendar and Google user data and the Google API Services User Data Policy
• Anthropic: anthropic.com/legal/privacy — governs Claude API
• Stripe: stripe.com/privacy — governs payment data
• Razorpay: razorpay.com/privacy — governs India payment data

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Send an email notification to all account holders at least 14 days before the change takes effect
• Display a prominent in-app banner for 30 days after the change

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree with the changes, you may delete your account before the effective date.

12. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related enquiries within 5 business days.