Privacy Policy

This Privacy Policy explains how Slimhippo Technologies LLP(“ wacrm”, “we”, “us”) handles personal data in the wacrm service. It covers our website, the wacrm application, and data we receive through the WhatsApp Business Platform operated by Meta.

1. Who we are

Slimhippo Technologies LLP operates wacrm, a customer-relationship tool for businesses that communicate with their customers on WhatsApp. You can reach us at contact@slimhippo.in for any privacy question, including the requests described in section 8.

2. Two different roles we play

This distinction decides who can act on a request about a given record, so it is worth stating plainly:

• For our own customers — the businesses that sign up for wacrm — we are the data controller. We decide how account and billing data is handled, and you can ask us directly to change or delete it.
• For our customers' customers — the people those businesses message on WhatsApp — we are a data processor. We store and process those conversations on the business's behalf and under its instructions. We do not decide what they are used for, and we do not contact those people ourselves.

If you were messaged by a business using wacrm and want your data removed, the fastest route is to ask that business, since it controls the record. You may also write to us at contact@slimhippo.in and we will forward the request to them and support them in carrying it out.

3. What we collect

Account data

• Name, email address and password hash of each user.
• The account (business) a user belongs to and their role in it.
• Team invitations you send, and their status.
• Plan, message-credit balance and billing status for the account.

WhatsApp data

When you connect a WhatsApp Business phone number, Meta delivers events to our webhook. From those events and your use of the app we store:

• The phone number, WhatsApp profile name and WhatsApp ID of people who message your business.
• Message content — text, images, video, audio, documents, stickers, locations and reactions — sent to and from your business number, plus delivery and read status.
• Contact records your team creates around those numbers: tags, notes, pipeline stage and any custom fields you define.
• Your WhatsApp Business access token and webhook verify token, which are encrypted at restusing AES-256-GCM. They are decrypted only in memory, only to call Meta's API on your behalf.

Technical data

• A session cookie so you stay logged in. It is strictly necessary; we do not use advertising or tracking cookies.
• Server logs containing IP address, timestamp and request path, kept for security and debugging.

4. What we do with it

• Operate the service: deliver, display and organise your messages.
• Authenticate users and enforce account and role permissions.
• Meter usage and apply your plan's sending limits.
• Detect and prevent abuse, fraud and security incidents (this is why we rate-limit and log).
• Provide support when you ask for it.

We do not sell personal data. We do not use the contents of your WhatsApp conversations for advertising, and we do not use them to train machine-learning models.

5. AI features

wacrm can draft replies and auto-respond using an AI provider. This is off unless an account enables it and supplies its own provider API key. When it is on, the relevant part of the conversation is sent to the provider that account chose, under that provider's terms, purely to generate the reply. Turning the feature off stops any further transmission.

6. Who else touches your data

• Meta Platforms — delivers and receives every WhatsApp message, under the WhatsApp Business Terms.
• Our hosting provider — runs the servers and database where your data is stored.
• An AI provider of your choosing — only if you enable the AI features described above.

We may also disclose data where the law requires it, or to establish or defend a legal claim. Beyond that we do not share it.

7. How long we keep it

• Messages, contacts and media— for as long as your account is open, because the product's purpose is to keep conversation history available to your team. You can delete individual contacts and their history at any time from within the app.
• Account data — for as long as the account is open.
• After a deletion request — removed from live systems within 30 days, and from encrypted backups within 90 days, after which backups holding it have rotated out.
• Records we must keep — a minimal record that a deletion happened, and any transaction records tax law requires us to retain.

8. Your rights

Subject to local law, you may ask us to access, correct, export or delete your personal data, or to restrict or object to how we use it. Write to contact@slimhippo.in, or use the form at Delete Your Data.

We verify identity before acting on a deletion request. That step is deliberate: the request form is public, and without verification anyone could erase somebody else's account by typing their address.

9. Security

• All traffic is served over HTTPS.
• WhatsApp access tokens and webhook verify tokens are encrypted at rest with AES-256-GCM.
• Passwords are stored only as salted hashes, never in plain text.
• Every account's data is isolated by row-level security in the database, so one account cannot read another's.
• Inbound webhooks are rejected unless they carry a valid HMAC-SHA256 signature from Meta.

No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting your data we will notify you and any regulator the law requires, without undue delay.

10. International transfers

Your data may be processed in countries other than your own, including by Meta as it routes WhatsApp messages. Where the law requires it, we rely on appropriate safeguards for those transfers.

11. Children

wacrm is a business tool and is not directed at children under 16. We do not knowingly collect their data. If you believe a child's data has reached us, contact us and we will delete it.

12. Changes

We may update this policy. The “last updated” date at the top always reflects the current version, and we will tell account owners about material changes before they take effect.

13. Contact

Slimhippo Technologies LLP
Email: contact@slimhippo.in