Privacy Policy

1. Our Role — Who Controls Your Data

MeshTack is a Business Solution Provider for the WhatsApp Business Platform. Our role differs depending on whose data is involved:

• Business account holders. For the account data of the businesses that sign up for MeshTack (name, phone number, billing details, usage logs), we act as the data controller and this Policy describes our own processing.
• End customers of those businesses. For the WhatsApp conversations between a business and its customers, the business is the data controller and MeshTack acts as a data processor on that business's documented instructions. We do not decide why or how that conversation data is used, and we do not use it for our own purposes.

If you are a customer who messaged a business through MeshTack and want to access or delete your data, please contact that business directly — they control it. You may also contact us at meshitsolutions@gmail.com or support@meshitsolutions.com and we will route your request to the relevant business and assist them in fulfilling it.

2. Information We Collect

Account & Authentication Data

• Phone number used to sign you in and link your account to your business WhatsApp number.
• Name and business details you provide during registration or onboarding.
• Authentication tokens issued to keep you securely signed in on your device.

WhatsApp Conversation Data

• Messages, contact names, and phone numbers exchanged between your business and your customers through the WhatsApp Business API.
• Media (images, documents, audio) sent or received within those conversations.
• Message status and delivery information (sent, delivered, read).

We process this conversation data on your behalf solely to provide the inbox, broadcast, chatbot, and analytics features of the Service. We do not sell it or use it for advertising.

Technical Data

• Device type, operating system version, and app version.
• Log data and diagnostic information used to operate and troubleshoot the Service.

3. How We Use Your Information

• To provide and operate the Service authentication, messaging, inbox, broadcasts, chatbots, and analytics.
• To deliver and synchronise your WhatsApp conversations across your devices.
• To maintain security, prevent abuse, and comply with WhatsApp/Meta platform policies.
• To provide customer support and respond to your requests.
• To improve the reliability and performance of the Service.
• To contact you by phone call and WhatsApp when you submit an enquiry or register and give your consent to respond to you, complete onboarding, and send related service and promotional messages. We only do this after you tick the consent box and verify your number by OTP, and you can opt out at any time by replying STOP on WhatsApp.

Consent & verification records. When you tick the consent box and complete WhatsApp OTP verification on our enquiry or registration forms, we store your verified number, the fact and time that you consented, and the source of that consent as proof of your opt-in. This record is kept for as long as needed to evidence consent and honour opt-outs.

4. WhatsApp Business API & Meta

MeshTack integrates with the WhatsApp Business Platform provided by Meta Platforms, Inc. Your use of WhatsApp messaging is also governed by WhatsApp's Business Messaging Policy and Meta's Privacy Policy. Conversation data is transmitted through Meta's infrastructure as required to send and receive messages.

How we handle WhatsApp data

We apply the following commitments to all data obtained through the WhatsApp Business Platform:

• We use WhatsApp message data only to provide the messaging features the business enabled (inbox, replies, broadcasts, chatbots, flows, and the analytics shown back to that same business).
• We do not sell WhatsApp data, and we do not use it for advertising or ad targeting.
• We do not use WhatsApp message content to train, fine-tune or improve any machine-learning or AI model — ours or anyone else's.
• We do not share one business's conversation data with any other business on the platform. Every account is isolated by tenant.
• Staff access to message content is restricted to the minimum needed for support and troubleshooting, is logged, and only occurs at the business's request or where necessary for security or legal compliance.

Optional AI assistant

A business may optionally enable an AI auto-reply assistant on a WhatsApp number. This feature is disabled by default and only operates on numbers where the business has explicitly turned it on and supplied its configuration.

A business can enable it in either of two ways:

• Using its own AI provider account — the business supplies its own API key, and the relationship with that AI provider is directly between the business and the provider.
• Using MeshTack's AI service — we make the calls through our own provider account and bill the business for usage. In this case we act as the business's processor for that transfer.

In both cases, when enabled and only then:

• The incoming customer message and up to the last 10 messages of that conversation are sent to a third-party AI provider (OpenAI or Anthropic) solely to generate a reply.
• These are API calls for a single reply. The providers act as processors under their API terms, which exclude API content from model training.
• The generated reply is returned to the conversation and stored with it. Nothing else is retained by us at the provider.
• A business that prefers not to send message content off-platform can simply leave the AI assistant off and use the rule-based chatbot, which runs entirely on our own infrastructure in India.

Opt-in and opt-out

Businesses may only message customers who have given a valid opt-in, as required by WhatsApp's Business Messaging Policy. MeshTack records opt-ins with their source and timestamp. Any recipient can opt out at any time by replying STOP to a WhatsApp message; we process opt-outs automatically and exclude opted-out numbers from all subsequent broadcasts. Replying START re-subscribes.

Threads, Instagram & Facebook (optional connections)

If you choose to connect a Threads, Instagram, or Facebook account, you authorise that access through Meta's official OAuth flow, and we access only your own account's data and only the scopes you grant. Depending on the features you enable, this may include:

• Profile information your account id, username, name, profile picture and bio, shown back to you in the dashboard.
• Your content the Threads posts (and Instagram/Facebook posts) you create, schedule, publish or delete through MeshTack.
• Replies & mentions replies on your posts and mentions of your account, so you can read, reply to, or hide them.
• Content insights performance metrics for your own account and posts (views, likes, replies, etc.).
• Instagram cross-share when you opt in, a Threads post can be shared to your linked Instagram account as a Story at publish time.

We never post or act on your behalf without an action you initiate, we do not access other users' private data, and we do not sell this data or use it for advertising. Access tokens are stored securely and used only to provide the features you enabled. You can disconnect any connected account at any time from the relevant page in MeshTack, which removes the stored access token; you may also request deletion of the associated data (see Data Deletion).

5. Google Account Data (SEO Features)

If you use MeshTack's SEO features and choose to connect a Google account, you authorise access through Google's official OAuth consent flow. We request only the scopes needed for the features you enable, and we access only your own Google account's data:

• Google Business Profile (.../auth/business.manage) to read your business locations and, when you initiate it, publish posts/updates and manage your listing to improve local search visibility.
• Google Search Console (.../auth/webmasters.readonly) read-only access to your site's search performance (impressions, clicks, queries, average position) shown back to you in your SEO reports and audits.
• Google Analytics (.../auth/analytics.readonly) read-only access to your website traffic metrics (sessions, traffic sources, conversions) shown back to you in your SEO reports and dashboards.

Limited Use of Google user data

MeshTack's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the SEO features you enabled.
• We do not sell Google user data, and we do not use it for advertising.
• We do not transfer Google user data to others except as necessary to provide the Service, to comply with applicable law, or as part of a merger or acquisition.
• We do not allow humans to read Google user data, except with your consent, where necessary for security or to comply with law, or when the data has been aggregated and anonymised.

Access and refresh tokens are stored securely and used only to provide the features you enabled. You can disconnect your Google account at any time from the SEO setup page, which removes the stored tokens; you may also request deletion of the associated data (see Data Deletion).

6. How We Share Information

We do not sell your personal information. We share data only:

• With Meta/WhatsApp as necessary to deliver your messages through the WhatsApp Business API.
• With service providers (e.g. cloud hosting) that process data on our behalf under confidentiality obligations.
• When required by law to comply with a legal obligation, court order, or valid government request.
• To protect rights and safety to prevent fraud, abuse, or security threats.

7. Data Retention

We retain data only for as long as it is needed for the purpose it was collected. Our standard periods are:

• WhatsApp conversations and media — retained while the business's account is active and for up to 5 years thereafter, so the business retains access to its own message history for service, dispute and record-keeping purposes.
• Business account & profile data — retained for the life of the account and for up to 5 years after closure.
• Consent and opt-out records — retained for up to 5 years after the account closes, because we must be able to evidence a valid opt-in and continue honouring an opt-out. Opt-out records are kept even after deletion requests, precisely so we do not message that number again.
• Access tokens (WhatsApp, Meta, Google) — deleted immediately on disconnection or account closure.
• Technical and diagnostic logs — retained up to 90 days.
• Billing and tax records — retained as required by Indian tax law (currently 8 years).

These are maximum periods, not commitments to hold data. You may request deletion at any time and we will act on it within 30 days, regardless of the periods above — a deletion request always overrides them, except for records we are legally required to keep (tax/audit) and opt-out records, which we retain specifically so the number is never messaged again. See Data Deletion and “Your Rights” below.

8. Where Your Data Is Stored & Sub-Processors

MeshTack is operated from India and your data is stored on servers located in India. Where a sub-processor operates outside India, transfers are made under appropriate safeguards and only for the purposes described in this Policy.

We use the following categories of sub-processor, each bound by confidentiality and data-protection obligations:

• Meta Platforms, Inc. — delivery of WhatsApp messages via the WhatsApp Business Platform (required to operate the Service).
• Cloud hosting and infrastructure providers — hosting of the application and databases.
• Razorpay — payment and subscription processing for paid plans. We do not store card details.
• Google — only where a business connects Google services for the optional SEO features, and analytics for our own website.
• OpenAI / Anthropic — only where a business has explicitly enabled the optional AI auto-reply assistant on a WhatsApp number (off by default), and only to generate that reply. See section 4. These providers are located outside India; the transfer is limited to the message content needed for the reply and is made under their API terms, which exclude API content from model training.

9. Data Security

We use industry-standard safeguards including encryption in transit (HTTPS/TLS), access controls, and secure authentication to protect your information. No method of transmission or storage is 100% secure, but we work to protect your data and continuously improve our security practices.

10. Your Rights

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Withdraw consent or object to certain processing.
• Request a copy of your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at meshitsolutions@gmail.com or support@meshitsolutions.com. We respond within 30 days. If you are the customer of a business using MeshTack, see section 1 — that business controls your conversation data, and we will forward your request to them and support them in answering it.

Indian users have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correct and erase personal data and to nominate another person to exercise those rights. Grievances may be sent to our Grievance Officer, Rakesh Kumar Khandelwal — see section 13 for contact details.

11. Children's Privacy

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you within the app. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact Us & Grievance Officer

If you have any questions about this Privacy Policy or our data practices, or wish to raise a grievance, contact us at:

Meshit Solutions OPC Pvt Ltd
Email: meshitsolutions@gmail.com
Support: support@meshitsolutions.com
General enquiries: info@meshitsolutions.com
Phone: +91 92178 25076

Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made thereunder, the contact details of our Grievance Officer are:

Rakesh Kumar Khandelwal
Grievance Officer, Meshit Solutions OPC Pvt Ltd
Email: meshitsolutions@gmail.com
Alternate: support@meshitsolutions.com
WhatsApp / Phone: +91 92178 25076

We acknowledge grievances within 48 hours and resolve them within 30 days of receipt.